Data processing method and device, storage medium and computer equipment

Abstract

The embodiment of the invention provides a data processing method and device, a storage medium and computer equipment, and the method comprises the steps: transmitting a verification equipment public key to data publishing equipment during data publishing, thereby enabling the data publishing equipment to employ the verification equipment public key to encrypt an original key; the encrypted first encryption key and the encrypted data ontology are used as encrypted data to be published together; when the data processing equipment receives encrypted data, a data access request carrying the processing equipment public key and the first encryption key is sent to the verification equipment, so that the verification equipment decrypts the first encryption key by adopting the verification equipment private key to obtain an original key, and encrypts the original key through the processing equipment public key to obtain the encrypted data; and returning the second encryption key obtained by encryption to the data processing equipment, so that the data processing equipment decrypts the second encryption key by using the processing equipment private key to obtain the original key, and decrypts the encrypted data body to obtain the original data, thereby improving the security of the data.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a data processing method, device, storage medium and computer equipment. Background Art

[0002] With the rapid development of information technology, data has become an important resource and core asset of the modern economy and society. The state attaches great importance to the management of data assets and the protection of data privacy, and actively builds and improves the data protection system through laws, regulations and policy measures to ensure the security and privacy of data during collection, storage, use and transmission.

[0003] In the related art, the data sharing method lacks comprehensive data encryption measures and usually relies only on a simple API Key or single-factor authentication. This method only implements data access control, but in the process of data transmission, such as through a content delivery network (CDN), it is easy to be intercepted or tampered with, posing a security risk. Summary of the invention

[0004] The main purpose of this application is to provide a data processing method, device, storage medium and computer equipment, aiming to provide a new key management method to improve the security of data during data transmission. The technical solution is as follows:

[0005] In a first aspect, an embodiment of the present application provides a data processing method, which is applied to a verification device, including:

[0006] Receive a data access request sent by a data processing device, the data access request carrying a processing device public key of the data processing device and a first encryption key, the data access request is a request generated when the data processing device applies for access to encrypted data, the encrypted data carries an encrypted data body and the first encryption key, the encrypted data body is obtained by encrypting original data by a data publishing device based on an original key, and the first encryption key is obtained by encrypting the original key by the data publishing device using the verification device public key of the verification device;

[0007] Decrypting the first encryption key by verifying the device private key to obtain the original key;

[0008] Encrypting the original key by using the public key of the processing device to obtain a second encrypted key;

[0009] The second encryption key is sent to the data processing device so that the data processing device decrypts the second encryption key by using the processing device private key to obtain the original key, and decrypts the encrypted data body by using the original key to obtain the original data.

[0010] In a second aspect, an embodiment of the present application provides a data processing method, which is applied to a data publishing device, including:

[0011] Acquire original data, and send a verification device public key acquisition request to the verification device, so that the verification device returns the verification device public key according to the verification device public key acquisition request;

[0012] Generate an original key, and encrypt the original data by using the original key to obtain the encrypted data body;

[0013] The original key is encrypted by the public key of the verification device to obtain an encrypted key;

[0014] The encryption key and the encrypted data body are encapsulated to obtain the encrypted data, so as to publish the encrypted data.

[0015] In a third aspect, an embodiment of the present application provides a data processing method, which is applied to a data processing device, including:

[0016] Acquire encrypted data, parse the encrypted data, and parse out the encrypted data body and the first encryption key, wherein the encrypted data body is obtained by encrypting the original data by the data publishing device based on the original key, and the first encryption key is obtained by encrypting the original key by the data publishing device based on the public key of the verification device;

[0017] Sending a data access request to the verification device, the data access request carrying a processing device public key of the data processing device and the first encryption key;

[0018] Receive a second encryption key sent by the verification device, decrypt the second encryption key by using the processing device private key to obtain the original key, the second encryption key is obtained by the verification device decrypting the first encryption key by using the verification device private key to obtain the original key, and encrypting the original key by using the processing device public key;

[0019] The encrypted data body is decrypted using the original key to obtain the original data.

[0020] In a fourth aspect, an embodiment of the present application provides a data processing device, which is applied to a verification device, including:

[0021] A receiving unit, used for receiving a data access request sent by a data processing device, the data access request carrying a processing device public key of the data processing device and a first encryption key, the data access request is a request generated when the data processing device applies for access to encrypted data, the encrypted data carries an encrypted data body and the first encryption key, the encrypted data body is obtained by encrypting original data by a data publishing device based on an original key, and the first encryption key is obtained by encrypting the original key by the data publishing device using a verification device public key of a verification device;

[0022] A first decryption unit, used to decrypt the first encryption key by using a private key of the verification device to obtain the original key;

[0023] A first encryption unit, configured to encrypt the original key by using the public key of the processing device to obtain a second encryption key;

[0024] The first sending unit is used to send the second encryption key to the data processing device, so that the data processing device decrypts the second encryption key through the processing device private key to obtain the original key, and decrypts the encrypted data body through the original key to obtain the original data.

[0025] In a fifth aspect, an embodiment of the present application provides a data processing device, which is applied to a data publishing device, including:

[0026] A second sending unit is used to obtain original data and send a verification device public key acquisition request to the verification device, so that the verification device returns the verification device public key according to the verification device public key acquisition request;

[0027] The second encryption unit is used to generate an original key, and encrypt the original data by using the original key to obtain the encrypted data body;

[0028] A third encryption unit, used to encrypt the original key by using the public key of the verification device to obtain an encrypted key;

[0029] The encapsulation unit is used to encapsulate the encryption key and the encrypted data body to obtain the encrypted data so as to publish the encrypted data.

[0030] In a sixth aspect, an embodiment of the present application provides a data processing apparatus, applied to a data processing device, including:

[0031] A parsing unit, used to obtain encrypted data, parse the encrypted data, and parse out the encrypted data body and a first encryption key, wherein the encrypted data body is obtained by encrypting the original data by the data publishing device based on the original key, and the first encryption key is obtained by encrypting the original key by the data publishing device based on the public key of the verification device;

[0032] A third sending unit, configured to send a data access request to the verification device, where the data access request carries a processing device public key of the data processing device and the first encryption key;

[0033] A second decryption unit is used to receive a second encryption key sent by the verification device, and decrypt the second encryption key by using the processing device private key to obtain the original key, wherein the second encryption key is obtained by decrypting the first encryption key by the verification device using the verification device private key and encrypting the original key by using the processing device public key;

[0034] The third decryption unit is used to decrypt the encrypted data body by using the original key to obtain the original data.

[0035] In a seventh aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a plurality of instructions suitable for loading by a processor to execute any of the above data processing methods.

[0036] In an eighth aspect, an embodiment of the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above data processing methods when executing the computer program.

[0037] In the embodiment of the present application, when the data publishing device publishes data, the public key of the verification device is sent to the data publishing device, so that the data publishing device uses the public key of the verification device to encrypt the original key used to encrypt the original data, so that the first encryption key and the encrypted data body obtained by encryption are published together as encrypted data; when the data processing device receives the encrypted data, it is necessary to send a data access request carrying the public key of the processing device and the first encryption key to the verification device, so that the verification device uses the private key of the verification device to decrypt the first encryption key, obtain the original key, and encrypt the original key by the public key of the processing device, and return the encrypted second encryption key to the data processing device, so that the data processing device uses the private key of the processing device to decrypt the second encryption key, obtain the original key, and decrypt the encrypted data body by the original key to obtain the original data. In this way, the verification device provides the data publishing device and the data processing device with key encryption when publishing data and key decryption when processing data, so as to avoid the original key being intercepted due to direct transmission, causing the encrypted data body to be maliciously decrypted, so as to improve the security of the original key, thereby reducing the risk of malicious decryption of the encrypted data body, and improving the security of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 A schematic diagram of a data processing system according to an embodiment of the present invention.

[0040] Figure 2 A flowchart of a data processing method provided in an embodiment of the present application.

[0041] Figure 3 Another flowchart of the data processing method provided in an embodiment of the present application.

[0042] Figure 4 Another flowchart of the data processing method provided in an embodiment of the present application.

[0043] Figure 5 A file format diagram of a slice file format provided in an embodiment of the present application.

[0044] Figure 6 A schematic diagram of the data format of encrypted data provided in an embodiment of the present application.

[0045] Figure 7 Another flowchart of the data processing method provided in an embodiment of the present application.

[0046] Figure 8 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application.

[0047] Fig. 9 Another structural schematic diagram of the data processing device provided in an embodiment of the present application.

[0048] Fig.10 Another structural schematic diagram of the data processing device provided in an embodiment of the present application.

[0049] Fig.11 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0051] It should be noted that in some processes described in the specification, claims and the above-mentioned drawings, multiple steps appearing in a specific order are included, but it should be clearly understood that these steps may not be executed in the order in which they appear in this document or may be executed in parallel. The step numbers are only used to distinguish different steps, and the numbers themselves do not represent any execution order. In addition, descriptions such as "first", "second" or "target" in this document are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0052] Before further describing the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are described. The nouns and terms involved in the embodiments of the present disclosure are subject to the following interpretations:

[0053] Content Delivery Network (CDN) aims to avoid bottlenecks and links on the Internet that may affect the speed and stability of data transmission as much as possible, so as to make content transmission faster and more stable. By placing node servers in various places on the network to form a layer of intelligent virtual network on the existing Internet, the CDN system can redirect user requests to the service node closest to the user in real time based on comprehensive information such as network traffic and the connection and load status of each node, as well as the distance to the user and response time. Its purpose is to enable users to obtain the required content nearby, solve the problem of network congestion, and improve the response speed of users visiting websites.

[0054] A key is usually a key used to encrypt and decrypt data. This key can be a combination of numbers, letters or symbols to protect data from unauthorized access.

[0055] Stream data is a continuously generated, real-time, dynamically changing data set. Unlike batch data, stream data does not process a fixed set of data at one time, but processes real-time data continuously. Stream data usually comes from various real-time events, such as sensor data, social media messages, financial transactions, network logs, etc.

[0056] Asymmetric encryption is a technology that ensures data security. It contains two keys (public key and private key). First, the private key is calculated based on the key generation algorithm. Then, the public key is generated based on the private key using another algorithm. The generation process of the public key is irreversible. Since it is difficult to exhaustively derive the private key from the public key (i.e., it is computationally unfeasible), the data is considered safe, thus achieving the effect of ensuring data security.

[0057] Hash-based Message Authentication Code (HMAC) is an authentication code based on a hash function, which is used to verify the integrity and authenticity of a message and prevent the message from being tampered with. A specific hash algorithm and specific rules are used to combine data. This rule is usually to XOR or concatenate the key bitwise to the front or back of the message. The combined data is used as input and calculated by the selected hash algorithm. The hash function operates on the input data and generates a hash value of a fixed length. The operation process of the hash function is usually to divide the input data into blocks of fixed size, then operate on each block and combine the result with the result of the previous block until all blocks are processed. Finally, the hash function will output a fixed-length HMAC value as the result.

[0058] Identity declaration information (Json web token, JWT) is an open standard based on JSON (RFC 7519) for transferring declarations between network application environments. The token is designed to be compact and secure, and is particularly suitable for single sign-on (SSO) scenarios of distributed sites. JWT declarations are generally used to transfer authenticated user identity information between identity providers and service providers to facilitate the acquisition of resources from resource servers. Some additional declaration information required for other business logic can also be added. The token can also be used directly for authentication or encrypted.

[0059] Uniform resource locator (URL) is a method used to specify the location of information on the World Wide Web service program of the Internet.

[0060] At present, users in the field of big data processing mainly process and share data in batches, and perform data analysis and data mining based on the generated processed batch data. However, due to the high value and high sensitivity of some data, data owners are also very concerned about the security of the data sharing process. If there is a lack of appropriate security measures, it may lead to the leakage of commercial secrets or the theft of sensitive information, causing immeasurable economic losses and reputation damage. Therefore, there is an urgent need for an efficient, secure, and real-time data encryption method and system to ensure the security of data during distribution and sharing.

[0061] In order to solve the above problems, the embodiment of the present application proposes to send the public key of the verification device to the data publishing device when the data publishing device publishes data, so that the data publishing device uses the public key of the verification device to encrypt the original key used to encrypt the original data, so as to publish the first encryption key and the encrypted data body obtained by encryption as encrypted data; when the data processing device receives the encrypted data, it is necessary to send a data access request carrying the public key of the processing device and the first encryption key to the verification device, so that the verification device uses the private key of the verification device to decrypt the first encryption key, obtain the original key, and encrypt the original key by the public key of the processing device, and return the encrypted second encryption key to the data processing device, so that the data processing device uses the private key of the processing device to decrypt the second encryption key, obtain the original key, and decrypt the encrypted data body by the original key to obtain the original data. In this way, the data publishing device and the data processing device are provided with encryption and decryption services of the original key through the verification device, so as to improve the security of the original key, thereby improving the security of the data. Please continue to refer to the following specific embodiments for details.

[0062] See also Figure 1 , Figure 1 A scenario diagram of a data processing system provided in an embodiment of the present application. It includes a data publishing device, a data processing device, and a verification device. The data publishing device is used to pull data from a data source to publish the pulled data through a network; the data processing device is used to obtain data from the network and perform corresponding processing on the obtained data to deliver the processed data to a data application; the verification device is used to encrypt the data with a key when the data publishing device publishes the data to implement key management, and to implement verification authorization management when the data processing device applies to access the obtained encrypted data.

[0063] Among them, data publishing equipment, data processing equipment and verification equipment are computer equipment, which refers to a computer system that can provide certain services to terminals. Compared with ordinary terminals, computer equipment has higher requirements in terms of stability, security, performance, etc. Computer equipment can be a high-performance computer in a network platform, a cluster of multiple high-performance computers, a part of a high-performance computer (such as a virtual machine), a combination of parts of multiple high-performance computers (such as virtual machines), etc.

[0064] Data publishing equipment and data processing equipment may also be terminals including but not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc. In addition, it may be a single device or a collection of multiple devices. The terminal may communicate with the network in a wired or wireless manner to exchange data.

[0065] The data transmission method according to the embodiment of the present disclosure may be implemented on a computer device.

[0066] It should be noted that Figure 1 The scenario diagram of the data processing system shown is merely an example. The data processing system and scenario described in the embodiment of the present application are intended to more clearly illustrate the technical solution of the embodiment of the present application, and do not constitute a limitation on the technical solution provided in the embodiment of the present application. A person of ordinary skill in the art can appreciate that with the evolution of data processing and the emergence of new business scenarios, the technical solution provided in the embodiment of the present application is equally applicable to similar technical problems.

[0067] For details, please refer to Figure 2 , Figure 2 A flow chart of a data processing method provided in an embodiment of the present application. The data processing method is applied to a verification device and includes:

[0068] In step 201, a data access request sent by a data processing device is received.

[0069] The data access request is a request generated when the data processing device applies for access to encrypted data. The encrypted data is data obtained by the data processing device through a distribution network such as a CDN network and published by the data publishing device after being encrypted.

[0070] Specifically, the encrypted data carries the encrypted data body and the first encryption key. The encrypted data body payload is obtained by the data publishing device encrypting the original data based on the original key key. The first encryption key skey is obtained by the data publishing device encrypting the original key key through the verification device public key pubkey of the verification device.

[0071] That is, when publishing data, the data publishing device needs to encrypt the original data using the original key key to obtain the encrypted data body payload, and encrypt the original key key using the verification device public key pubkey of the verification device to obtain the first encryption key skey. When the data is published, the encrypted data body payload and the first encryption key skey are published together in the form of encrypted data, so that the data processing device can obtain the encrypted data body payload and the first encryption key skey when receiving the encrypted data.

[0072] When applying to access the encrypted data, the data processing device needs to send the first encryption key skey and the processing device public key cpubkey to the verification device along with the data access request, so that the verification device receives the first encryption key skey and the processing device public key cpubkey.

[0073] The original data is the stream data obtained by the data publishing device from the data stream.

[0074] In step 202, the first encryption key is decrypted by verifying the device private key to obtain the original key.

[0075] Among them, since the first encryption key skey is obtained by encrypting the original key key using the verification device public key pubkey by the data publishing device, after the verification device receives the first encryption key skey, it can decrypt the first encryption key sky according to the verification device private key privatekey to obtain the original key key.

[0076] Specifically, the decryption algorithm may be implemented by using an asymmetric encryption algorithm, such as RSA.

[0077] In step 203, the original key is encrypted by processing the device public key to obtain a second encrypted key.

[0078] Among them, since the data processing device needs the original key key to decrypt the encrypted data body payload to obtain the original data, the data processing device needs to obtain the original key key. To ensure the security of the original key key during transmission, the verification device encrypts the original key key through the processing device public key cpubkey sent by the data processing device to obtain the second encryption key cskey.

[0079] In step 204, the second encryption key is sent to the data processing device, so that the data processing device decrypts the second encryption key by using the processing device private key to obtain the original key, and decrypts the encrypted data body by using the original key to obtain the original data.

[0080] Among them, after encrypting to obtain the second encryption key cskey, the second encryption key cskey is returned to the data processing device. Since the second encryption key cskey is obtained by encrypting the original key key using the processing device public key cpubkey of the data processing device, the data processing device can decrypt the second encryption key cskey through the processing device private key cprivatekey to decrypt the original key key, and decrypt the encrypted data body payload through the original key key to obtain the original data.

[0081] As can be seen from the above, the embodiment of the present application sends the public key of the verification device to the data publishing device when the data publishing device publishes data, so that the data publishing device uses the public key of the verification device to encrypt the original key used to encrypt the original data, so as to publish the first encryption key and the encrypted data body as encrypted data; when the data processing device receives the encrypted data, it is necessary to send a data access request carrying the public key of the processing device and the first encryption key to the verification device, so that the verification device uses the private key of the verification device to decrypt the first encryption key, obtain the original key, and encrypt the original key by the public key of the processing device, and return the encrypted second encryption key to the data processing device, so that the data processing device uses the private key of the processing device to decrypt the second encryption key, obtain the original key, and decrypt the encrypted data body by the original key to obtain the original data. In this way, the verification device provides the data publishing device and the data processing device with key encryption when publishing data and key decryption when processing data, so as to avoid the original key being intercepted due to direct transmission, causing the encrypted data body to be maliciously decrypted, so as to improve the security of the original key, thereby reducing the risk of malicious decryption of the encrypted data body, and improving the security of the data.

[0082] In some embodiments, Figure 3 As shown, Figure 3 Another flow chart of the data processing method provided in the embodiment of the present application. The data processing method includes:

[0083] In step 301, a request for obtaining a public key of a verification device sent by a data publishing device is received, and a public key of the verification device is sent to the data publishing device, triggering the data publishing device to encrypt the original key to obtain a first encryption key.

[0084] Among them, this step is the interaction process between the data publishing device and the verification device. When the data publishing device is ready to publish data, it will send a verification device public key acquisition request to the verification device to obtain the verification device public key pubkey from the verification device. When the verification device receives the verification device public key acquisition request, it will return its own verification device public key pubkey to the data publishing device, so that the data publishing device obtains the verification device public key pubkey, and encrypts the original key key through the verification device public key pubkey to obtain the first encryption key skey.

[0085] Specifically, the original key is an encryption key required to encrypt stream data in the data stream.

[0086] In step 302, in response to the access permission configuration instruction for the data flow, the access user permission and access time permission required for accessing the data flow are determined.

[0087] The data publisher will add the user rights to access the data stream and set the access time rights to access the data stream. The data publisher can access the verification device through the data publishing device to implement the permission configuration instructions for the data stream to be published, or set up a permission configuration system dedicated to configuring permissions in the verification device so that the user can implement the permission configuration instructions in the permission configuration system. The specific implementation method of the permission configuration instructions is not limited here.

[0088] For example, data publisher A sets that only user IDs that have established a friend relationship with data publisher A can access the data stream during the time period from 12:00 to 13:00.

[0089] In step 303, a data access request sent by a data processing device is received.

[0090] Among them, step 303 to step 310 are the interaction process between the data processing device and the verification device. When the data processing device is ready to access the encrypted data, it will send a data access request to the verification device to apply to the verification device for access to the encrypted data.

[0091] Specifically, the data access request carries an encrypted data body payload and the first encryption key skey. The encrypted data body payload and the first encryption key skey are obtained by the data processing device by parsing the encrypted data. After parsing the encrypted data body payload and the first encryption key skey, the data processing device packages its own processing device public key cpubkey combined with the first encryption key skey into a data access request, so that the verification device can obtain the processing device public key cpubkey and the first encryption key skey in the process of sending the data access request to the verification device.

[0092] In step 304, the first encryption key is decrypted by verifying the device private key to obtain the original key.

[0093] Among them, since the first encryption key skey is obtained by encrypting the original key key using the verification device public key pubkey by the data publishing device, after the verification device receives the first encryption key skey, it can decrypt the first encryption key sky according to the verification device private key privatekey to obtain the original key key.

[0094] Specifically, before the verification device decrypts the first encryption key through the verification device private key to obtain the original key, it can also verify the identity of the target user. The specific verification method is that the verification device calls the interface (API) of the user management system to verify the validity of the identity declaration information JWT. If the verification is successful, step 305 is executed. If the verification fails, the verification device returns an error message and records a log. The identity declaration information JWT contains user identity information and session information. When the data processing device sends a data access request later, the data processing device puts the identity declaration information JWT into the header of the data access request, and the verification device verifies the identity of the target user. The user management system can be configured in the verification device or in a third-party device, which is not limited here. When the user management system is configured in the verification device, the verification device will receive the user login information sent by the data processing device, and authenticate the target user according to the user login information. If the identity authentication is successful, the first encryption key is decrypted through the verification device private key to obtain the original key.

[0095] In step 305, a second authentication code is generated based on the original key and the data flow identifier.

[0096] When the original data is stream data, in order to ensure the data integrity of the stream data and prevent it from being tampered with, the verification device can also determine whether the stream data is complete and has not been tampered with by verifying the authentication code.

[0097] Specifically, the embodiment of the present application provides a method for generating a message authentication code, which uses the original key key combined with the data stream identifier streamid of the data stream to which the encrypted data body belongs to generate the authentication code. The specific method for generating the message authentication code can be to combine the original key key and the data stream identifier streamid according to specific rules. The combined data is used as input, and the message authentication code is calculated by a selected hash algorithm (such as SHA256).

[0098] The second authentication code is generated by the verification device through a message authentication code based on the data stream identifier streamid sent by the data processing device and the original key key decrypted in step 303.

[0099] In step 306, the first authentication code is compared with the second authentication code.

[0100] The first authentication code is an authentication code generated by the data publishing device based on the original key and the data stream identifier. The first authentication code is encapsulated into the encrypted data and published together with the encrypted data, so that the data processing device obtains the first authentication code. After obtaining the first authentication code, the data processing device sends the first authentication code together with the data access request to the verification device, so that the verification device obtains the first authentication code.

[0101] Specifically, after the verification device generates the second verification code in step 305, the verification device compares the first verification code carried in the data access request with the generated second verification code to determine whether the stream data is complete and has not been tampered with.

[0102] In step 307, if the first authentication code is the same as the second authentication code, the target user identifier of the target user is determined according to the identity declaration information.

[0103] Among them, if the first authentication code is the same as the second authentication code, it means that the stream data is complete and has not been tampered with. Then verify whether the authorization for the encrypted data is passed. The authorization verification requires obtaining the target user identifier uid of the target user. The target user identifier uid can be obtained through the identity declaration information JWT.

[0104] In step 308, the access user authority and the access time authority configured for the data flow corresponding to the data flow identifier are obtained.

[0105] Among them, since before publishing the data stream, the data publisher needs to implement the permission configuration instructions for the data stream to be published to set the access time permission for accessing the data stream, it is necessary to obtain the previously configured access user permission and access time permission for the data stream configuration corresponding to the data stream identifier.

[0106] Specifically, when a data publishing device publishes encrypted data, the data stream identifier encapsulates the identifier of the data stream to which the encrypted data belongs into the encrypted data, so that the data processing device parses the encrypted data to obtain the data stream identifier, and then sends the data stream identifier to the verification device together with the data access request.

[0107] In step 309, if the target user identifier satisfies the access user authority and the current time satisfies the access time authority, the original key is encrypted by processing the device public key to obtain a second encryption key.

[0108] If the target user identifier satisfies the access user authority and the current time satisfies the access time authority, it means that the access can be authorized, and the original key is encrypted by processing the device public key to obtain a second encryption key.

[0109] For example, data publisher A sets that only user IDs that have established a friend relationship with data publisher A can access the data stream during the time period from 12:00 to 13:00. The user IDs that have established a friend relationship with data publisher A include user ID1, user ID2, and user ID3. The user ID of the target user is ID2, and the current time is 12:30, then this access can be authorized.

[0110] In step 310, the second encryption key is sent to the data processing device, so that the data processing device decrypts the second encryption key by using the processing device private key to obtain the original key, and decrypts the encrypted data body by using the original key to obtain the original data.

[0111] Among them, after encrypting to obtain the second encryption key cskey, the second encryption key cskey is returned to the data processing device. Since the second encryption key cskey is obtained by encrypting the original key key using the processing device public key cpubkey of the data processing device, the data processing device can decrypt the second encryption key cskey through the processing device private key cprivatekey to decrypt the original key key, and decrypt the encrypted data body payload through the original key key to obtain the original data.

[0112] In some implementations, after the data publishing device encrypts the original data using the original key to obtain the encrypted data body, it may further include:

[0113] Divide the original key into specified numbers to obtain the original sub-key sequence;

[0114] Assign a subkey identifier to each original subkey so that the subkey identifiers of the original subkeys are different;

[0115] Determine a subkey identifier sequence composed of the subkey identifiers corresponding to each original subkey in the original subkey sequence;

[0116] Randomly sorting the original subkeys in the original subkey sequence to obtain a target subkey sequence;

[0117] Obtain a target subkey identifier sequence composed of the subkey identifiers corresponding to each original subkey in the target subkey sequence;

[0118] Encrypting the target subkey identification sequence using the verification device public key to obtain a first encrypted subkey identification sequence;

[0119] Encrypting the target subkey sequence using the verification device public key to obtain a first encrypted subkey sequence;

[0120] The first encryption subkey sequence, the first encryption subkey identification sequence and the encrypted data body are encapsulated to obtain encrypted data.

[0121] For example, if the original key is "abcgfdh" and the specified number is 3, the original key is divided into 3 parts, and the original subkey sequence is: "abc", "gf", "dh", where the subkey identifier of the original subkey "abc" is q, the subkey identifier of the original subkey "gf" is e, and the subkey identifier of the original subkey "dh" is r. The subkey identifier sequence is qer, and after the original subkeys are randomly sorted, the target original subkey sequence is "gf", "dh", "abc". Then the target subkey identifier sequence is erq, and the target subkey identifier sequence erq is encrypted using the verification device public key pubkey to obtain the first encrypted subkey identifier sequence; the target original subkey sequence is encrypted using the verification device public key pubkey to obtain the first encrypted subkey sequence.

[0122] The first encryption subkey sequence, the first encryption subkey identification sequence and the encrypted data body are encapsulated to obtain encrypted data.

[0123] After the data processing device receives the encrypted data, the first encryption subkey sequence and the first encryption subkey identification sequence carried in the encrypted data can be parsed out by parsing;

[0124] The data access request sent by the data processing device to the verification device may also carry a first encrypted subkey sequence and a first encrypted subkey identification sequence, so that the verification device decrypts the first encrypted subkey sequence according to the verification device private key to obtain a target subkey sequence, and decrypts the first encrypted subkey identification sequence according to the verification device private key to obtain a target subkey identification sequence;

[0125] encrypting the target subkey sequence by processing the device public key to obtain a second encrypted subkey sequence;

[0126] encrypting the target subkey identification sequence by processing the device public key to obtain a second encrypted subkey identification sequence, and returning the second encrypted subkey sequence and the second encrypted subkey identification sequence to the data processing device;

[0127] The data processing device, upon receiving the second encrypted subkey identification sequence and the second encrypted subkey identification sequence, decrypts the second encrypted subkey sequence according to the processing device private key to obtain the target subkey sequence;

[0128] Decrypting the second encrypted subkey identification sequence according to the processing device private key to obtain a target subkey identification sequence;

[0129] Since the data processing device cannot know the correct arrangement order of the subkeys in the original key, the digital certificate of the data processing device can be sent to the data publishing device to verify whether the data processing device is a trusted device through the data publishing device. If so, the data publishing device will return the correct subkey identification sequence when the data is published to the data processing device. Or after obtaining the subkey identification sequence, the data publishing device directly sends it to the trusted device of the data publishing device such as the data processing device. In this way, even if other devices intercept and crack the target subkey identification sequence, they cannot rearrange the original subkeys in the target subkey sequence to restore the original key.

[0130] According to the subkey identification sequence and the target subkey identification sequence, the order of the original subkeys in the target subkey identification sequence is adjusted to obtain the original key.

[0131] For example, if the target subkey identification sequence is erq, the target subkey identification sequence is "gf", "dh", "abc", and the subkey identification sequence is qer, it means that the original subkey "abc" ranks first in the sequence of the original key, the original subkey "gf" ranks second in the sequence of the original key, and the original subkey "dh" ranks third in the sequence of the original key, then the adjusted original key is "abcgfdh". By dividing the original key, and randomly sorting the sequence composed of the divided original subkeys, and encrypting the randomly sorted target subkey sequence and the target subkey identification sequence composed of each original subkey corresponding to the identification in the target subkey identification sequence, the subsequent data processing device needs to decrypt the target subkey sequence and the target subkey identification sequence through the verification device, and adjust the order of the original subkeys in the target subkey identification sequence according to the subkey identification sequence and the target subkey identification sequence, and restore the original key, further enhancing the difficulty of cracking the original key and improving the data security during data transmission.

[0132] In some embodiments, Figure 4 As shown, Figure 4 Another flow chart of the data processing method provided in the embodiment of the present application. The data processing method is applied to a data publishing device, including:

[0133] In step 401, original data is obtained, and a request for obtaining a verification device public key is sent to the verification device to obtain the verification device public key of the verification device from the verification device.

[0134] The original data is the data pulled from the data source. When the original data is static data, the data source is a data set consisting of multiple static data, and the data is pulled one by one. When the original data is dynamic data such as stream data, the data source is the data stream, and the data pulling method can include the following two data pulling methods:

[0135] (1) Segmentation by fixed size. Segment the data stream by fixed byte size. For example, split the data stream into segments of 1M bytes each.

[0136] (2) Segmentation by time interval. Segment the data stream by fixed time intervals. For example, generate a data block every 10 seconds.

[0137] Specifically, different data source protocol types can select different protocols to pull data from the data source, and package the data into raw data in the format of a slice file such as SliceFile according to the slicing strategy. Slice files are the basic unit for internal processing of data streams. Each slice file contains two parts: a file header and data payload data. The file format is as follows: Figure 5 As shown, Figure 5 A schematic diagram of the file format of the slice file format provided in the embodiment of the present application. The file format of the slice file format includes:

[0138] (1) Data payload: the actual data content, which can be any type of byte stream.

[0139] (2) File header: Contains metadata related to the data payload, including:

[0140] uuid: used to uniquely identify each shard; timestamp: the timestamp of the data shard creation; duration: indicates the length of the interval between shard generation; datasize: indicates the size of the data payload.

[0141] Among them, when publishing data, the data publishing device needs to encrypt the original key key through the verification device's verification device public key pubkey, so it is necessary to send a verification device public key acquisition request to the verification device to obtain the verification device public key pubkey of the verification device from the verification device.

[0142] In step 402, an original key is generated, and the original data is encrypted using the original key to obtain the encrypted data body.

[0143] The original key key is a random key of a specified length generated by the data publishing device. The original key key is encrypted using a symmetric encryption algorithm (such as AES-128) to generate an encrypted encrypted data body payload.

[0144] In step 403, the original key is encrypted by verifying the device public key to obtain a first encryption key.

[0145] The data publishing device encrypts the original key key using an asymmetric encryption algorithm (such as RSA) by using the public key pubkey of the verification device to generate a first encryption key skey.

[0146] In step 404, the first encryption key and the encrypted data body are encapsulated to obtain encrypted data, so as to publish the encrypted data.

[0147] Among them, in order to enable the data processing device that subsequently receives the published encrypted data to obtain the original key based on the first encryption key through key management interaction between the first encryption key and the verification device, the data publishing device needs to encapsulate the first encryption key and the encrypted data body so that the first encryption key and the encrypted data body are published together with the encrypted data.

[0148] Specifically, in the process of publishing encrypted data, the encrypted data with the .enc suffix obtained in the previous step will be added to the .list format stream list file for streaming data, and the stream list file and the encrypted data will be handed over to the network (such as the CDN network) for data distribution. The list file lists the latest N (for example, 10) data fragments. Each time newly generated encrypted data is added, the oldest encrypted data in the stream list file is deleted, and the latest encrypted data is added to the end of the stream list file. The encrypted data is named incrementally according to certain rules.

[0149] The following is an example of the generated stream list file content:

[0150] #LIST

[0151] http: / / cdn.com / stream / segment00210.enc

[0152] http: / / cdn.com / stream / segment00211.enc

[0153] http: / / cdn.com / stream / segment00212.enc

[0154] …

[0155] Among them, #LIST indicates the file type, *.enc is encrypted data, and *.enc can use a URL format path.

[0156] In some implementations, before encapsulating the first encryption key and the encrypted data body to obtain the encrypted data, the method further includes:

[0157] (1) Obtain a data stream identifier of the data stream to which the original data belongs.

[0158] Among them, since in the process of pulling the original data in the slice file format from the data source, the data publishing device can know from which data stream the original data is pulled, it can obtain the data stream identifier streamid of the data stream to which the original data belongs.

[0159] (2) Generate a first authentication code based on the data flow identifier and the original key.

[0160] The authentication code is generated by combining the original key key with the data stream identifier streamid of the data stream to which the encrypted data body belongs. The specific method for generating the message authentication code is to combine the original key key and the data stream identifier streamid according to specific rules. The combined data is used as input and the message authentication code is calculated by a selected hash algorithm (such as SHA256).

[0161] The encapsulating the first encryption key and the encrypted data body to obtain the encrypted data includes:

[0162] The data flow identifier, the first encryption key, the first authentication code and the encrypted data body are encapsulated to obtain encrypted data.

[0163] The first authentication code is used by the subsequent verification device to verify the data integrity of the data received by the data processing device to prevent tampering, and the verification method requires the verification device to generate a second authentication code based on the data flow identifier and the original key, and compare the first authentication code with the second authentication code to determine the data integrity to prevent tampering. Therefore, when encapsulating the first encryption key and the encrypted data body, it is also necessary to encapsulate the data flow identifier and the first authentication code to obtain the encrypted data.

[0164] Specifically, Figure 6 As shown, Figure 6A schematic diagram of the data format of encrypted data provided for an embodiment of the present application. Among them, the encrypted data format includes two parts: the encrypted data description information manifest and the encrypted data body payload. The encrypted data body and the encrypted information description information are encapsulated in a compressed file format (ZIP) to generate encrypted encrypted data. The encrypted data description information includes an encryption algorithm indication, a first encryption key skey, a data stream identifier streamid, a first authentication code, and a verification device access address url. The encryption algorithm indication is used to indicate the encryption algorithm used by the data publishing device when encrypting the original data through the original key key, so that the corresponding decryption algorithm needs to be adopted when the encryption algorithm indication is used to indicate that the data processing device needs to decrypt the encrypted data body through the original key key. The verification device access address url indicates the address where the verification device is located, which facilitates the data processing device to request access authorization from the verification device.

[0165] In some embodiments, Figure 7 As shown, Figure 7 A flow chart of a data processing method provided in an embodiment of the present application. The data processing method is applied to a data processing device, including:

[0166] In step 501, encrypted data is obtained, and the encrypted data is parsed to obtain the encrypted data body and the first encryption key.

[0167] Among them, for streaming data, the data processing device will cyclically request the specified .list stream list file from the network using the HTTP or HTTPS protocol at a specified time interval (for example, 1 second), parse the file content, obtain the encrypted data list, and download the corresponding encrypted data. When it is found that the content of the stream list file has been updated, the latest encrypted data is downloaded to obtain the encrypted data.

[0168] Specifically, since the data processing device needs to process the original data presented in plain text when processing data, it is necessary to parse the encrypted data to parse the encrypted data payload and the first encryption key skey from the encapsulated encrypted data. The encrypted data payload is obtained by the data publishing device encrypting the original data based on the original key key, and the first encryption key skey is obtained by the data publishing device encrypting the original key key based on the public key pubkey of the verification device;

[0169] In step 502, a data access request is sent to a verification device, where the data access request carries a processing device public key of a data processing device and a first encryption key.

[0170] Among them, since the first encryption key skey is obtained by the data publishing device encrypting the original key key according to the verification device public key pubkey of the verification device, the data processing device cannot decrypt the first encryption key skey at this time, so it is necessary to send a data access request carrying the processing device public key pubkey of the data processing device and the first encryption key skey to the verification device.

[0171] In step 503, the second encryption key sent by the verification device is received, and the second encryption key is decrypted by processing the device private key to obtain the original key.

[0172] After obtaining the processing device public key pubkey and the first encryption key skey from the data access request, the verification device will decrypt the first encryption key sky according to the verification device private key privatekey to obtain the original key key. In order to prevent the original key key from being intercepted during the process of sending it to the data processing device, the verification device also needs to encrypt the original key key by the processing device public key pubkey to send the encrypted second encryption key cskey to the data processing device.

[0173] Specifically, after receiving the second encryption key cskey, the data processing device may decrypt the second encryption key cskey according to the processing device private key cprivatekey to obtain the original key key.

[0174] In step 504, the encrypted data body is decrypted using the original key to obtain the original data.

[0175] Among them, since the encrypted data body is obtained by the data publishing device encrypting the original data through the original key according to the specified encryption algorithm, in the process of the data processing device using the original key to decrypt the encrypted data body, it is necessary to select the corresponding decryption algorithm according to the encryption algorithm indication of the encrypted data description information manifest of the encrypted data, so as to decrypt the encrypted data body through the decryption algorithm to obtain the original data.

[0176] In some implementations, the encrypted data further carries a first authentication code and a data stream identifier, where the data stream identifier is an identifier of a data stream to which the encrypted data body belongs. After parsing the encrypted data, the method further includes:

[0177] Parsing the first authentication code and the data flow identifier;

[0178] The sending of a data access request to the verification device, wherein the data access request carries a processing device public key of the data processing device and the first encryption key, comprises:

[0179] A data access request is sent to the verification device, where the data access request carries a processing device public key of the data processing device, the first encryption key, the first authentication code, and the data flow identifier.

[0180] Among them, in order to ensure the data integrity of the stream data and prevent tampering, the data publishing device will encapsulate the data stream identifier streamid of the data stream to which the encrypted data body belongs, and the first authentication code generated according to the data stream identifier streamid and the original key key into the encrypted data when publishing the encrypted data. In this way, the data processing device can parse the data stream identifier streamid and the first authentication code from the encrypted data when parsing the encrypted data.

[0181] Specifically, the verification of whether the stream data is complete and whether it has been tampered with is performed in the verification device, so the data processing device needs to send the first authentication code and the data stream identifier to the verification device together with the data access request.

[0182] In some implementations, before obtaining the encrypted data, the method further includes:

[0183] (1) obtaining user login information, sending the user login information to a verification device, so that the verification device verifies the user login information, and returns identity declaration information when the verification is successful;

[0184] (2) receiving identity declaration information returned by the verification device based on the user login information;

[0185] The sending of a data access request to the verification device, wherein the data access request carries a processing device public key of the data processing device, the first encryption key, the first authentication code, and the data flow identifier, comprises:

[0186] A data access request is sent to the verification device, where the data access request carries the processing device public key of the data processing device, the first encryption key, the first authentication code, the data flow identifier, and the identity declaration information.

[0187] Among them, when the user management system is configured in the verification device, the data processing device first sends the user identity information such as the user name and password to the user management system of the verification device for identity authentication. After the verification is passed, the user management system returns the identity declaration information JWT to the data processing device. The identity declaration information includes user identity information and session information. When the data processing device sends a data access request later, the data processing device puts the identity declaration information into the header of the data access request, and the verification device verifies the identity of the target user. The user management can also be configured in a third-party device, which is not limited here.

[0188] Specifically, after the data processing device obtains the original data, it can provide services using a specified protocol (such as the websocket protocol). The data application does not need to be modified, and the original protocol can be used to establish a connection with the data processing device, so that the existing data sharing system does not need to be modified or adapted to expand the data security sharing function. This can not only avoid the technical challenges brought by the upgrade of the existing system, but also reduce the cost and complexity of system access.

[0189] The specific implementation of the above steps can be found in the previous embodiments, which will not be described in detail here.

[0190] In order to better implement the data transmission method provided in the embodiment of the present application, the embodiment of the present application also provides a device based on the above data transmission method. The meanings of the terms are the same as those in the above data transmission method, and the specific implementation details can refer to the description in the method embodiment.

[0191] See also Figure 8 , Figure 8 The data transmission method device may include a receiving unit 601, a first decryption unit 602, a first encryption unit 603, and a first sending unit 604.

[0192] A receiving unit 601 is used to receive a data access request sent by a data processing device, wherein the data access request carries a processing device public key of the data processing device and a first encryption key. The data access request is a request generated when the data processing device applies for access to encrypted data. The encrypted data carries an encrypted data body and the first encryption key. The encrypted data body is obtained by encrypting original data by a data publishing device based on an original key. The first encryption key is obtained by encrypting the original key by the data publishing device using the verification device public key of a verification device.

[0193] A first decryption unit 602, configured to decrypt the first encryption key by using a verification device private key to obtain the original key;

[0194] A first encryption unit 603, configured to encrypt the original key using the processing device public key to obtain a second encryption key;

[0195] The first sending unit 604 is used to send the second encryption key to the data processing device, so that the data processing device decrypts the second encryption key through the processing device private key to obtain the original key, and decrypts the encrypted data body through the original key to obtain the original data.

[0196] In some embodiments, the device is further used to:

[0197] A request for obtaining a public key of a verification device sent by a data publishing device is received, and the public key of the verification device is sent to the data publishing device, triggering the data publishing device to encrypt the original key to obtain a first encryption key.

[0198] In some embodiments, the data access request also carries a first authentication code and a data stream identifier, wherein the first authentication code is an authentication code generated by the data publishing device based on the original key and the data stream identifier, and the data stream identifier is an identifier of a data stream to which the encrypted data body carried by the encrypted data to which the data processing device applies for access belongs. The device is further used to:

[0199] Generate a second authentication code based on the original key and the data stream identifier;

[0200] comparing the first authentication code with the second authentication code;

[0201] If the first authentication code is the same as the second authentication code, the step of encrypting the original key by using the processing device public key to obtain a second encrypted key is performed.

[0202] In some embodiments, the device is further used to:

[0203] In response to the access permission configuration instruction for the data flow, the access user permission and access time permission required for accessing the data flow are determined.

[0204] In some embodiments, the data access request also carries identity declaration information, and the device is further configured to:

[0205] If the first authentication code is the same as the second authentication code, determining a target user identifier of a target user according to the identity declaration information, the target user being a user who applies for access to the encrypted data through the data processing device;

[0206] Obtaining access user rights and access time rights configured for the data flow corresponding to the data flow identifier;

[0207] If the target user identifier satisfies the access user authority and the current time satisfies the access time authority, the step of encrypting the original key by using the processing device public key to obtain a second encryption key is performed.

[0208] See also Fig. 9 , Fig. 9Another structural diagram of a data processing device provided in an embodiment of the present application, wherein the data processing device is applied to a data publishing device. The data transmission method device may include a second sending unit 701, a second encryption unit 702, a third encryption unit 703, and an encapsulation unit 704.

[0209] The second sending unit 701 is used to obtain original data and send a verification device public key acquisition request to the verification device, so that the verification device returns the verification device public key according to the verification device public key acquisition request;

[0210] The second encryption unit 702 is used to generate an original key, and encrypt the original data by using the original key to obtain the encrypted data body;

[0211] The third encryption unit 703 is used to encrypt the original key by using the verification device public key to obtain a first encryption key;

[0212] The encapsulation unit 704 is used to encapsulate the first encryption key and the encrypted data body to obtain encrypted data so as to publish the encrypted data.

[0213] In some embodiments, the device is further used to:

[0214] Obtaining a data stream identifier of a data stream to which the original data belongs;

[0215] Generate a first authentication code based on the data stream identifier and the original key;

[0216] The encapsulation unit 704 is used for:

[0217] The data flow identifier, the first encryption key, the first authentication code and the encrypted data body are encapsulated to obtain encrypted data.

[0218] See also Fig.10 , Fig.10 Another structural diagram of a data processing device provided in an embodiment of the present application, wherein the data processing device is applied to a data processing device. The data transmission method device may include a parsing unit 801, a third sending unit 802, a second decryption unit 803, and a third decryption unit 804.

[0219] The parsing unit 801 is used to obtain encrypted data, parse the encrypted data, and parse out the encrypted data body and the first encryption key, wherein the encrypted data body is obtained by encrypting the original data by the data publishing device based on the original key, and the first encryption key is obtained by encrypting the original key by the data publishing device based on the public key of the verification device;

[0220] A third sending unit 802 is used to send a data access request to the verification device, where the data access request carries a processing device public key of the data processing device and the first encryption key;

[0221] A second decryption unit 803 is used to receive a second encryption key sent by the verification device, and decrypt the second encryption key by using a processing device private key to obtain an original key, where the second encryption key is obtained by the verification device decrypting the first encryption key by using the verification device private key and encrypting the original key by using the processing device public key;

[0222] The third decryption unit 804 is used to decrypt the encrypted data body using the original key to obtain the original data.

[0223] In some embodiments, the encrypted data also carries a first authentication code and a data stream identifier, where the data stream identifier is an identifier of the data stream to which the encrypted data body belongs. The device is further configured to:

[0224] Parsing the first authentication code and the data flow identifier;

[0225] The third sending unit 802 is configured to:

[0226] A data access request is sent to the verification device, where the data access request carries a processing device public key of the data processing device, the first encryption key, the first authentication code, and the data flow identifier.

[0227] In some embodiments, the device is further used to:

[0228] Acquire user login information, send the user login information to a verification device, so that the verification device verifies the user login information, and returns identity declaration information when the verification is successful;

[0229] Receiving identity declaration information returned by the verification device based on the user login information;

[0230] The third sending unit 802 is configured to:

[0231] A data access request is sent to the verification device, where the data access request carries the processing device public key of the data processing device, the first encryption key, the first authentication code, the data flow identifier, and the identity declaration information.

[0232] The specific implementation of each of the above units can be found in the previous embodiments, which will not be described in detail here.

[0233] As can be seen from the above, the embodiment of the present application receives a data access request sent by a data processing device through a receiving unit 601, and the data access request carries a processing device public key of the data processing device and a first encryption key. The data access request is a request generated when the data processing device applies for access to encrypted data, and the encrypted data carries an encrypted data body and the first encryption key. The encrypted data body is obtained by encrypting the original data by a data publishing device based on an original key, and the first encryption key is obtained by encrypting the original key by the data publishing device through the verification device public key of the verification device; the first decryption unit 602 decrypts the first encryption key through the verification device private key to obtain the original key; the first encryption unit 603 encrypts the original key through the processing device public key to obtain a second encryption key; the first sending unit 604 sends the second encryption key to the data processing device, so that the data processing device decrypts the second encryption key through the processing device private key to obtain the original key, and decrypts the encrypted data body through the original key to obtain the original data.

[0234] In this way, the verification device provides the data publishing device and the data processing device with key encryption when publishing data and key decryption when processing data, so as to avoid the original key being intercepted by direct transmission, resulting in malicious decryption of the encrypted data body, so as to improve the security of the original key, thereby reducing the risk of malicious decryption of the encrypted data body, and improving the security of the data. The data integrity of the stream data is ensured by the authentication code generated by the original key and the data stream identifier to prevent tampering. The user's identity is verified during the verification process of the verification device, and the subsequent key management process will only be executed when the identity authentication is passed, so as to improve data security. After the data processing device obtains the original data, it can provide services with the specified protocol, and the data application does not need to be modified. The original protocol can be used to establish a connection with the data processing device, so that the existing data sharing system does not need to be modified and adapted, and the data security sharing function can be expanded. It can not only avoid the technical challenges brought by the upgrade of the existing system, but also reduce the cost and complexity of system access. The original key is divided, and the sequence composed of the divided original sub-keys is randomly sorted, and the randomly sorted target sub-key sequence and the target sub-key identification sequence composed of each original sub-key corresponding identification in the target sub-key identification sequence are encrypted, so that the subsequent data processing device needs to decrypt the target sub-key sequence and the target sub-key identification sequence through the verification device, and adjust the sorting of the original sub-keys in the target sub-key identification sequence according to the sub-key identification sequence and the target sub-key identification sequence, and restore the original key, so as to further enhance the difficulty of cracking the original key and improve the data security during data transmission.

[0235] The specific implementation of each of the above units can be found in the previous embodiments, which will not be described in detail here.

[0236] Reference Fig.11 , Fig.11 The block diagram of the structure of part of the computer device 110 for implementing the embodiment of the present disclosure. The computer device 110 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPUs) 622 (for example, one or more processors) and memory 632, and one or more storage media 630 (for example, one or more mass storage devices) storing application programs 642 or data 644. Among them, the memory 632 and the storage medium 630 can be temporary storage or permanent storage. The program stored in the storage medium 630 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server 600. Furthermore, the central processing unit 622 can be configured to communicate with the storage medium 630 and execute a series of instruction operations in the storage medium 630 on the server 600.

[0237] The computer device 110 may also include one or more power supplies 626, one or more wired or wireless network interfaces 650, one or more input and output interfaces 658, and / or one or more operating systems 641, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0238] When the computer device 110 is a verification device, the central processor 622 in the computer device 110 can be used to execute the data processing method of the embodiment of the present disclosure, for example:

[0239] Receive a data access request sent by a data processing device, the data access request carrying a processing device public key of the data processing device and a first encryption key, the data access request is a request generated when the data processing device applies for access to encrypted data, the encrypted data carries an encrypted data body and the first encryption key, the encrypted data body is obtained by encrypting original data by a data publishing device based on an original key, and the first encryption key is obtained by encrypting the original key by the data publishing device using the verification device public key of a verification device;

[0240] Decrypting the first encryption key by using a verification device private key to obtain the original key;

[0241] Encrypting the original key by using the processing device public key to obtain a second encrypted key;

[0242] The second encryption key is sent to the data processing device so that the data processing device decrypts the second encryption key through the processing device private key to obtain the original key, and decrypts the encrypted data body through the original key to obtain the original data.

[0243] When the computer device 110 is a data publishing device, the central processor 622 in the computer device 110 can be used to execute the data processing method of the embodiment of the present disclosure, for example:

[0244] Acquire original data, and send a verification device public key acquisition request to the verification device, so that the verification device returns the verification device public key according to the verification device public key acquisition request;

[0245] Generate an original key, and encrypt the original data using the original key to obtain the encrypted data body;

[0246] Encrypting the original key by using the verification device public key to obtain a first encryption key;

[0247] The first encryption key and the encrypted data body are encapsulated to obtain encrypted data, so as to publish the encrypted data.

[0248] When the computer device 110 is a data processing device, the central processor 622 in the computer device 110 may be used to execute the data processing method of the embodiment of the present disclosure, for example:

[0249] Acquire encrypted data, parse the encrypted data, parse out the encrypted data body and the first encryption key, the encrypted data body is obtained by the data publishing device encrypting the original data based on the original key, and the first encryption key is obtained by the data publishing device encrypting the original key based on the public key of the verification device;

[0250] Sending a data access request to the verification device, wherein the data access request carries a processing device public key of the data processing device and the first encryption key;

[0251] Receive a second encryption key sent by the verification device, decrypt the second encryption key by using a processing device private key to obtain the original key, wherein the second encryption key is obtained by the verification device decrypting the first encryption key by using the verification device private key to obtain the original key, and encrypting the original key by using the processing device public key;

[0252] The encrypted data body is decrypted using the original key to obtain the original data.

[0253] The embodiments of the present disclosure further provide a computer-readable storage medium, which is used to store program codes, and the program codes are used to execute the data processing methods of the aforementioned embodiments.

[0254] The present disclosure also provides a computer program product, which includes a computer program. The processor of the computer device reads and executes the computer program, so that when the computer device is a verification device, the above-mentioned data processing method is implemented. For example:

[0255] Receive a data access request sent by a data processing device, the data access request carrying a processing device public key of the data processing device and a first encryption key, the data access request is a request generated when the data processing device applies for access to encrypted data, the encrypted data carries an encrypted data body and the first encryption key, the encrypted data body is obtained by encrypting original data by a data publishing device based on an original key, and the first encryption key is obtained by encrypting the original key by the data publishing device using the verification device public key of a verification device;

[0256] Decrypting the first encryption key by using a verification device private key to obtain the original key;

[0257] Encrypting the original key by using the processing device public key to obtain a second encrypted key;

[0258] The second encryption key is sent to the data processing device so that the data processing device decrypts the second encryption key through the processing device private key to obtain the original key, and decrypts the encrypted data body through the original key to obtain the original data.

[0259] When the computer device is a data publishing device, the above data processing method is implemented. For example:

[0260] Acquire original data, and send a verification device public key acquisition request to the verification device, so that the verification device returns the verification device public key according to the verification device public key acquisition request;

[0261] Generate an original key, and encrypt the original data using the original key to obtain the encrypted data body;

[0262] Encrypting the original key by using the verification device public key to obtain a first encryption key;

[0263] The first encryption key and the encrypted data body are encapsulated to obtain encrypted data, so as to publish the encrypted data.

[0264] When the computer device is a data processing device, the above data processing method is implemented. For example:

[0265] Acquire encrypted data, parse the encrypted data, parse out the encrypted data body and the first encryption key, the encrypted data body is obtained by the data publishing device encrypting the original data based on the original key, and the first encryption key is obtained by the data publishing device encrypting the original key based on the public key of the verification device;

[0266] Sending a data access request to the verification device, wherein the data access request carries a processing device public key of the data processing device and the first encryption key;

[0267] Receive a second encryption key sent by the verification device, decrypt the second encryption key by using a processing device private key to obtain the original key, wherein the second encryption key is obtained by the verification device decrypting the first encryption key by using the verification device private key to obtain the original key, and encrypting the original key by using the processing device public key;

[0268] The encrypted data body is decrypted using the original key to obtain the original data.

[0269] In addition, the terms "comprises" and "includes" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus that includes a series of steps or elements is not necessarily limited to those steps or elements explicitly listed, but may include other steps or elements not explicitly listed or inherent to such process, method, product or apparatus.

[0270] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0271] It should be understood that in the description of the embodiments of the present application, the meaning of multiple (or multiple items) is more than two, greater than, less than, exceed, etc. are understood to not include the number, and above, below, within, etc. are understood to include the number.

[0272] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0273] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0274] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0275] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program codes.

[0276] It should also be understood that the various implementations provided in the embodiments of the present application can be combined arbitrarily to achieve different technical effects.

[0277] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0278] The above is a specific description of the implementation method of the present application, but the present application is not limited to the above-mentioned implementation method. Technical personnel familiar with the field can also make various equivalent modifications or substitutions without violating the spirit of the present application. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. A data processing method, characterized in that: Applied to verify equipment, including: Receive a data access request sent by a data processing device, the data access request carrying a processing device public key of the data processing device and a first encryption key, the data access request is a request generated when the data processing device applies for access to encrypted data, the encrypted data carries an encrypted data body and the first encryption key, the encrypted data body is obtained by encrypting original data by a data publishing device based on an original key, and the first encryption key is obtained by encrypting the original key by the data publishing device using the verification device public key of a verification device; Decrypting the first encryption key by using a verification device private key to obtain the original key; Encrypting the original key by using the processing device public key to obtain a second encrypted key; The second encryption key is sent to the data processing device so that the data processing device decrypts the second encryption key through the processing device private key to obtain the original key, and decrypts the encrypted data body through the original key to obtain the original data.

2. The data processing method according to claim 1, characterized in that: The method further comprises: A request for obtaining a public key of a verification device sent by a data publishing device is received, and the public key of the verification device is sent to the data publishing device, triggering the data publishing device to encrypt the original key to obtain a first encryption key.

3. The data processing method according to claim 1, characterized in that: The data access request also carries a first authentication code and a data stream identifier, wherein the first authentication code is an authentication code generated by the data publishing device based on the original key and the data stream identifier, and the data stream identifier is an identifier of a data stream to which the encrypted data body carried by the encrypted data applied for access by the data processing device belongs. After the first encryption key is decrypted by the private key of the verification device to obtain the original key, the method further includes: Generate a second authentication code based on the original key and the data stream identifier; comparing the first authentication code with the second authentication code; If the first authentication code is the same as the second authentication code, the step of encrypting the original key by using the processing device public key to obtain a second encrypted key is performed.

4. The data processing method according to claim 3, characterized in that: Before the receiving of the data access request sent by the data processing device, the method further includes: In response to the access permission configuration instruction for the data flow, the access user permission and access time permission required for accessing the data flow are determined.

5. The data processing method according to claim 4, characterized in that: The data access request also carries identity declaration information. If the first authentication code is the same as the second authentication code, the step of encrypting the original key by using the processing device public key to obtain a second encryption key is performed, including: If the first authentication code is the same as the second authentication code, determining a target user identifier of a target user according to the identity declaration information, the target user being a user who applies for access to the encrypted data through the data processing device; Obtaining access user rights and access time rights configured for the data flow corresponding to the data flow identifier; If the target user identifier satisfies the access user authority and the current time satisfies the access time authority, the step of encrypting the original key by using the processing device public key to obtain a second encryption key is performed.

6. A data processing method, characterized in that: Applicable to data publishing equipment, including: Acquire original data, and send a verification device public key acquisition request to the verification device, so that the verification device returns the verification device public key according to the verification device public key acquisition request; Generate an original key, and encrypt the original data using the original key to obtain the encrypted data body; Encrypting the original key by using the verification device public key to obtain a first encryption key; The first encryption key and the encrypted data body are encapsulated to obtain encrypted data, so as to publish the encrypted data.

7. The data processing method according to claim 6, characterized in that: Before encapsulating the first encryption key and the encrypted data body to obtain the encrypted data, the method further includes: Obtaining a data stream identifier of a data stream to which the original data belongs; Generate a first authentication code based on the data stream identifier and the original key; The encapsulating the first encryption key and the encrypted data body to obtain the encrypted data includes: The data flow identifier, the first encryption key, the first authentication code and the encrypted data body are encapsulated to obtain encrypted data.

8. A data processing method, characterized in that: Applicable to data processing equipment, including: Acquire encrypted data, parse the encrypted data, parse out the encrypted data body and the first encryption key, the encrypted data body is obtained by the data publishing device encrypting the original data based on the original key, and the first encryption key is obtained by the data publishing device encrypting the original key based on the public key of the verification device; Sending a data access request to the verification device, wherein the data access request carries a processing device public key of the data processing device and the first encryption key; Receive a second encryption key sent by the verification device, decrypt the second encryption key by using a processing device private key to obtain the original key, wherein the second encryption key is obtained by the verification device decrypting the first encryption key by using the verification device private key to obtain the original key, and encrypting the original key by using the processing device public key; The encrypted data body is decrypted using the original key to obtain the original data.

9. The data processing method according to claim 8, characterized in that: The encrypted data also carries a first authentication code and a data stream identifier, where the data stream identifier is an identifier of a data stream to which the encrypted data body belongs. After parsing the encrypted data, the method further includes: Parsing the first authentication code and the data flow identifier; The sending of a data access request to the verification device, wherein the data access request carries a processing device public key of the data processing device and the first encryption key, comprises: A data access request is sent to the verification device, where the data access request carries a processing device public key of the data processing device, the first encryption key, the first authentication code, and the data flow identifier.

10. The data processing method according to claim 9, characterized in that: Before obtaining the encrypted data, the method further includes: Acquire user login information, send the user login information to a verification device, so that the verification device verifies the user login information, and returns identity declaration information when the verification is successful; Receiving identity declaration information returned by the verification device based on the user login information; The sending of a data access request to the verification device, wherein the data access request carries a processing device public key of the data processing device, the first encryption key, the first authentication code, and the data flow identifier, comprises: A data access request is sent to the verification device, where the data access request carries the processing device public key of the data processing device, the first encryption key, the first authentication code, the data flow identifier, and the identity declaration information.

11. A data processing device, applied to a verification device, comprising: A receiving unit, used for receiving a data access request sent by a data processing device, wherein the data access request carries a processing device public key of the data processing device and a first encryption key, wherein the data access request is a request generated when the data processing device applies for access to encrypted data, wherein the encrypted data carries an encrypted data body and the first encryption key, wherein the encrypted data body is obtained by encrypting original data by a data publishing device based on an original key, and wherein the first encryption key is obtained by encrypting the original key by the data publishing device using a verification device public key of a verification device; A first decryption unit, configured to decrypt the first encryption key by using a verification device private key to obtain the original key; A first encryption unit, configured to encrypt the original key by using the public key of the processing device to obtain a second encryption key; The first sending unit is used to send the second encryption key to the data processing device, so that the data processing device decrypts the second encryption key through the processing device private key to obtain the original key, and decrypts the encrypted data body through the original key to obtain the original data.

12. A data processing device, characterized in that: Applicable to data publishing equipment, including: A second sending unit, configured to obtain original data and send a verification device public key acquisition request to the verification device, so that the verification device returns the verification device public key according to the verification device public key acquisition request; A second encryption unit is used to generate an original key, and encrypt the original data by using the original key to obtain an encrypted data body; A third encryption unit, configured to encrypt the original key by using the verification device public key to obtain a first encryption key; The encapsulation unit is used to encapsulate the first encryption key and the encrypted data body to obtain encrypted data so as to publish the encrypted data.

13. A data processing device, characterized in that: Applicable to data processing equipment, including: A parsing unit, used to obtain encrypted data, parse the encrypted data, and parse out an encrypted data body and a first encryption key, wherein the encrypted data body is obtained by encrypting the original data by the data publishing device based on the original key, and the first encryption key is obtained by encrypting the original key by the data publishing device based on the public key of the verification device; A third sending unit, configured to send a data access request to the verification device, wherein the data access request carries a processing device public key of the data processing device and the first encryption key; A second decryption unit, configured to receive a second encryption key sent by the verification device, and decrypt the second encryption key by using a processing device private key to obtain an original key, wherein the second encryption key is obtained by the verification device decrypting the first encryption key by using the verification device private key to obtain the original key, and encrypting the original key by using the processing device public key; The third decryption unit is used to decrypt the encrypted data body by using the original key to obtain the original data.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the data processing method according to any one of claims 1 to 10.

15. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the data processing method according to any one of claims 1 to 10 is implemented.

Images