Data processing method, system and terminal based on data identification

Abstract

The invention discloses a data processing method and system based on data identification and a terminal, and the method comprises the steps: obtaining initial data collected by a data sensor, carrying out the identification processing of the initial data through a data identification hardware engine, and obtaining first target data; performing encryption processing on the first target data through a cryptographic algorithm engine to obtain second target data; transmitting the second target data to a storage area, and decrypting the second target data to obtain decrypted second target data; and performing auditing processing on the decrypted second target data to obtain an auditing result, and if the auditing result is that auditing is passed, storing the decrypted second target data as credible data in the storage area. According to the invention, before the data is stored in the terminal equipment, a hardware isolation effect can be performed on the data, so that the possibility of data change is reduced, the security of the data is greatly improved, and the loss of a user is reduced.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data processing method, system, terminal and computer-readable storage medium based on data identification. Background Art

[0002] Information security is the technical and management security protection established and adopted by data processing systems in order to protect computer hardware, software, and data from being destroyed, altered, or leaked due to accidental or malicious reasons.

[0003] With the development of the times, users pay more attention to information security. At present, the data collected by data sensors are directly stored in the storage area of ​​the terminal device, and then a series of security processing is performed on the data in the storage area, such as encryption.

[0004] However, the prior art does not take into account the security of data transmission from the time the data sensor collects data to the time the data is sent to the terminal for storage. Often, after the data reaches the storage area of ​​the terminal device, a series of security processing is performed. If the process from the time the data sensor collects data to the time the data is sent to the terminal for storage is not protected, the transmitted data may be altered, resulting in the data received by the terminal device being different from the original data, reducing the security of the data and causing losses to the user.

[0005] Therefore, the prior art still needs to be improved and developed. Summary of the invention

[0006] The main purpose of the present invention is to provide a data processing method, system, terminal and computer-readable storage medium based on data identification, aiming to solve the problem in the prior art that there is a lack of data protection in the process of sending data collected by data sensors to the storage area of ​​terminal devices, resulting in changes in the transmitted data, causing the data received by the terminal device to be not the original data, and reducing data security.

[0007] To achieve the above object, the present invention provides a data processing method based on data identification, and the data processing method based on data identification comprises the following steps:

[0008] Acquire initial data collected by a data sensor, and perform identification processing on the initial data through a data identification hardware engine to obtain first target data;

[0009] Encrypting the first target data by a cryptographic algorithm engine to obtain second target data;

[0010] The second target data is transferred to a storage area, and the second target data is decrypted to obtain the decrypted second target data;

[0011] The decrypted second target data is audited to obtain an audit result. If the audit result is passed, the decrypted second target data is stored in the storage area as trusted data.

[0012] Optionally, the data processing method based on data identification, wherein the step of performing identification processing on the initial data by using a data identification hardware engine to obtain the first target data, specifically includes:

[0013] Obtain the source device ID, data classification, and software version number of the initial data, and generate the collection time of the initial data through a hardware trusted clock;

[0014] The data identification hardware engine uses the source device ID, data classification, software version number, and collection time of the initial data as the identification of the initial data;

[0015] A data identification summary of the initial data is generated according to the identification, and the identification, the data identification summary and the initial data are packaged to obtain first target data.

[0016] Optionally, the data processing method based on data identification, wherein the step of encrypting the first target data by a cryptographic algorithm engine to obtain the second target data, specifically includes:

[0017] Performing key symmetric encryption processing on the first target data through a cryptographic algorithm engine to obtain first intermediate data;

[0018] Swap a preset number of characters at the beginning and the end of the intermediate data to obtain encrypted data, generate a corresponding signature, package the encrypted data and the signature to obtain second target data, and the signature is used to indicate that the data has been encrypted.

[0019] Optionally, in the data processing method based on data identification, the step of transmitting the second target data to a storage area specifically includes:

[0020] Preset a fixed time interval and a data volume threshold, obtain the time interval between the current time and the last data transmission in real time, and obtain the data volume of the second target data in real time;

[0021] If the time interval satisfies the fixed time interval, or the data volume of the second target data reaches the data volume threshold, the second target data is transferred to the storage area.

[0022] Optionally, the data processing method based on data identification, wherein the decrypting the second target data to obtain the decrypted second target data, specifically includes:

[0023] Acquire a key for key symmetric encryption processing, and decrypt the encrypted data in the second target data according to the key to obtain second intermediate data;

[0024] The preset number of characters at the beginning and the preset number of characters at the end of the second intermediate data are swapped to obtain the decrypted second target data.

[0025] Optionally, the data processing method based on data identification, wherein the audit processing of the decrypted second target data to obtain the audit result specifically includes:

[0026] Obtaining the identifier and data identifier digest of the decrypted second target data, and calculating hash values ​​of the identifier and the data identifier digest;

[0027] Compare the hash value of the identifier with the hash value of the data identifier summary. If the hash value of the identifier is equal to the hash value of the data identifier summary, check the signature. If the signature check passes, the audit result obtained is audit passed.

[0028] If the hash value of the identifier is not equal to the hash value of the data identifier digest, or the signature check fails, the audit result obtained is that the audit failed.

[0029] Optionally, the data processing method based on data identification, wherein the decrypted second target data is audited to obtain an audit result, further comprising:

[0030] If the audit result is that the audit fails, the decrypted second target data is deleted from the storage area, the audit result is reported to the cloud, and the security analysis result from the cloud is received.

[0031] In addition, to achieve the above-mentioned purpose, the present invention further provides a data processing system based on data identification, wherein the data processing system based on data identification includes:

[0032] An identification processing module, used to obtain initial data collected by the data sensor, and perform identification processing on the initial data through a data identification hardware engine to obtain first target data;

[0033] An encryption processing module, used for encrypting the first target data through a cryptographic algorithm engine to obtain second target data;

[0034] A decryption processing module, used for transferring the second target data to a storage area, and performing decryption processing on the second target data to obtain decrypted second target data;

[0035] The trusted audit module is used to audit the decrypted second target data to obtain an audit result. If the audit result is passed, the decrypted second target data is stored in the storage area as trusted data.

[0036] In addition, to achieve the above-mentioned purpose, the present invention also provides a terminal, wherein the terminal includes: a memory, a processor, and a data processing program based on data identification stored in the memory and executable on the processor, and when the data processing program based on data identification is executed by the processor, the steps of the data processing method based on data identification as described above are implemented.

[0037] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a data processing program based on data identification, and when the data processing program based on data identification is executed by a processor, the steps of the data processing method based on data identification as described above are implemented.

[0038] In the present invention, the initial data collected by the data sensor is obtained, and the initial data is identified by a data identification hardware engine to obtain the first target data; the first target data is encrypted by a cryptographic algorithm engine to obtain the second target data; the second target data is transmitted to a storage area, and the second target data is decrypted to obtain the decrypted second target data; the decrypted second target data is audited to obtain an audit result, and if the audit result is that the audit is passed, the decrypted second target data is stored in the storage area as trusted data. The present invention can perform a hardware isolation on the data before the data is stored in the terminal device, which reduces the possibility of data change, greatly improves the security of the data, and thus reduces the loss of users. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a flow chart of a preferred embodiment of the data processing method based on data identification of the present invention;

[0040] Figure 2 It is a schematic diagram of the principle of a preferred embodiment of a data processing system based on data identification of the present invention;

[0041] Figure 3 Schematic diagram of the operating environment of a preferred embodiment of the terminal of the present invention. DETAILED DESCRIPTION

[0042] The present application provides a data processing method based on data identification and related equipment. In order to make the purpose, technical solution and effect of the present application clearer and more specific, the present application is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described here are only used to explain the present application and are not used to limit the present application.

[0043] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with those in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0044] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0045] The data processing method based on data identification described in the preferred embodiment of the present invention is as follows: Figure 1 As shown, the data processing method based on data identification includes the following steps:

[0046] Step S10: Acquire initial data collected by the data sensor, and perform identification processing on the initial data through a data identification hardware engine to obtain first target data.

[0047] Specifically, the source device ID, data classification, and software version number of the initial data are obtained, and the collection time of the initial data is generated through a hardware trusted clock.

[0048] It is understandable that when the data sensor completes the initial data collection, the initial data sent by the data sensor is received, and the source device ID, data classification, and software version number (software version numbering refers to the way of setting the version number for the software. Usually, the version number will be set in numbers, but there are different ways. There are often some English and numbers after the software name, such as: QQ 2007Beta). At the same time, the collection time of the initial data is generated by the hardware trusted clock; wherein, the hardware trusted clock is the clock displayed on the BIOS interface, also known as the backup clock or real-time clock. The reason for this is that the hardware clock will not stop running due to power failure or shutdown, and the operation of the hardware clock depends on the operation of the button battery on the motherboard.

[0049] Furthermore, the source device ID, data classification, software version number, and collection time of the initial data are used as identification of the initial data through a data identification hardware engine.

[0050] In this embodiment, the source device ID, data classification, software version number, and collection time are integrated through a data identification hardware engine, and they are used as identifiers of the initial data. After the data is identified according to the data identification format, it can be used for subsequent data security detection.

[0051] Furthermore, a data identification summary of the initial data is generated according to the identification, and the identification, the data identification summary and the initial data are packaged to obtain first target data.

[0052] It can be understood that the source device ID, data classification, software version number, and collection time are integrated to generate a data identification summary of the initial data, which contains the approximate information of the data and can be used for subsequent comparison and judgment; the identification, the data identification summary and the initial data are packaged to obtain the first target data with completed identification.

[0053] Step S20: encrypt the first target data using a cryptographic algorithm engine to obtain second target data.

[0054] Specifically, the first target data is symmetric encrypted with a key by a cryptographic algorithm engine to obtain first intermediate data.

[0055] In this embodiment, the first intermediate data is obtained by performing key symmetric encryption through the cryptographic algorithm engine, that is, the first encryption process of the data is completed. The cryptographic algorithm engine includes a key symmetric encryption algorithm, which is also called private key encryption or shared key encryption, that is, the two parties sending and receiving data must use the same key to encrypt and decrypt the plaintext. The symmetric key encryption algorithm mainly includes: DES, 3DES, IDEA, RC5, RC6, etc. As an example, suppose A needs to send a document with a plaintext of M to B, but because he is afraid that the document will be eavesdropped or tampered with in the middle of the transmission, A uses symmetric encryption to encrypt M by processing it through an encryption function to generate M', and after B receives the encrypted text, it can restore it to the plaintext M by reprocessing M' as agreed in advance, thereby achieving the purpose of secure transmission of information.

[0056] Furthermore, a preset number of characters at the beginning and the preset number of characters at the end of the intermediate data are swapped to obtain encrypted data, and a corresponding signature is generated. The encrypted data and the signature are packaged to obtain second target data, and the signature is used to indicate that the data has been encrypted.

[0057] It can be understood that after the first target data is encrypted for the first time through the cryptographic algorithm engine, in order to further improve the security of data transmission and ensure that the device storing the data is the original data, this embodiment swaps the preset number of characters at the beginning and end of the intermediate data with the preset number of characters at the end to obtain the encrypted data.

[0058] As an example, assuming that the intermediate data is 1010001001110, and the preset number is set to 3 (the specific number can be set according to the situation and is not limited here), then after swapping the first 3 characters and the last 3 characters of the intermediate data, the encrypted data obtained is 1100001001101. The double-layer encryption processing further ensures the security of the data.

[0059] Furthermore, a corresponding signature is generated for the encrypted data, and the encrypted data and the signature are packaged to obtain the second target data. It can be understood that the signature is an identifier, and when the data has a signature, it means that the data is encrypted data, which can avoid obtaining unencrypted risk data and data from other sources.

[0060] Step S30: transferring the second target data to a storage area, and decrypting the second target data to obtain decrypted second target data.

[0061] The transferring the second target data to the storage area specifically includes:

[0062] Preset a fixed time interval and a data volume threshold, obtain the time interval between the current time and the last data transmission in real time, and obtain the data volume of the second target data in real time;

[0063] If the time interval satisfies the fixed time interval, or the data volume of the second target data reaches the data volume threshold, the second target data is transferred to the storage area.

[0064] In this embodiment, the data acquisition device can transmit in real time or perform batch transmission after the terminal stores a certain amount or time of data. For this purpose, a fixed time interval and a data volume threshold are pre-set as conditions for the start of the two types of data transmission, and then the time interval between the current time and the last data transmission and the data volume of the second target data acquired in real time are compared with the two conditions. If the time interval meets the fixed time interval, or the data volume of the second target data reaches the data volume threshold, the second target data is transferred to the storage area; that is, as long as one of the two conditions is met, the second target data is transferred to the storage area to realize batch transmission, which greatly speeds up the transmission speed and effectively reduces the amount of calculation of the system.

[0065] Further, the decrypting the second target data to obtain the decrypted second target data specifically includes:

[0066] Acquire a key for key symmetric encryption processing, and decrypt the encrypted data in the second target data according to the key to obtain second intermediate data;

[0067] The preset number of characters at the beginning and the preset number of characters at the end of the second intermediate data are swapped to obtain the decrypted second target data.

[0068] It can be understood that, similar to the encryption process described above, the encrypted data can be decrypted using an algorithm opposite to the encryption process to obtain the second intermediate data, which will not be described in detail here.

[0069] Step S40: audit the decrypted second target data to obtain an audit result. If the audit result is passed, the decrypted second target data is stored in the storage area as trusted data.

[0070] The auditing of the decrypted second target data to obtain the audit result specifically includes:

[0071] Obtaining the identifier and data identifier digest of the decrypted second target data, and calculating hash values ​​of the identifier and the data identifier digest;

[0072] Compare the hash value of the identifier with the hash value of the data identifier summary. If the hash value of the identifier is equal to the hash value of the data identifier summary, check the signature. If the signature check passes, the audit result obtained is audit passed.

[0073] If the hash value of the identifier is not equal to the hash value of the data identifier digest, or the signature check fails, the audit result obtained is that the audit failed.

[0074] In this embodiment, after obtaining the decrypted data, it is necessary to determine whether the decrypted data meets the storage conditions. At this time, it is necessary to calculate the hash value of the data identification field and compare it with the data identification summary field. If the hash value of the identification is equal to the hash value of the data identification summary, it means that the hash value judgment is correct, and the signature of the data packet needs to be further verified. If the signature verification passes, it means that the data packet has not been tampered with, and the second data can be stored in the storage area as trusted data (the trusted data can also be used for other purposes, such as training models, etc., and the storage in the storage area here is only an example). If the hash value of the identification is not equal to the hash value of the data identification summary, or the signature check fails, the audit result obtained is that the audit fails, and the decrypted second target data cannot be stored in the storage area as trusted data.

[0075] Furthermore, the decrypted second target data is audited to obtain an audit result, and then the following steps are further included:

[0076] If the audit result is that the audit fails, the decrypted second target data is deleted from the storage area, the audit result is reported to the cloud, and the security analysis result from the cloud is received.

[0077] It can be understood that if the hash value of the identifier is not equal to the hash value of the data identifier summary, or the signature check fails, the audit result is audit failure, indicating that there is a problem with the data at this time, that is, there may be a security problem (vulnerability) in the data transmission process. Therefore, the decrypted second target data is first immediately deleted from the storage area, and then the audit result is reported to the cloud. After receiving the audit result, the cloud begins to analyze the entire link of data transmission to solve the security problem, and feeds back the security analysis results to the terminal.

[0078] It can be seen that the present invention can perform a hardware isolation on the data before the data is stored in the terminal device. By comparing the data encryption and identification, it can accurately determine whether the data is safe, reduce the possibility of data change, greatly improve the security of the data, and thus reduce the loss of users.

[0079] Furthermore, if Figure 2As shown, based on the above-mentioned data processing method based on data identification, the present invention also provides a data processing system based on data identification, wherein the data processing system based on data identification includes:

[0080] The identification processing module 41 is used to obtain the initial data collected by the data sensor, and perform identification processing on the initial data through the data identification hardware engine to obtain the first target data;

[0081] An encryption processing module 42, configured to perform encryption processing on the first target data through a cryptographic algorithm engine to obtain second target data;

[0082] A decryption processing module 43, used for transmitting the second target data to a storage area, and performing decryption processing on the second target data to obtain decrypted second target data;

[0083] The trusted audit module 44 is used to audit the decrypted second target data to obtain an audit result. If the audit result is passed, the decrypted second target data is stored as trusted data in the storage area.

[0084] Furthermore, if Figure 3 As shown, based on the above-mentioned data processing method and system based on data identification, the present invention also provides a terminal accordingly, and the terminal includes a processor 10, a memory 20 and a display 30. Figure 3 Only some components of the terminal are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0085] The memory 20 may be an internal storage unit of the terminal in some embodiments, such as a hard disk or memory of the terminal. The memory 20 may also be an external storage device of the terminal in other embodiments, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the terminal. Further, the memory 20 may also include both an internal storage unit of the terminal and an external storage device. The memory 20 is used to store application software and various types of data installed in the terminal, such as the program code of the installation terminal, etc. The memory 20 may also be used to temporarily store data that has been output or is to be output. In one embodiment, a data processing program 40 based on a data identifier is stored on the memory 20, and the data processing program 40 based on a data identifier can be executed by the processor 10, thereby realizing the data processing method based on a data identifier in the present application.

[0086] In some embodiments, the processor 10 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run the program code stored in the memory 20 or process data, such as executing the data processing method based on data identification.

[0087] In some embodiments, the display 30 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 30 is used to display information on the terminal and to display a visual user interface. The components 10-30 of the terminal communicate with each other via a system bus.

[0088] In one embodiment, when the processor 10 executes the data processing program 40 based on the data identifier in the memory 20, the following steps are implemented:

[0089] Acquire initial data collected by a data sensor, and perform identification processing on the initial data through a data identification hardware engine to obtain first target data;

[0090] Encrypting the first target data by a cryptographic algorithm engine to obtain second target data;

[0091] The second target data is transferred to a storage area, and the second target data is decrypted to obtain the decrypted second target data;

[0092] The decrypted second target data is audited to obtain an audit result. If the audit result is passed, the decrypted second target data is stored in the storage area as trusted data.

[0093] The step of performing identification processing on the initial data by using a data identification hardware engine to obtain the first target data specifically includes:

[0094] Obtain the source device ID, data classification, and software version number of the initial data, and generate the collection time of the initial data through a hardware trusted clock;

[0095] The data identification hardware engine uses the source device ID, data classification, software version number, and collection time of the initial data as the identification of the initial data;

[0096] A data identification summary of the initial data is generated according to the identification, and the identification, the data identification summary and the initial data are packaged to obtain first target data.

[0097] The step of encrypting the first target data by a cryptographic algorithm engine to obtain the second target data specifically includes:

[0098] Performing key symmetric encryption processing on the first target data through a cryptographic algorithm engine to obtain first intermediate data;

[0099] Swap a preset number of characters at the beginning and the end of the intermediate data to obtain encrypted data, generate a corresponding signature, package the encrypted data and the signature to obtain second target data, and the signature is used to indicate that the data has been encrypted.

[0100] The step of transferring the second target data to the storage area specifically includes:

[0101] Preset a fixed time interval and a data volume threshold, obtain the time interval between the current time and the last data transmission in real time, and obtain the data volume of the second target data in real time;

[0102] If the time interval satisfies the fixed time interval, or the data volume of the second target data reaches the data volume threshold, the second target data is transferred to the storage area.

[0103] The decrypting the second target data to obtain the decrypted second target data specifically includes:

[0104] Acquire a key for key symmetric encryption processing, and decrypt the encrypted data in the second target data according to the key to obtain second intermediate data;

[0105] The preset number of characters at the beginning and the preset number of characters at the end of the second intermediate data are swapped to obtain the decrypted second target data.

[0106] The auditing of the decrypted second target data to obtain the audit result specifically includes:

[0107] Obtaining the identifier and data identifier digest of the decrypted second target data, and calculating hash values ​​of the identifier and the data identifier digest;

[0108] Compare the hash value of the identifier with the hash value of the data identifier summary. If the hash value of the identifier is equal to the hash value of the data identifier summary, check the signature. If the signature check passes, the audit result obtained is audit passed.

[0109] If the hash value of the identifier is not equal to the hash value of the data identifier digest, or the signature check fails, the audit result obtained is that the audit failed.

[0110] The process of auditing the decrypted second target data to obtain an audit result further includes:

[0111] If the audit result is that the audit fails, the decrypted second target data is deleted from the storage area, the audit result is reported to the cloud, and the security analysis result from the cloud is received.

[0112] In summary, the present invention provides a data processing method, system and terminal based on data identification, the method comprising: obtaining the initial data collected by the data sensor, and performing identification processing on the initial data through the data identification hardware engine to obtain the first target data; encrypting the first target data through the cryptographic algorithm engine to obtain the second target data; transmitting the second target data to the storage area, decrypting the second target data to obtain the decrypted second target data; auditing the decrypted second target data to obtain the audit result, and if the audit result is that the audit is passed, the decrypted second target data is stored in the storage area as trusted data. The present invention can perform a hardware isolation on the data before the data is stored in the terminal device, which reduces the possibility of data change, greatly improves the security of the data, and thus reduces the loss of users.

[0113] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or terminal including the element.

[0114] Of course, those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0115] It should be understood that the application of the present invention is not limited to the above examples. For ordinary technicians in this field, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A data processing method based on data identification, characterized in that: The data processing method based on data identification includes: Acquire initial data collected by the data sensor, and perform identification processing on the initial data through a data identification hardware engine to obtain first target data; Encrypting the first target data by a cryptographic algorithm engine to obtain second target data; The second target data is transferred to a storage area, and the second target data is decrypted to obtain the decrypted second target data; The decrypted second target data is audited to obtain an audit result. If the audit result is that the audit is passed, the decrypted second target data is stored in the storage area as trusted data.

2. The data processing method based on data identification according to claim 1 is characterized in that: The step of performing identification processing on the initial data by using a data identification hardware engine to obtain the first target data specifically includes: Obtain the source device ID, data classification, and software version number of the initial data, and generate the collection time of the initial data through a hardware trusted clock; The data identification hardware engine uses the source device ID, data classification, software version number, and collection time of the initial data as the identification of the initial data; A data identification summary of the initial data is generated according to the identification, and the identification, the data identification summary and the initial data are packaged to obtain first target data.

3. The data processing method based on data identification according to claim 2 is characterized in that: The encrypting the first target data by using a cryptographic algorithm engine to obtain the second target data specifically includes: Performing key symmetric encryption processing on the first target data through a cryptographic algorithm engine to obtain first intermediate data; Swap a preset number of characters at the beginning and the end of the intermediate data to obtain encrypted data, generate a corresponding signature, and package the encrypted data and the signature to obtain second target data, wherein the signature is used to indicate that the data has been encrypted.

4. The data processing method based on data identification according to claim 1 is characterized in that: The transferring the second target data to the storage area specifically includes: Preset a fixed time interval and a data volume threshold, obtain the time interval between the current time and the last data transmission in real time, and obtain the data volume of the second target data in real time; If the time interval satisfies the fixed time interval, or the data volume of the second target data reaches the data volume threshold, the second target data is transferred to the storage area.

5. The data processing method based on data identification according to claim 3 is characterized in that: The decrypting the second target data to obtain the decrypted second target data specifically includes: Acquire a key for key symmetric encryption processing, and decrypt the encrypted data in the second target data according to the key to obtain second intermediate data; The preset number of characters at the beginning and the preset number of characters at the end of the second intermediate data are swapped to obtain the decrypted second target data.

6. The data processing method based on data identification according to claim 5 is characterized in that: The auditing of the decrypted second target data to obtain the audit result specifically includes: Obtaining the identifier and data identifier digest of the decrypted second target data, and calculating hash values ​​of the identifier and the data identifier digest; Compare the hash value of the identifier with the hash value of the data identifier summary. If the hash value of the identifier is equal to the hash value of the data identifier summary, check the signature. If the signature check passes, the audit result obtained is audit passed. If the hash value of the identifier is not equal to the hash value of the data identifier digest, or the signature check fails, the audit result obtained is that the audit failed.

7. The data processing method based on data identification according to claim 1 is characterized in that: The decrypted second target data is audited to obtain an audit result, and then the following steps are further included: If the audit result is that the audit fails, the decrypted second target data is deleted from the storage area, the audit result is reported to the cloud, and the security analysis result from the cloud is received.

8. A data processing system based on data identification, characterized in that: The data processing system based on data identification includes: An identification processing module, used to obtain initial data collected by the data sensor, and perform identification processing on the initial data through a data identification hardware engine to obtain first target data; An encryption processing module, used for encrypting the first target data through a cryptographic algorithm engine to obtain second target data; a decryption processing module, used for transferring the second target data to a storage area, and performing decryption processing on the second target data to obtain decrypted second target data; The trusted audit module is used to audit the decrypted second target data to obtain an audit result. If the audit result is passed, the decrypted second target data is stored in the storage area as trusted data.

9. A terminal, characterized in that: The terminal includes: a memory, a processor, and a data processing program based on data identification stored in the memory and executable on the processor. When the data processing program based on data identification is executed by the processor, the steps of the data processing method based on data identification as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a data processing program based on data identification, and when the data processing program based on data identification is executed by a processor, the steps of the data processing method based on data identification as described in any one of claims 1 to 7 are implemented.

Images