Data processing method and device, storage medium and computer device

Abstract

The embodiment of the application provides a data processing method and device, a storage medium and a computer device, wherein the verification device public key is sent to the data publishing device when publishing data, so that the data publishing device encrypts the original key by using the verification device public key, and the first encrypted key and the encrypted data body are published as the encrypted data; when the data processing device receives the encrypted data, the data access request carrying the processing device public key and the first encrypted key is sent to the verification device, so that the verification device decrypts the first encrypted key by using the verification device private key, obtains the original key, encrypts the original key by using the processing device public key, returns the second encrypted key to the data processing device, the data processing device decrypts the second encrypted key by using the processing device private key, obtains the original key, and decrypts the encrypted data body to obtain the original data, thereby improving the security of the data.

Description

Technical Field

[0001] This application relates to the field of data processing, and more particularly to a data processing method, apparatus, storage medium, and computer equipment. Background Technology

[0002] With the rapid development of information technology, data has become an important resource and core asset of modern economy and society. The country attaches great importance to the management of data assets and the protection of data privacy, and actively builds and improves the data protection system through laws, regulations and policies to ensure the security and privacy of data during collection, storage, use and transmission.

[0003] In related technologies, data sharing methods lack comprehensive data encryption measures and usually rely only on simple API keys or single-factor authentication. This method only implements data access control, but it is easily intercepted or tampered with during data transmission, such as through a Content Delivery Network (CDN), posing a security risk. Summary of the Invention

[0004] The main objective of this application is to provide a data processing method, apparatus, storage medium, and computer equipment, aiming to offer a novel key management approach and improve data security during data transmission. The technical solution is as follows:

[0005] In a first aspect, embodiments of this application provide a data processing method applied to a verification device, comprising:

[0006] The system receives a data access request sent by a data processing device. The data access request carries the processing device's public key and a first encryption key. The data access request is generated when the data processing device requests access to encrypted data. The encrypted data carries the encrypted data body and the first encryption key. The encrypted data body is obtained by the data publishing device encrypting the original data based on the original key. The first encryption key is obtained by the data publishing device encrypting the original key using the verification device's public key.

[0007] The original key is obtained by decrypting the first encryption key using the device's private key.

[0008] The original key is encrypted using the public key of the processing device to obtain the second encryption key;

[0009] The second encryption key is sent to the data processing device so that the data processing device can decrypt the second encryption key using its private key to obtain the original key, and then decrypt the encrypted data body using the original key to obtain the original data.

[0010] Secondly, embodiments of this application provide a data processing method applied to a data publishing device, comprising:

[0011] Obtain the raw data and send a public key retrieval request to the verification device so that the verification device returns the public key based on the public key retrieval request.

[0012] Generate an original key, and encrypt the original data using the original key to obtain the encrypted data body;

[0013] The original key is encrypted using the public key of the verification device to obtain the encrypted key.

[0014] The encryption key and the encrypted data body are encapsulated to obtain encrypted data, which is then published.

[0015] Thirdly, embodiments of this application provide a data processing method applied to a data processing device, comprising:

[0016] The encrypted data is obtained and parsed to extract the encrypted data body and the first encryption key. The encrypted data body is obtained by the data publishing device encrypting the original data based on the original key. The first encryption key is obtained by the data publishing device encrypting the original key based on the public key of the verification device.

[0017] Send a data access request to the verification device, the data access request carrying the processing device public key of the data processing device and the first encryption key;

[0018] The device receives a second encryption key sent by the verification device, decrypts the second encryption key using the processing device's private key to obtain the original key. The second encryption key is obtained by the verification device decrypting the first encryption key using the verification device's private key to obtain the original key, and then encrypting the original key using the processing device's public key.

[0019] The original data is obtained by decrypting the encrypted data body using the original key.

[0020] Fourthly, embodiments of this application provide a data processing apparatus applied to a verification device, comprising:

[0021] The receiving unit is configured to receive a data access request sent by the data processing device. The data access request carries the processing device public key of the data processing device and a first encryption key. The data access request is a request generated when the data processing device requests access to encrypted data. The encrypted data carries the encrypted data body and the first encryption key. The encrypted data body is obtained by the data publishing device encrypting the original data based on the original key. The first encryption key is obtained by the data publishing device encrypting the original key using the verification device public key of the verification device.

[0022] The first decryption unit is used to decrypt the first encryption key by verifying the device's private key to obtain the original key;

[0023] The first encryption unit is used to encrypt the original key using the public key of the processing device to obtain the second encryption key;

[0024] The first sending unit is used to send the second encryption key to the data processing device, so that the data processing device can decrypt the second encryption key using its private key to obtain the original key, and then decrypt the encrypted data body using the original key to obtain the original data.

[0025] Fifthly, embodiments of this application provide a data processing apparatus, applied to a data publishing device, comprising:

[0026] The second sending unit is used to acquire raw data and send a public key acquisition request to the verification device, so that the verification device returns the public key of the verification device according to the public key acquisition request.

[0027] The second encryption unit is used to generate an original key, and to encrypt the original data using the original key to obtain the encrypted data body;

[0028] The third encryption unit is used to encrypt the original key using the public key of the verification device to obtain the encryption key;

[0029] The encapsulation unit is used to encapsulate the encryption key and the encrypted data body to obtain encrypted data for publication.

[0030] Sixthly, embodiments of this application provide a data processing apparatus, applied to a data processing device, comprising:

[0031] The parsing unit is used to acquire encrypted data, parse the encrypted data, and parse out the encrypted data body and the first encryption key. The encrypted data body is obtained by the data publishing device encrypting the original data based on the original key, and the first encryption key is obtained by the data publishing device encrypting the original key based on the public key of the verification device.

[0032] The third sending unit is used to send a data access request to the verification device, the data access request carrying the processing device public key of the data processing device and the first encryption key;

[0033] The second decryption unit is used to receive the second encryption key sent by the verification device, and decrypt the second encryption key using the processing device's private key to obtain the original key. The second encryption key is obtained by the verification device decrypting the first encryption key using the verification device's private key to obtain the original key, and then encrypting the original key using the processing device's public key.

[0034] The third decryption unit is used to decrypt the encrypted data body using the original key to obtain the original data.

[0035] In a seventh aspect, embodiments of this application provide a computer-readable storage medium storing a plurality of instructions adapted for loading by a processor to perform the data processing method as described above.

[0036] Eighthly, embodiments of this application provide a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the data processing method as described above.

[0037] In this embodiment, when a data publishing device publishes data, it sends a verification device's public key to the data publishing device. This allows the data publishing device to encrypt the original key used to encrypt the original data using the verification device's public key, and then publish the first encryption key and the encrypted data body together as encrypted data. When the data processing device receives the encrypted data, it sends a data access request carrying the processing device's public key and the first encryption key to the verification device. The verification device then decrypts the first encryption key using its private key to obtain the original key, encrypts the original key using its public key, and returns the second encryption key to the data processing device. The data processing device then decrypts the second encryption key using its private key to obtain the original key, and uses this original key to decrypt the encrypted data body to obtain the original data. Thus, by providing key encryption during data publishing and key decryption during data processing through the verification device, the data publishing device avoids the direct transmission of the original key, which could lead to interception and malicious decryption of the encrypted data body. This improves the security of the original key, thereby reducing the risk of malicious decryption of the encrypted data body and enhancing data security. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 This is a schematic diagram of a data processing system provided in an embodiment of this application.

[0040] Figure 2 This is a flowchart illustrating the data processing method provided in an embodiment of this application.

[0041] Figure 3 This is another schematic diagram of the data processing method provided in the embodiments of this application.

[0042] Figure 4 This is another schematic diagram of the data processing method provided in the embodiments of this application.

[0043] Figure 5 This is a schematic diagram of the file format of the slice file provided in the embodiments of this application.

[0044] Figure 6 This is a schematic diagram of the data format of the encrypted data provided in the embodiments of this application.

[0045] Figure 7 This is another schematic diagram of the data processing method provided in the embodiments of this application.

[0046] Figure 8 This is a schematic diagram of the structure of the data processing apparatus provided in the embodiments of this application.

[0047] Figure 9 Another schematic diagram of the data processing apparatus provided in the embodiments of this application.

[0048] Figure 10 Another schematic diagram of the data processing apparatus provided in the embodiments of this application.

[0049] Figure 11 A schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0050] To enable those skilled in the art to better understand the solutions of this application, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0051] It should be noted that while some processes described in the specification, claims, and accompanying drawings contain multiple steps that appear in a specific order, it should be clearly understood that these steps may not be performed in the order they appear herein, or may be performed in parallel. The step numbers are merely used to distinguish different steps and do not represent any particular order of execution. Furthermore, descriptions such as "first," "second," or "objective" in this document are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0052] Before providing a further detailed description of the embodiments of this disclosure, the terms and concepts used in these embodiments are explained, and they are subject to the following interpretations:

[0053] A Content Delivery Network (CDN) aims to bypass bottlenecks and points of failure on the internet that could affect data transmission speed and stability, resulting in faster and more stable content delivery. By placing node servers throughout the network, forming an intelligent virtual network on top of the existing internet infrastructure, a CDN system can redirect user requests to the nearest service node in real time based on comprehensive information such as network traffic, the connectivity and load of each node, and the distance and response time to the user. Its purpose is to allow users to obtain the content they need from the nearest location, alleviating network congestion and improving website response speed.

[0054] A key typically refers to a key used to encrypt and decrypt data. This key can be a combination of numbers, letters, or symbols, and is used to protect data from unauthorized access.

[0055] Stream data is a continuously generated, real-time, and dynamically changing collection of data. Unlike batch data, streaming data does not process a fixed set of data at once, but rather processes data generated in real time. Stream data typically originates from various real-time events, such as sensor data, social media messages, financial transactions, and web logs.

[0056] Asymmetric encryption is a technology for ensuring data security. It involves two keys (a public key and a private key). First, a key generation algorithm is used to calculate the private key from the input. Then, another algorithm is used to generate the public key from the private key. The generation of the public key is irreversible. Because it is impossible to exhaustively derive the private key from the public key (i.e., computationally impossible), the data is considered secure, thus achieving the effect of ensuring data security.

[0057] A Hash-based Message Authentication Code (HMAC) is a hash function-based authentication code used to verify the integrity and authenticity of a message while preventing message tampering. It combines data using a specific hash algorithm and rules, typically by XORing or concatenating the key to the beginning or end of the message. The combined data is then used as input and processed by the selected hash algorithm. The hash function operates on the input data, generating a fixed-length hash value. The hash function's operation typically involves dividing the input data into fixed-size blocks, processing each block, and combining the result with the result of the previous block, until all blocks are processed. Finally, the hash function outputs a fixed-length HMAC value.

[0058] Identity Tokens (JSON Web Tokens, JWTs) are an open JSON-based standard (RFC 7519) for transmitting claims between web application environments. This token is designed to be compact and secure, particularly suitable for Single Sign-On (SSO) scenarios in distributed sites. JWTs are typically used to transmit authenticated user identity information between identity providers and service providers to facilitate resource retrieval from resource servers. They can also be used to add additional claims necessary for other business logic. The token can be used directly for authentication or it can be encrypted.

[0059] The Uniform Resource Locator (URL) is a method of representing the location of information on the World Wide Web services of the Internet.

[0060] Currently, users in the big data processing field primarily process and share data in batches, performing data analysis and mining based on the generated batches of data. However, due to the high value and sensitivity of some data, data owners are also very concerned about security during the data sharing process. Without appropriate security measures, this could lead to the leakage of trade secrets or the theft of sensitive information, causing incalculable economic losses and reputational damage. Therefore, there is an urgent need for an efficient, secure, and real-time data encryption method and system to ensure the security of data during distribution and sharing.

[0061] To address the aforementioned problems, this application proposes a method whereby a verification device's public key is sent to the data publishing device when publishing data. This allows the data publishing device to encrypt the original key used to encrypt the original data using the verification device's public key, and then publish the first encryption key and the encrypted data itself as encrypted data. When the data processing device receives the encrypted data, it sends a data access request carrying the processing device's public key and the first encryption key to the verification device. The verification device then decrypts the first encryption key using its private key to obtain the original key, encrypts the original key using its public key, and returns the resulting second encryption key to the data processing device. The data processing device then decrypts the second encryption key using its private key to obtain the original key, and finally decrypts the encrypted data itself using the original key to obtain the original data. In this way, the verification device provides encryption and decryption services for the original key to both the data publishing and data processing devices, thereby improving the security of the original key and ultimately the data. Please refer to the following specific embodiments for details.

[0062] Please see Figure 1 , Figure 1 This is a schematic diagram of a data processing system provided in an embodiment of this application. It includes a data publishing device, a data processing device, and a verification device. The data publishing device is used to pull data from a data source and publish the pulled data over a network; the data processing device is used to obtain data from the network and process the obtained data accordingly to deliver the processed data to a data application; the verification device is used to manage keys by encrypting data using a key when the data publishing device publishes data, and to manage verification and authorization when the data processing device requests access to the obtained encrypted data.

[0063] Among them, data publishing equipment, data processing equipment, and verification equipment are computer equipment, which refers to a computer system that can provide certain services to terminals. Compared with ordinary terminals, computer equipment has higher requirements in terms of stability, security, and performance. Computer equipment can be a single high-performance computer in a network platform, a cluster of multiple high-performance computers, a portion of a single high-performance computer (such as a virtual machine), or a combination of portions of multiple high-performance computers (such as virtual machines), etc.

[0064] Data publishing and processing equipment can also include, but is not limited to, terminals such as mobile phones, computers, smart voice interaction devices, smart home appliances, vehicle terminals, and aircraft. Furthermore, it can be a single device or a collection of multiple devices. The terminal can communicate with the network and exchange data via wired or wireless means.

[0065] The data transmission method of this disclosure can be implemented in a computer device.

[0066] It should be noted that, Figure 1 The schematic diagram of the data processing system shown is merely an example. The data processing system and scenario described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of data processing and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0067] For details, please refer to Figure 2 , Figure 2 This is a flowchart illustrating a data processing method provided in an embodiment of this application. The data processing method is applied to a verification device and includes:

[0068] In step 201, a data access request sent by the data processing device is received.

[0069] A data access request is a request generated by a data processing device when it requests access to encrypted data. Encrypted data is data that the data processing device obtains through a distribution network, such as a CDN network, and then publishes after being encrypted by a data publishing device.

[0070] Specifically, the encrypted data carries the encrypted data body and the first encryption key. The encrypted data body payload is obtained by the data publishing device encrypting the original data based on the original key key. The first encryption key skey is obtained by the data publishing device encrypting the original key key using the verification device's verification device public key pubkey.

[0071] In other words, when publishing data, the data publishing device needs to encrypt the original data using the original key to obtain the encrypted data payload, and then encrypt the original key using the verification device's public key pubkey to obtain the first encryption key skey. When publishing data, the encrypted data payload and the first encryption key skey are published together as encrypted data, so that the data processing device can obtain the encrypted data payload and the first encryption key skey when it receives the encrypted data.

[0072] When a data processing device requests access to the encrypted data, it needs to send the first encryption key skey and the processing device's public key cpubkey along with the data access request to the verification device, so that the verification device can receive the first encryption key skey and the processing device's public key cpubkey.

[0073] The raw data refers to the streaming data obtained by the data publishing device from the data stream.

[0074] In step 202, the first encryption key is decrypted using the verification device's private key to obtain the original key.

[0075] Since the first encryption key skey is obtained by encrypting the original key key using the verification device's public key pubkey, after receiving the first encryption key skey, the verification device can decrypt the first encryption key sky using the verification device's private key privatekey to obtain the original key key.

[0076] Specifically, the decryption algorithm can be implemented using an asymmetric encryption algorithm, such as RSA.

[0077] In step 203, the original key is encrypted using the processing device's public key to obtain the second encryption key.

[0078] Since the data processing device needs to decrypt the encrypted data payload using the original key to obtain the original data, the data processing device needs to obtain the original key. To ensure the security of the original key during transmission, the verification device encrypts the original key using the processing device public key cpubkey sent by the data processing device to obtain the second encryption key cskey.

[0079] In step 204, the second encryption key is sent to the data processing device so that the data processing device can decrypt the second encryption key using its private key to obtain the original key, and then decrypt the encrypted data body using the original key to obtain the original data.

[0080] Specifically, after obtaining the second encryption key cskey, the second encryption key cskey is returned to the data processing device. Since the second encryption key cskey is obtained by encrypting the original key key using the processing device's public key cpubkey, the data processing device can decrypt the second encryption key cskey using the processing device's private key cprivatekey to decrypt the original key key. Then, the original key key is used to decrypt the encrypted data payload to obtain the original data.

[0081] As described above, this embodiment of the application sends the verification device's public key to the data publishing device when publishing data. This allows the data publishing device to encrypt the original key used to encrypt the original data using the verification device's public key, and then publishes the first encryption key and the encrypted data body together as encrypted data. When the data processing device receives the encrypted data, it sends a data access request carrying the processing device's public key and the first encryption key to the verification device. The verification device then decrypts the first encryption key using its private key to obtain the original key, encrypts the original key using its public key, and returns the second encryption key to the data processing device. The data processing device then decrypts the second encryption key using its private key to obtain the original key, and decrypts the encrypted data body using the original key to obtain the original data. Thus, by providing key encryption during data publishing and key decryption during data processing through the verification device, the data publishing device avoids the direct transmission of the original key, which could lead to interception and malicious decryption of the encrypted data body. This improves the security of the original key, thereby reducing the risk of malicious decryption of the encrypted data body and enhancing data security.

[0082] In some implementations, such as Figure 3 As shown, Figure 3 Another flowchart illustrating the data processing method provided in this application embodiment. The data processing method includes:

[0083] In step 301, a request to obtain the verification device public key is received from the data publishing device, the verification device public key is sent to the data publishing device, and the data publishing device is triggered to encrypt the original key to obtain the first encryption key.

[0084] This step involves the interaction between the data publishing device and the verification device. When the data publishing device is ready to publish data, it sends a public key retrieval request to the verification device to obtain its public key (pubkey). Upon receiving the request, the verification device returns its own public key (pubkey) to the data publishing device, enabling the data publishing device to obtain the public key (pubkey) and encrypt the original key (key) using it to obtain the first encryption key (skey).

[0085] Specifically, the raw key is the encryption key required to encrypt the streaming data in the data stream.

[0086] In step 302, in response to the access permission configuration instruction for the data stream, the access user permissions and access time permissions required to access the data stream are determined.

[0087] The data publisher adds access permissions for the data stream and sets access time permissions. The data publisher can access the verification device through the data publishing device to implement permission configuration commands for the data stream to be published, or set up a dedicated permission configuration system in the verification device so that users can implement permission configuration commands in the permission configuration system. The specific implementation method of permission configuration commands is not limited here.

[0088] For example, data publisher A sets the data stream so that only users who have established a friend relationship with data publisher A can access it between 12:00 and 13:00.

[0089] In step 303, a data access request sent by the data processing device is received.

[0090] Steps 303 to 310 constitute the interaction process between the data processing device and the verification device. When the data processing device is ready to access the encrypted data, it sends a data access request to the verification device to request access to the encrypted data.

[0091] Specifically, the data access request carries an encrypted data payload and the first encryption key skey. The encrypted data payload and the first encryption key skey are obtained by the data processing device by parsing the encrypted data. After parsing the encrypted data payload and the first encryption key skey, the data processing device combines its own processing device public key cpubkey with the first encryption key skey to package the data access request, so that the verification device can obtain the processing device public key cpubkey and the first encryption key skey during the process of sending the data access request to the verification device.

[0092] In step 304, the first encryption key is decrypted using the verification device's private key to obtain the original key.

[0093] Since the first encryption key skey is obtained by encrypting the original key key using the verification device's public key pubkey, after receiving the first encryption key skey, the verification device can decrypt the first encryption key sky using the verification device's private key privatekey to obtain the original key key.

[0094] Specifically, before decrypting the first encryption key using the verification device's private key to obtain the original key, the verification device can also verify the target user's identity. The verification method involves the verification device calling the user management system's API to verify the validity of the identity claim information JWT. If the verification passes, step 305 is executed; otherwise, the verification device returns an error message and logs it. The identity claim information JWT contains user identity information and session information. Subsequently, when the data processing device sends a data access request, it includes the identity claim information JWT in the header of the data access request, allowing the verification device to verify the target user's identity. The user management system can be configured within the verification device or on a third-party device; this is not limited here. When the user management system is configured within the verification device, the verification device receives user login information sent by the data processing device, verifies the target user's identity based on the login information, and if the verification passes, executes the step of decrypting the first encryption key using the verification device's private key to obtain the original key.

[0095] In step 305, a second authentication code is generated based on the original key and the data stream identifier.

[0096] In addition, when the original data is streaming data, in order to ensure the integrity of the streaming data and prevent it from being tampered with, the verification device can also determine whether the streaming data is complete and whether it has been tampered with by verifying the authentication code.

[0097] Specifically, this application provides a method for generating a message authentication code, which uses the original key (key) combined with the stream identifier (streamid) of the data stream to which the encrypted data body belongs to generate the authentication code. Specifically, the message authentication code can be generated by combining the original key (key) and the stream identifier (streamid) according to specific rules. The combined data is then used as input and calculated using a selected hash algorithm (e.g., SHA256) to obtain the message authentication code.

[0098] The second authentication code is generated by the verification device based on the data stream identifier streamid sent by the data processing device and the original key key decrypted in step 303.

[0099] In step 306, the first authentication code is compared with the second authentication code.

[0100] The first authentication code is generated by the data publishing device based on the original key and the data stream identifier. The first authentication code is encapsulated within encrypted data and published along with the encrypted data so that the data processing device can obtain it. After obtaining the first authentication code, the data processing device sends it along with the data access request to the verification device so that the verification device can obtain the first authentication code.

[0101] Specifically, after the verification device generates the second verification code in step 305, the verification device will compare the first verification code carried in the data access request with the generated second verification code to determine whether the stream data is complete and whether it has been tampered with.

[0102] In step 307, if the first authentication code is the same as the second authentication code, the target user identifier of the target user is determined based on the identity declaration information.

[0103] If the first authentication code is the same as the second authentication code, it means that the stream data is intact and has not been tampered with. Then, the authorization for the encrypted data is verified. The authorization verification requires obtaining the target user's UID, which can be obtained through the identity claim information JWT.

[0104] In step 308, the access user permissions and access time permissions configured for the data stream corresponding to the data stream identifier are obtained.

[0105] Before publishing a data stream, the data publisher needs to implement permission configuration instructions to set access time permissions for that data stream. Therefore, it is necessary to retrieve the previously configured access user permissions and access time permissions for the data stream corresponding to the data stream identifier.

[0106] Specifically, the data stream identifier is a feature that the data publishing device encapsulates into the encrypted data when publishing encrypted data. This allows the data processing device to parse the encrypted data and obtain the data stream identifier, which is then sent to the verification device along with the data access request.

[0107] In step 309, if the target user identifier meets the access user permissions and the current time meets the access time permissions, the original key is encrypted using the processing device public key to obtain the second encryption key.

[0108] If the target user identifier meets the access user permissions and the current time meets the access time permissions, it means that this access can be authorized. Then, the original key is encrypted by processing the device public key to obtain the second encryption key.

[0109] For example, if data publisher A sets the data stream to be accessible only to users who are friends with data publisher A between 12:00 and 13:00, and the users who are friends with data publisher A include user id1, user id2, and user id3, and the target user's user id is id2, and the current time is 12:30, then this access can be authorized.

[0110] In step 310, a second encryption key is sent to the data processing device so that the data processing device can decrypt the second encryption key using its private key to obtain the original key, and then decrypt the encrypted data body using the original key to obtain the original data.

[0111] Specifically, after obtaining the second encryption key cskey, the second encryption key cskey is returned to the data processing device. Since the second encryption key cskey is obtained by encrypting the original key key using the processing device's public key cpubkey, the data processing device can decrypt the second encryption key cskey using the processing device's private key cprivatekey to decrypt the original key key. Then, the original key key is used to decrypt the encrypted data payload to obtain the original data.

[0112] In some implementations, after the data publishing device encrypts the original data using the original key to obtain the encrypted data body, it may further include:

[0113] The original key is divided into a specified number of subkeys to obtain the original subkey sequence;

[0114] Configure a subkey identifier for each original subkey, so that the subkey identifiers are different between the original subkeys;

[0115] Determine the subkey identifier sequence in the original subkey sequence, which is composed of the subkey identifier corresponding to each original subkey;

[0116] The original subkeys in the original subkey sequence are randomly sorted to obtain the target subkey sequence;

[0117] Obtain the target subkey identifier sequence, which is composed of the subkey identifiers corresponding to each original subkey in the target subkey sequence;

[0118] The target subkey identifier sequence is encrypted using the verification device's public key to obtain the first encrypted subkey identifier sequence;

[0119] The target subkey sequence is encrypted using the public key of the verification device to obtain the first encrypted subkey sequence;

[0120] The first encryption subkey sequence, the first encryption subkey identifier sequence, and the encrypted data body are encapsulated to obtain encrypted data.

[0121] For example, if the original key is "abcgfdh" and the specified quantity is 3, then the original key is divided into 3 parts, resulting in the original subkey sequence: "abc", "gf", "dh". The subkey identifier for the original subkey "abc" is 'q', the subkey identifier for the original subkey "gf" is 'e', ​​and the subkey identifier for the original subkey "dh" is 'r'. The subkey identifier sequence is 'qer'. After randomly sorting the original subkeys, the target original subkey sequence is "gf", "dh", "abc". The target subkey identifier sequence is then 'erq'. The target subkey identifier sequence 'erq' is encrypted using the verification device's public key 'pubkey' to obtain the first encrypted subkey identifier sequence. The target original subkey sequence is then encrypted using the verification device's public key 'pubkey' to obtain the first encrypted subkey sequence.

[0122] The first encryption subkey sequence, the first encryption subkey identifier sequence, and the encrypted data body are encapsulated to obtain encrypted data.

[0123] After receiving encrypted data, the data processing device can parse it to extract the first encryption subkey sequence and the first encryption subkey identifier sequence carried in the encrypted data.

[0124] The data access request sent by the data processing device to the verification device may also carry a first encrypted subkey sequence and a first encrypted subkey identifier sequence, so that the verification device can decrypt the first encrypted subkey sequence according to the verification device's private key to obtain the target subkey sequence, and decrypt the first encrypted subkey identifier sequence according to the verification device's private key to obtain the target subkey identifier sequence;

[0125] The target subkey sequence is encrypted using the device's public key to obtain the second encrypted subkey sequence;

[0126] The target subkey identifier sequence is encrypted using the public key of the processing device to obtain the second encrypted subkey identifier sequence, and the second encrypted subkey sequence and the second encrypted subkey identifier sequence are returned to the data processing device.

[0127] When the data processing device receives the second encryption subkey identifier sequence and the second encryption subkey identifier sequence, it decrypts the second encryption subkey sequence according to the processing device's private key to obtain the target subkey sequence.

[0128] The target subkey identifier sequence is obtained by decrypting the second encryption subkey identifier sequence using the private key of the processing device.

[0129] Since the data processing device cannot know the correct order of the subkeys in the original key, it can send its digital certificate to the data publishing device. The data publishing device can then verify whether it is a trusted device. If so, it will return the correct subkey identifier sequence to the data processing device. Alternatively, after obtaining the subkey identifier sequence, the data publishing device can directly send it to a trusted device, such as the data processing device. Therefore, even if other devices intercept and crack the target subkey identifier sequence, they cannot rearrange the original subkeys in the target subkey sequence to reconstruct the original key.

[0130] Based on the subkey identifier sequence and the target subkey identifier sequence, the original subkeys in the target subkey identifier sequence are sorted to obtain the original key.

[0131] For example, if the target subkey identifier sequence is erq, the target subkey identifier sequence is "gf", "dh", "abc", and the subkey identifier sequence is qer, then the original subkey "abc" is in the first position of the original key sequence, the original subkey "gf" is in the second position, and the original subkey "dh" is in the third position. Therefore, the adjusted original key is "abcgfdh". By dividing the original key and randomly sorting the sequence of the divided original subkeys, and encrypting the target subkey identifier sequence and the identifier sequence corresponding to each original subkey in the randomly sorted target subkey sequence, subsequent data processing devices need to decrypt the target subkey sequence and the target subkey identifier sequence through a verification device. Based on the subkey identifier sequence and the target subkey identifier sequence, the order of the original subkeys in the target subkey identifier sequence is adjusted to reconstruct the original key, further increasing the difficulty of cracking the original key and improving data security during data transmission.

[0132] In some implementations, such as Figure 4 As shown, Figure 4 Another schematic flowchart illustrating the data processing method provided in this application embodiment. This data processing method is applied to a data publishing device and includes:

[0133] In step 401, the original data is obtained, and a public key acquisition request for the verification device is sent to the verification device to obtain the public key of the verification device from the verification device.

[0134] The original data refers to data pulled from a data source. When the original data is static, the data source is a collection of static data points, and the data is pulled one by one. When the original data is dynamic data such as streaming data, the data source is the data stream, and the data can be pulled in the following two ways:

[0135] (1) Fragmenting by fixed size. Fragment the data stream into fixed byte sizes. For example, divide the data stream into segments of 1MB each.

[0136] (2) Fragment by time interval. Fragment the data stream at fixed time intervals. For example, generate a data block every 10 seconds.

[0137] Specifically, since different data source protocol types can select different protocols to pull data from the data source, the data is packaged into raw data in a slice file format, such as a slice file, according to the slicing strategy. The slice file is the basic unit for internal data stream processing; each slice file contains two parts: a header and a data payload. The file format is as follows: Figure 5 As shown, Figure 5 This is a schematic diagram of the file format of the slice file format provided in this application embodiment. The file format of the slice file format includes:

[0138] (1) Data payload: The actual data content, which can be any type of byte stream.

[0139] (2) File header: Contains metadata related to the data payload, including:

[0140] uuid: Used to uniquely identify each shard; timestamp: Timestamp when the data shard was created; duration: Indicates the time interval between shard creation; datasize: Indicates the size of the data load.

[0141] When publishing data, the data publishing device needs to encrypt the original key key using the verification device's public key pubkey. Therefore, it needs to send a verification device public key acquisition request to the verification device to obtain the verification device's public key pubkey.

[0142] In step 402, an original key is generated, and the original data is encrypted using the original key to obtain the encrypted data body.

[0143] The original key is a random key of a specified length generated by the data publishing device. The original key is then encrypted using a symmetric encryption algorithm (e.g., AES-128) to generate the encrypted data payload.

[0144] In step 403, the original key is encrypted using the verification device's public key to obtain the first encryption key.

[0145] The data publishing device verifies the device's public key pubkey and encrypts the original key key using an asymmetric encryption algorithm (such as RSA) to generate the first encryption key skey.

[0146] In step 404, the first encryption key and the encrypted data body are encapsulated to obtain encrypted data, which is then published.

[0147] In order for the data processing device that subsequently receives the encrypted data to obtain the original key through key management interaction between the first encryption key and the verification device, the data publishing device needs to encapsulate the first encryption key and the encrypted data body so that the first encryption key and the encrypted data body are published together with the encrypted data.

[0148] Specifically, during the process of publishing encrypted data on the data publishing device, for streaming data, the encrypted data with the .enc suffix obtained in the previous step is added to a .list format streaming list file. The streaming list file and the encrypted data are then handed over to the network (e.g., a CDN network) for data distribution. The streaming list file lists the latest N (e.g., 10) data fragments. Each time newly generated encrypted data is added, the oldest encrypted data in the streaming list file is deleted, and the latest encrypted data is appended to the end of the streaming list file. The encrypted data is named incrementally according to a certain rule.

[0149] The following is an example of the content of the generated stream list file:

[0150] #LIST

[0151] http: / / cdn.com / stream / segment00210.enc

[0152] http: / / cdn.com / stream / segment00211.enc

[0153] http: / / cdn.com / stream / segment00212.enc

[0154] …

[0155] Here, #LIST indicates the file type, *.enc is encrypted data, and *.enc can be a URL path.

[0156] In some implementations, before encapsulating the first encryption key and the encrypted data body to obtain encrypted data, the method further includes:

[0157] (1) Obtain the data stream identifier of the data stream to which the original data belongs.

[0158] In the process of pulling raw data in slice file format from the data source, the data publishing device can know which data stream the raw data was pulled from, and thus can obtain the stream identifier (streamid) of the data stream to which the raw data belongs.

[0159] (2) Generate a first authentication code based on the data stream identifier and the original key.

[0160] The authentication code is generated by combining the original key (key) with the stream identifier (streamid) of the data stream to which the encrypted data body belongs. Specifically, the message authentication code can be generated by combining the original key (key) and the stream identifier (streamid) according to specific rules. The combined data is then used as input and calculated using a selected hash algorithm (e.g., SHA256) to obtain the message authentication code.

[0161] The process of encapsulating the first encryption key and the encrypted data body to obtain encrypted data includes:

[0162] Encapsulate the data stream identifier, the first encryption key, the first authentication code, and the encrypted data body to obtain encrypted data.

[0163] The first authentication code is used by subsequent verification devices to verify the integrity of the data received by the data processing device, preventing tampering. The verification method requires the verification device to generate a second authentication code based on the data stream identifier and the original key. By comparing the first and second authentication codes, data integrity is determined, preventing tampering. Therefore, when encapsulating the first encryption key and the encrypted data body, the data stream identifier and the first authentication code also need to be encapsulated to obtain the encrypted data.

[0164] Specifically, such as Figure 6 As shown, Figure 6This is a schematic diagram of the data format of the encrypted data provided in this application embodiment. The encrypted data format includes two parts: an encrypted data description manifest and an encrypted data payload. The encrypted data payload and the encrypted data description manifest are packaged in a compressed file format (ZIP) to generate the encrypted data. The encrypted data description manifest includes an encryption algorithm indicator, a first encryption key (skey), a data stream identifier (streamid), a first authentication code, and a verification device access address (url). The encryption algorithm indicator specifies the encryption algorithm used by the data publishing device when encrypting the original data using the original key (key), so that the data processing device can use the corresponding decryption algorithm when decrypting the encrypted data payload using the original key (key). The verification device access address (url) indicates the address of the verification device, facilitating the data processing device to request access authorization from the verification device.

[0165] In some implementations, such as Figure 7 As shown, Figure 7 This is a flowchart illustrating a data processing method provided in an embodiment of this application. The data processing method is applied to a data processing device and includes:

[0166] In step 501, encrypted data is obtained, and the encrypted data is parsed to extract the encrypted data body and the first encryption key.

[0167] Specifically, for streaming data, the data processing device will repeatedly request the specified .list stream list file from the network using HTTP or HTTPS protocol at specified time intervals (e.g., 1 second), parse the file content to obtain the encrypted data list, download the corresponding encrypted data, and download the latest encrypted data when the stream list file content is updated, thus obtaining the encrypted data.

[0168] Specifically, since the data processing device needs to process the raw data presented in plaintext, it needs to parse the encrypted data to extract the encrypted data payload and the first encryption key skey from the encapsulated encrypted data. The encrypted data payload is obtained by the data publishing device encrypting the raw data based on the original key key, and the first encryption key skey is obtained by the data publishing device encrypting the original key key based on the verification device's public key pubkey.

[0169] In step 502, a data access request is sent to the verification device. The data access request carries the processing device public key of the data processing device and the first encryption key.

[0170] Since the first encryption key skey is obtained by the data publishing device encrypting the original key key based on the verification device's verification device public key pubkey, the data processing device cannot decrypt the first encryption key skey at this time. Therefore, it needs to send a data access request to the verification device carrying the data processing device's processing device public key pubkey and the first encryption key skey.

[0171] In step 503, the second encryption key sent by the verification device is received, and the second encryption key is decrypted using the processing device's private key to obtain the original key.

[0172] In this process, after obtaining the processing device's public key (pubkey) and the first encryption key (skey) from the data access request, the verification device decrypts the first encryption key (sky) using its private key (privatekey) to obtain the original key (key). To prevent interception during the transmission of the original key to the data processing device, the verification device further encrypts the original key using the processing device's public key (pubkey) before sending the resulting second encryption key (cskey) to the data processing device.

[0173] Specifically, after receiving the second encryption key cskey, the data processing device can decrypt the second encryption key cskey using the processing device's private key cprivatekey to obtain the original key key.

[0174] In step 504, the encrypted data body is decrypted using the original key to obtain the original data.

[0175] Since the encrypted data body is obtained by the data publishing device encrypting the original data using the original key and a specified encryption algorithm, when the data processing device decrypts the encrypted data body using the original key, it needs to select the corresponding decryption algorithm according to the encryption algorithm instruction of the encrypted data description information manifest of the encrypted data, so as to decrypt the encrypted data body through the decryption algorithm and obtain the original data.

[0176] In some implementations, the encrypted data also carries a first authentication code and a data stream identifier, wherein the data stream identifier is the identifier of the data stream to which the encrypted data body belongs. After parsing the encrypted data, the following steps are also included:

[0177] The first authentication code and the data stream identifier are parsed out.

[0178] The step of sending a data access request to the verification device, the data access request carrying the processing device public key of the data processing device and the first encryption key, includes:

[0179] A data access request is sent to the verification device, the data access request carrying the processing device public key of the data processing device, the first encryption key, the first authentication code, and the data stream identifier.

[0180] To ensure the integrity of streaming data and prevent tampering, the data publishing device encapsulates the stream identifier (streamid) of the data stream to which the encrypted data body belongs, as well as the first authentication code generated based on the stream identifier (streamid) and the original key (key), into the encrypted data when publishing encrypted data. In this way, the data processing device can extract the stream identifier (streamid) and the first authentication code from the encrypted data when parsing the encrypted data.

[0181] Specifically, the verification of the integrity and tampering of the stream data is performed in the verification device. Therefore, the data processing device needs to send the first authentication code and the data stream identifier to the verification device along with the data access request.

[0182] In some implementations, prior to obtaining the encrypted data, the method further includes:

[0183] (1) Obtain user login information, send the user login information to the verification device so that the verification device can verify the user login information and return identity declaration information when the verification is successful;

[0184] (2) Receive identity statement information returned by the verification device based on the user login information;

[0185] The step of sending a data access request to the verification device, the data access request carrying the processing device public key of the data processing device, the first encryption key, the first authentication code, and the data stream identifier, includes:

[0186] A data access request is sent to the verification device, the data access request carrying the processing device public key of the data processing device, the first encryption key, the first authentication code, the data stream identifier, and the identity declaration information.

[0187] When the user management system is configured on the authentication device, the data processing device first sends user identity information, such as username and password, to the user management system on the authentication device for identity verification. After successful verification, the user management system returns a User Identity Token (JWT) to the data processing device. The JWT contains user identity information and session information. Subsequently, when the data processing device sends a data access request, it includes the JWT in the header of the request, allowing the authentication device to verify the target user's identity. The user management system can also be configured on third-party devices; this is not a limitation here.

[0188] Specifically, after the data processing device obtains the raw data, it can provide services using a specified protocol (such as the WebSocket protocol). Data applications do not need to be modified; they can simply establish a connection with the data processing device using the original protocol. This allows existing data sharing systems to expand their secure data sharing capabilities without modification or adaptation. This avoids the technical challenges of upgrading existing systems and reduces system access costs and complexity.

[0189] For details on the implementation of each of the above steps, please refer to the previous examples, which will not be repeated here.

[0190] To facilitate better implementation of the data transmission method provided in the embodiments of this application, the embodiments of this application also provide an apparatus based on the above data transmission method. The meanings of the terms used are the same as in the above data transmission method, and specific implementation details can be found in the descriptions in the method embodiments.

[0191] Please see Figure 8 , Figure 8 This is a schematic diagram of the structure of a data processing apparatus provided in an embodiment of this application. The data processing apparatus is applied to a verification device. The data transmission method apparatus may include a receiving unit 601, a first decryption unit 602, a first encryption unit 603, and a first sending unit 604, etc.

[0192] The receiving unit 601 is configured to receive a data access request sent by a data processing device. The data access request carries the processing device public key of the data processing device and a first encryption key. The data access request is a request generated when the data processing device requests access to encrypted data. The encrypted data carries an encrypted data body and the first encryption key. The encrypted data body is obtained by the data publishing device encrypting the original data based on the original key. The first encryption key is obtained by the data publishing device encrypting the original key using the verification device public key of the verification device.

[0193] The first decryption unit 602 is used to decrypt the first encryption key by verifying the device's private key to obtain the original key;

[0194] The first encryption unit 603 is used to encrypt the original key using the public key of the processing device to obtain a second encryption key;

[0195] The first sending unit 604 is used to send the second encryption key to the data processing device, so that the data processing device can decrypt the second encryption key using its private key to obtain the original key, and then decrypt the encrypted data body using the original key to obtain the original data.

[0196] In some embodiments, the device is further configured to:

[0197] The system receives a public key verification request from a data publishing device, sends the public key verification to the data publishing device, triggers the data publishing device to encrypt the original key, and obtains a first encryption key.

[0198] In some embodiments, the data access request further carries a first authentication code and a data stream identifier, wherein the first authentication code is an authentication code generated by the data publishing device based on the original key and the data stream identifier, and the data stream identifier is an identifier of the data stream to which the encrypted data body carried by the encrypted data requested by the data processing device belongs. The device is further configured to:

[0199] A second authentication code is generated based on the original key and the data stream identifier;

[0200] Compare the first authentication code with the second authentication code;

[0201] If the first authentication code is the same as the second authentication code, then the step of encrypting the original key using the public key of the processing device to obtain the second encryption key is performed.

[0202] In some embodiments, the device is further configured to:

[0203] In response to an access permission configuration instruction for a data stream, determine the user permissions and access time permissions required to access the data stream.

[0204] In some embodiments, the data access request also carries identity verification information, and the device is further configured to:

[0205] If the first authentication code is the same as the second authentication code, then the target user identifier of the target user is determined according to the identity declaration information, and the target user is the user who applied to access the encrypted data through the data processing device;

[0206] Obtain the access user permissions and access time permissions configured for the data stream corresponding to the data stream identifier;

[0207] If the target user identifier satisfies the access user permissions and the current time satisfies the access time permissions, then the step of encrypting the original key using the processing device public key to obtain the second encryption key is executed.

[0208] Please see Figure 9 , Figure 9This is another schematic diagram of the data processing apparatus provided in an embodiment of this application, which is applied to a data publishing device. The data transmission method apparatus may include a second sending unit 701, a second encryption unit 702, a third encryption unit 703, and an encapsulation unit 704, etc.

[0209] The second sending unit 701 is used to acquire raw data and send a verification device public key acquisition request to the verification device, so that the verification device returns the verification device public key according to the verification device public key acquisition request.

[0210] The second encryption unit 702 is used to generate an original key and encrypt the original data using the original key to obtain the encrypted data body;

[0211] The third encryption unit 703 is used to encrypt the original key using the public key of the verification device to obtain the first encryption key;

[0212] The encapsulation unit 704 is used to encapsulate the first encryption key and the encrypted data body to obtain encrypted data for publication.

[0213] In some embodiments, the device is further configured to:

[0214] Obtain the data stream identifier of the data stream to which the original data belongs;

[0215] A first authentication code is generated based on the data stream identifier and the original key;

[0216] The packaging unit 704 is used for:

[0217] Encapsulate the data stream identifier, the first encryption key, the first authentication code, and the encrypted data body to obtain encrypted data.

[0218] Please see Figure 10 , Figure 10 This is another schematic diagram of the data processing apparatus provided in an embodiment of this application. The data processing apparatus is applied to a data processing device. The data transmission method apparatus may include a parsing unit 801, a third sending unit 802, a second decryption unit 803, and a third decryption unit 804, etc.

[0219] The parsing unit 801 is used to acquire encrypted data, parse the encrypted data, and parse out the encrypted data body and the first encryption key. The encrypted data body is obtained by the data publishing device encrypting the original data based on the original key. The first encryption key is obtained by the data publishing device encrypting the original key based on the public key of the verification device.

[0220] The third sending unit 802 is used to send a data access request to the verification device. The data access request carries the processing device public key of the data processing device and the first encryption key.

[0221] The second decryption unit 803 is used to receive the second encryption key sent by the verification device, and decrypt the second encryption key using the processing device's private key to obtain the original key. The second encryption key is obtained by the verification device decrypting the first encryption key using the verification device's private key to obtain the original key, and then encrypting the original key using the processing device's public key.

[0222] The third decryption unit 804 is used to decrypt the encrypted data body using the original key to obtain the original data.

[0223] In some embodiments, the encrypted data further carries a first authentication code and a data stream identifier, wherein the data stream identifier is an identifier of the data stream to which the encrypted data body belongs. The apparatus is further configured to:

[0224] The first authentication code and the data stream identifier are parsed out.

[0225] The third transmitting unit 802 is used for:

[0226] A data access request is sent to the verification device, the data access request carrying the processing device public key of the data processing device, the first encryption key, the first authentication code, and the data stream identifier.

[0227] In some embodiments, the device is further configured to:

[0228] Obtain user login information, send the user login information to the verification device so that the verification device can verify the user login information, and return identity declaration information when the verification is successful;

[0229] Receive the identity statement information returned by the verification device based on the user login information;

[0230] The third transmitting unit 802 is used for:

[0231] A data access request is sent to the verification device, the data access request carrying the processing device public key of the data processing device, the first encryption key, the first authentication code, the data stream identifier, and the identity declaration information.

[0232] The specific implementation of each of the above units can be found in the previous embodiments, and will not be repeated here.

[0233] As described above, in this embodiment, the receiving unit 601 receives a data access request sent by a data processing device. The data access request carries the processing device's public key and a first encryption key. The data access request is generated when the data processing device requests access to encrypted data. The encrypted data carries the encrypted data body and the first encryption key. The encrypted data body is obtained by the data publishing device encrypting the original data based on the original key. The first encryption key is obtained by the data publishing device encrypting the original key using the verification device's public key. The first decryption unit 602 decrypts the first encryption key using the verification device's private key to obtain the original key. The first encryption unit 603 encrypts the original key using the processing device's public key to obtain a second encryption key. The first sending unit 604 sends the second encryption key to the data processing device, so that the data processing device decrypts the second encryption key using its private key to obtain the original key, and then decrypts the encrypted data body using the original key to obtain the original data.

[0234] Therefore, by using verification equipment to provide key encryption during data publishing and key decryption during data processing for both data publishing and data processing devices, this avoids the direct transmission of the original key, which could lead to interception and malicious decryption of the encrypted data. This improves the security of the original key, thereby reducing the risk of malicious decryption of the encrypted data and enhancing overall data security. Furthermore, the authentication code generated from the original key and data stream identifier ensures the integrity of the streaming data and prevents tampering. During the verification process, the user's identity is verified, and subsequent key management procedures are only executed after successful authentication, further enhancing data security. After the data processing device obtains the original data, it can provide services using a specified protocol. Data applications do not require modification; they can simply establish a connection with the data processing device using the original protocol. This allows existing data sharing systems to expand their secure data sharing capabilities without modification or adaptation. This avoids the technical challenges of upgrading existing systems and reduces system access costs and complexity. By dividing the original key and randomly sorting the sequence of original subkeys, and encrypting the target subkey sequence and the target subkey identifier sequence consisting of the identifiers corresponding to each original subkey in the randomly sorted target subkey sequence, the subsequent data processing device needs to decrypt the target subkey sequence and the target subkey identifier sequence through the verification device. Based on the subkey identifier sequence and the target subkey identifier sequence, the original subkeys in the target subkey identifier sequence are rearranged to restore the original key, further increasing the difficulty of cracking the original key and improving data security during data transmission.

[0235] The specific implementation of each of the above units can be found in the previous embodiments, and will not be repeated here.

[0236] Reference Figure 11 , Figure 11 This is a partial structural block diagram of a computer device 110 implementing an embodiment of the present disclosure. The computer device 110 can vary significantly due to different configurations or performance characteristics, and may include one or more central processing units (CPUs) 622 (e.g., one or more processors) and a memory 632, and one or more storage media 630 (e.g., one or more mass storage devices) storing application programs 642 or data 644. The memory 632 and storage media 630 may be temporary or persistent storage. The program stored in the storage media 630 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the server 600. Furthermore, the CPU 622 may be configured to communicate with the storage media 630 and execute the series of instruction operations in the storage media 630 on the server 600.

[0237] Computer device 110 may also include one or more power supplies 626, one or more wired or wireless network interfaces 650, one or more input / output interfaces 658, and / or one or more operating systems 641, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0238] When the computer device 110 is a verification device, the central processing unit 622 in the computer device 110 can be used to execute the data processing method of the embodiments of this disclosure, for example:

[0239] The system receives a data access request sent by a data processing device. The data access request carries the processing device public key of the data processing device and a first encryption key. The data access request is a request generated when the data processing device requests access to encrypted data. The encrypted data carries the encrypted data body and the first encryption key. The encrypted data body is obtained by the data publishing device encrypting the original data based on the original key. The first encryption key is obtained by the data publishing device encrypting the original key using the verification device public key of the verification device.

[0240] The original key is obtained by decrypting the first encryption key using the device's private key.

[0241] The original key is encrypted using the public key of the processing device to obtain a second encryption key;

[0242] The second encryption key is sent to the data processing device so that the data processing device can decrypt the second encryption key using its private key to obtain the original key, and then decrypt the encrypted data body using the original key to obtain the original data.

[0243] When the computer device 110 is a data publishing device, the central processing unit 622 in the computer device 110 can be used to execute the data processing method of the embodiments of this disclosure, for example:

[0244] Obtain the raw data and send a public key acquisition request to the verification device so that the verification device returns the public key of the verification device according to the public key acquisition request.

[0245] Generate an original key, and encrypt the original data using the original key to obtain the encrypted data body;

[0246] The original key is encrypted using the public key of the verification device to obtain the first encryption key;

[0247] The first encryption key and the encrypted data body are encapsulated to obtain encrypted data, which is then published.

[0248] When the computer device 110 is a data processing device, the central processing unit 622 in the computer device 110 can be used to execute the data processing method of the embodiments of this disclosure, for example:

[0249] The encrypted data is obtained, and the encrypted data is parsed to extract the encrypted data body and the first encryption key. The encrypted data body is obtained by the data publishing device encrypting the original data based on the original key, and the first encryption key is obtained by the data publishing device encrypting the original key based on the public key of the verification device.

[0250] Send a data access request to the verification device, the data access request carrying the processing device public key of the data processing device and the first encryption key;

[0251] The device receives a second encryption key sent by the verification device, decrypts the second encryption key using the processing device's private key to obtain the original key. The second encryption key is obtained by the verification device decrypting the first encryption key using the verification device's private key to obtain the original key, and then encrypting the original key using the processing device's public key.

[0252] The original data is obtained by decrypting the encrypted data body using the original key.

[0253] This disclosure also provides a computer-readable storage medium for storing program code for executing the data processing methods of the foregoing embodiments.

[0254] This disclosure also provides a computer program product comprising a computer program. A processor of a computer device reads and executes the computer program, causing the data processing method described above to be performed when the computer device is a verification device. For example:

[0255] The system receives a data access request sent by a data processing device. The data access request carries the processing device public key of the data processing device and a first encryption key. The data access request is a request generated when the data processing device requests access to encrypted data. The encrypted data carries the encrypted data body and the first encryption key. The encrypted data body is obtained by the data publishing device encrypting the original data based on the original key. The first encryption key is obtained by the data publishing device encrypting the original key using the verification device public key of the verification device.

[0256] The original key is obtained by decrypting the first encryption key using the device's private key.

[0257] The original key is encrypted using the public key of the processing device to obtain a second encryption key;

[0258] The second encryption key is sent to the data processing device so that the data processing device can decrypt the second encryption key using its private key to obtain the original key, and then decrypt the encrypted data body using the original key to obtain the original data.

[0259] When the computer device is a data publishing device, the data processing method described above is executed. For example:

[0260] Obtain the raw data and send a public key acquisition request to the verification device so that the verification device returns the public key of the verification device according to the public key acquisition request.

[0261] Generate an original key, and encrypt the original data using the original key to obtain the encrypted data body;

[0262] The original key is encrypted using the public key of the verification device to obtain the first encryption key;

[0263] The first encryption key and the encrypted data body are encapsulated to obtain encrypted data, which is then published.

[0264] When the computer device is a data processing device, it executes the data processing method described above. For example:

[0265] The encrypted data is obtained, and the encrypted data is parsed to extract the encrypted data body and the first encryption key. The encrypted data body is obtained by the data publishing device encrypting the original data based on the original key, and the first encryption key is obtained by the data publishing device encrypting the original key based on the public key of the verification device.

[0266] Send a data access request to the verification device, the data access request carrying the processing device public key of the data processing device and the first encryption key;

[0267] The device receives a second encryption key sent by the verification device, decrypts the second encryption key using the processing device's private key to obtain the original key. The second encryption key is obtained by the verification device decrypting the first encryption key using the verification device's private key to obtain the original key, and then encrypting the original key using the processing device's public key.

[0268] The original data is obtained by decrypting the encrypted data body using the original key.

[0269] Furthermore, the terms “comprising” and “including”, and any variations thereof, are intended to cover non-exclusive inclusion, such that a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or apparatus.

[0270] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0271] It should be understood that in the description of the embodiments of this application, "multiple" means two or more, "greater than", "less than", "exceeding" etc. are understood to exclude the number itself, and "above", "below", "within" etc. are understood to include the number itself.

[0272] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0273] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0274] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0275] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0276] It should also be understood that the various implementation methods provided in this application can be combined arbitrarily to achieve different technical effects.

[0277] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0278] The above is a detailed description of the embodiments of this application. However, this application is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A data processing method, characterized by, The application is applied to a verification device, comprising: receiving a data access request sent by a data processing device, wherein the data access request carries a processing device public key of the data processing device and a first encryption key, the data access request is generated when the data processing device applies for accessing encrypted data, the encrypted data carries an encrypted data body and the first encryption key, the encrypted data body is obtained by encrypting original data based on an original key by a data publishing device, and the first encryption key is obtained by encrypting the original key by the data publishing device through a verification device public key of the verification device; decrypting the first encryption key through a verification device private key to obtain the original key; encrypting the original key through the processing device public key to obtain a second encryption key; sending the second encryption key to the data processing device, so that the data processing device decrypts the second encryption key through a processing device private key to obtain the original key, and decrypts the encrypted data body through the original key to obtain original data.

2. The data processing method according to claim 1, characterized in that, The method further comprises: receiving a verification device public key acquisition request sent by a data publishing device, sending the verification device public key to the data publishing device to trigger the data publishing device to encrypt the original key to obtain the first encryption key.

3. The data processing method of claim 1, wherein, The data access request further carries a first authentication code and a data stream identifier, the first authentication code is an authentication code generated by the data publishing device based on the original key and the data stream identifier, and the data stream identifier is an identifier of a data stream to which the encrypted data body carried by the encrypted data applied by the data processing device for access belongs, after the original key is obtained by decrypting the first encryption key through the verification device private key, the method further comprises: generating a second authentication code based on the original key and the data stream identifier; comparing the first authentication code with the second authentication code; if the first authentication code is the same as the second authentication code, the step of encrypting the original key through the processing device public key to obtain the second encryption key is executed.

4. The data processing method according to claim 3, characterized in that, Before receiving the data access request sent by the data processing device, the method further comprises: determining access user rights and access time rights required for accessing the data stream in response to an access right configuration instruction of the data stream.

5. The data processing method according to claim 4, characterized in that, The data access request further carries identity declaration information, and the step of encrypting the original key through the processing device public key to obtain the second encryption key if the first authentication code is the same as the second authentication code comprises if the first authentication code is the same as the second authentication code, determining a target user identifier of a target user according to the identity declaration information, the target user being a user who applies for accessing the encrypted data through the data processing device; obtaining access user rights and access time rights configured for the data stream corresponding to the data stream identifier; If the target user identifier satisfies the access user right, and the current time satisfies the access time right, the step of encrypting the original key by the processing device public key to obtain a second encrypted key is performed.

6. A data processing method, characterized by, Applied to a data publishing device, comprising: Obtaining original data, sending a verification device public key obtaining request to a verification device to enable the verification device to return a verification device public key according to the verification device public key obtaining request; Generating an original key, encrypting the original data by the original key to obtain encrypted data body; Encrypting the original key by the verification device public key to obtain a first encrypted key; Packaging the first encrypted key and the encrypted data body to obtain encrypted data, publishing the encrypted data, enabling a data processing device to obtain encrypted data, analyzing the encrypted data to analyze encrypted data body and a first encrypted key, the encrypted data body being obtained by encrypting original data by an original key based on a data publishing device, the first encrypted key being obtained by encrypting the original key by a verification device public key based on the data publishing device, sending a data access request to the verification device, the data access request carrying a processing device public key of the data processing device and the first encrypted key, receiving a second encrypted key sent by the verification device, decrypting the second encrypted key by a processing device private key to obtain the original key, the second encrypted key being obtained by encrypting the original key by the processing device public key after the verification device decrypts the first encrypted key by a verification device private key to obtain the original key, and decrypting the encrypted data body by the original key to obtain the original data.

7. The data processing method according to claim 6, characterized in that, Before the step of packaging the first encrypted key and the encrypted data body to obtain encrypted data, the method further comprises: Obtaining a data stream identifier of a data stream to which the original data belongs; Generating a first authentication code based on the data stream identifier and the original key; The step of packaging the first encrypted key and the encrypted data body to obtain encrypted data comprises: Packaging the data stream identifier, the first encrypted key, the first authentication code, and the encrypted data body to obtain encrypted data.

8. A data processing method, characterized by, Applied to a data processing device, comprising: Obtaining encrypted data, analyzing the encrypted data to analyze encrypted data body and a first encrypted key, the encrypted data body being obtained by encrypting original data by an original key based on a data publishing device, the first encrypted key being obtained by encrypting the original key by a verification device public key based on the data publishing device; Sending a data access request to the verification device, the data access request carrying a processing device public key of the data processing device and the first encrypted key; receiving the second encryption key sent by the verification device, and decrypting the second encryption key by using a private key of the processing device to obtain the original key, wherein the second encryption key is obtained by decrypting the first encryption key by using a private key of the verification device and then encrypting the original key by using a public key of the processing device; decrypting the encrypted data body by using the original key to obtain the original data.

9. The data processing method according to claim 8, characterized in that, The encrypted data further carries a first authentication code and a data stream identifier, and the data stream identifier is an identifier of a data stream to which the encrypted data body belongs. After the encrypted data is parsed, the following steps are further included. parsing the first authentication code and the data stream identifier; The data access request sent to the verification device carries the public key of the processing device, the first encryption key, the first authentication code, and the data stream identifier. The data access request sent to the verification device carries the public key of the processing device, the first encryption key, the first authentication code, and the data stream identifier.

10. The data processing method according to claim 9, characterized in that, Before the encrypted data is obtained, the following steps are further included. obtaining user login information, sending the user login information to the verification device to enable the verification device to verify the user login information, and returning identity declaration information when the verification is passed; receiving the identity declaration information returned by the verification device based on the user login information; The data access request sent to the verification device carries the public key of the processing device, the first encryption key, the first authentication code, and the data stream identifier. The data access request sent to the verification device carries the public key of the processing device, the first encryption key, the first authentication code, and the data stream identifier.

11. A data processing apparatus, applied to a verification device, comprising: a receiving unit configured to receive a data access request sent by a data processing device, wherein the data access request carries a public key of the processing device and a first encryption key, the data access request is generated by the data processing device when the data processing device applies for accessing encrypted data, the encrypted data carries an encrypted data body and the first encryption key, the encrypted data body is obtained by encrypting original data by using an original key based on a data publishing device, and the first encryption key is obtained by encrypting the original key by using a public key of the verification device based on a data publishing device; a first decryption unit configured to decrypt the first encryption key by using a private key of the verification device to obtain the original key; a first encryption unit configured to encrypt the original key by using the public key of the processing device to obtain a second encryption key. The first sending unit is configured to send the second encryption key to the data processing device, so that the data processing device decrypts the second encryption key by using a processing device private key to obtain the original key, and decrypts the encrypted data body by using the original key to obtain the original data.

12. A data processing apparatus, characterized by The application is applied to a data publishing device, and includes: The second sending unit is configured to obtain original data, and send a verification device public key obtaining request to a verification device, so that the verification device returns a verification device public key according to the verification device public key obtaining request. The second encryption unit is configured to generate an original key, encrypt the original data by using the original key to obtain an encrypted data body. The third encryption unit is configured to encrypt the original key by using the verification device public key to obtain a first encryption key. The packaging unit is configured to package the first encryption key and the encrypted data body to obtain encrypted data, publish the encrypted data, and obtain the encrypted data by using a data processing device, analyze the encrypted data to obtain the encrypted data body and the first encryption key, encrypt the original data by using the original key to obtain the encrypted data body, encrypt the original key by using the verification device public key to obtain the first encryption key, send a data access request to the verification device, the data access request carries a processing device public key of the data processing device and the first encryption key, receive a second encryption key sent by the verification device, decrypt the second encryption key by using a processing device private key to obtain the original key, decrypt the first encryption key by using a verification device private key to obtain the original key, and encrypt the original key by using the processing device public key, and decrypt the encrypted data body by using the original key to obtain the original data.

13. A data processing apparatus, characterized by: The application is applied to a data processing device, and includes: The analysis unit is configured to obtain encrypted data, analyze the encrypted data to obtain an encrypted data body and a first encryption key, encrypt the original data by using an original key to obtain the encrypted data body, and encrypt the original key by using a verification device public key to obtain the first encryption key. The third sending unit is configured to send a data access request to the verification device, the data access request carrying a processing device public key of the data processing device and the first encryption key. The second decryption unit is configured to receive a second encryption key sent by the verification device, decrypt the second encryption key by using a processing device private key to obtain an original key, decrypt the first encryption key by using a verification device private key to obtain the original key, and encrypt the original key by using the processing device public key. The third decryption unit is configured to decrypt the encrypted data body by using the original key to obtain the original data.

14. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a plurality of instructions adapted to be loaded by the processor to execute the data processing method according to any one of claims 1 to 10.

15. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor implements the data processing method according to any one of claims 1 to 10 when executing the computer program.

Images