Data processing method and device based on security aspect, medium and equipment

Abstract

The embodiment of the invention discloses a data processing method and device based on a security aspect, a storage medium and equipment, and the method comprises the steps: intercepting to-be-stored data to be uploaded to a cloud storage server through an aspect program inserted in a cloud storage client; and encrypting the to-be-stored data through an encryption key generated under a preset security protection mechanism of the aspect program, assembling a ciphertext of the encryption key and the encrypted data together, and uploading the assembled ciphertext and encrypted data to a cloud storage server. And when the data is loaded from the cloud storage server, the data can be recovered by decrypting the obtained encryption key based on the ciphertext of the encryption key through the same security protection mechanism. Therefore, data transmission between the terminal and the cloud storage server is encrypted, the encryption process is protected by the security protection mechanism, and the plaintext of the encryption key is always in protection. On one hand, the security during data transmission is enhanced, on the other hand, the possibility of key leakage when the cloud storage client is attacked is reduced, and the security of the cloud storage data is improved from multiple angles.

Description

Technical Field

[0001] The present invention relates to computer technology, and in particular to a data processing method, device, medium and equipment based on security aspects. Background Art

[0002] At present, with the rapid development of the Internet, cloud services are becoming more and more widely used. Among them, Object Storage Service (OSS) provides users with a simple, secure, large-scale, low-cost, and highly durable data storage service, which is suitable for storing and processing unstructured data, such as pictures, videos, and audio files.

[0003] In the prior art, users create buckets to store data objects through OSS clients. Users can use APIs or SDKs to upload, download, and manage these objects, set access permissions, and track usage through monitoring tools.

[0004] However, in the prior art, OSS clients and OSS servers generally use HTTPS secure links to store data in plain text on the OSS server. This approach brings security requirements for the communication link, and it is also difficult to prevent security risks caused by OSS products doing evil in the background, such as OSS product administrators stealing or leaking user data.

[0005] In order to solve the above problems, the present invention proposes a data processing method based on security aspects, which can significantly improve the security of OSS service storage data. Summary of the invention

[0006] The embodiments of this specification provide a data processing method based on security aspects, which intercepts the data to be stored to be uploaded to the cloud storage server through the aspect program pre-inserted in the cloud storage client, encrypts the data to be stored through the encryption key generated under the preset security protection mechanism of the aspect program, and assembles the ciphertext of the encryption key and the encrypted data together and uploads them to the cloud storage server. When loading data from the cloud storage server, the encryption key obtained by decryption based on the ciphertext of the encryption key can be used to restore the data using the same security protection mechanism. The data transmitted between the terminal and the cloud storage server is encrypted, and the encryption process is protected by the security protection mechanism, and the plaintext of the encryption key is always protected. On the one hand, the security of data transmission is enhanced, and on the other hand, the possibility of key leakage when the cloud storage client is attacked is reduced, thereby improving the security of cloud storage data from multiple angles. The method is applied to a terminal, and the cloud storage client of the terminal has a pre-deployed aspect base. The method includes: The method is applied to a terminal, wherein a cloud storage client of the terminal has a pre-deployed slice base, and the method comprises: In response to the cloud storage client calling the upload function, intercepting the call request for calling the upload function through a slice program, and determining the data to be stored carried in the intercepted call request, wherein the slice program is pre-configured by the slice base into the cloud storage client; Calling the software password module in the aspect program, and generating a plain text of the encryption key and a cipher text of the encryption key under the security protection mechanism preset by the software password module; According to the security protection mechanism, the data to be stored is encrypted by using the plain text of the encryption key to obtain encrypted data; The encrypted data and the ciphertext of the encryption key are assembled through the aspect program to obtain cloud storage data and send it to a cloud storage server, so that the cloud storage server stores the assembled cloud storage data.

[0007] Furthermore, in some embodiments, The method further comprises: In response to the cloud storage client calling a load function, intercepting the cloud storage data obtained by the load function from the cloud storage server through a slice program, wherein the slice program is pre-configured into the cloud storage client by the slice base; Determining the encrypted data and the ciphertext of the encryption key according to the cloud storage data; Calling the software cryptographic module in the aspect program, and decrypting the ciphertext of the encryption key under the security protection mechanism of the software cryptographic module to determine the plaintext of the encryption key; According to the security protection mechanism, the encrypted data is decrypted by using the plain text of the encryption key to obtain the loading data; The loaded data is returned to the cloud storage client.

[0008] Furthermore, in some embodiments, Assembling the encrypted data and the ciphertext of the encryption key through the slice program to obtain cloud storage data and send it to the cloud storage server, specifically including: Determining, by means of the sectioning program, a check code for checking the integrity of the data to be stored; Determining a data header based on the check code and the ciphertext of the encryption key; Using the encrypted data as the data body, assembling the data header and the data body to obtain cloud storage data; The cloud storage data is sent to the cloud storage server through the upload function.

[0009] Furthermore, in some embodiments, Determining a check code for checking the integrity of the data to be stored specifically includes: By means of the aspect program, a key management service is called to generate a plain text of a verification key for the data to be stored and a cipher text of the verification key; Receiving the ciphertext of the verification key returned by the key management service; The software cryptographic module is called to generate a verification code of the data to be stored according to the security protection mechanism, the ciphertext of the verification key and the data to be stored.

[0010] Furthermore, in some embodiments, Determining a data header based on the check code, the ciphertext of the encryption key, and the metadata of the encrypted data specifically includes: The slice program determines the data header based on the verification code of the data to be stored, the ciphertext of the verification key and the ciphertext of the encryption key.

[0011] Furthermore, in some embodiments, The method further comprises: In response to the cloud storage client calling a load function, intercepting the cloud storage data obtained by the load function from the cloud storage server through a slice program, wherein the slice program is pre-configured into the cloud storage client by the slice base; Determining, according to the data header of the cloud storage data, a verification code of the data to be stored, a ciphertext of the verification key, and a ciphertext of the encryption key; Calling the software cryptographic module, determining the plaintext of the encryption key according to the ciphertext of the encryption key according to the security protection mechanism, and decrypting the encrypted data by the plaintext of the encryption key to obtain the loading data; According to the security protection mechanism, decrypt the ciphertext of the verification key, and generate a verification code of the loaded data according to the plaintext of the verification key and the loaded data; Verifying the integrity of the loaded data according to the check code of the data to be stored and the verification code of the loaded data; When the integrity verification of the loaded data passes, the loaded data is returned to the cloud storage client.

[0012] Furthermore, in some embodiments, Calling the software password module in the aspect program, generating a plain text of the encryption key and a cipher text of the encryption key under the security protection mechanism preset by the software password module, specifically including: Calling the slice program to slice the data to be stored according to the configuration file to determine a number of sub-data; For each sub-data, determining an encryption method for the sub-data according to the configuration file; Generate a plain text of the encryption key of the sub-data and generate a cipher text of the encryption key by using the software cryptographic module according to the encryption method; According to the security protection mechanism, the data to be stored is encrypted by the plain text of the encryption key to obtain the encrypted data, specifically including According to the security protection mechanism, the encrypted data of the sub-data is obtained through the plain text of the encryption key of the sub-data.

[0013] Furthermore, in some embodiments, Assembling the encrypted data and the ciphertext of the encryption key through the slice program to obtain cloud storage data and send it to the cloud storage server, specifically including: Determine, by means of the sectioning program, a check code for verifying the integrity of the sub-data, and determine, according to the segmentation of the data to be stored, metadata of the sub-data; Determine a data header of the sub-data based on the check code of the sub-data, the ciphertext of the encryption key of the sub-data, and the metadata of the sub-data; Using the encrypted data of the sub-data as the data body, and obtaining the encrypted block of the sub-data according to the data header of the sub-data and the data body; The encrypted blocks of each sub-data are assembled to obtain cloud storage data, and are sent to the cloud storage server through the upload function.

[0014] Furthermore, in some embodiments, The method further comprises: In response to the cloud storage client calling a load function, intercepting the cloud storage data obtained by the load function from the cloud storage server through a slice program, wherein the slice program is pre-configured into the cloud storage client by the slice base; Determining encryption blocks of each sub-data according to the cloud storage data; For each encrypted block of sub-data, determine the verification code of the sub-data, the ciphertext of the verification key of the sub-data, and the ciphertext of the encryption key of the sub-data according to the encrypted block of the sub-data; Calling the software cryptographic module, determining the plaintext of the encryption key according to the ciphertext of the encryption key of the sub-data, and decrypting the encrypted data of the sub-data to obtain the sub-data; Decrypting the ciphertext of the verification key of the sub-data, and generating a verification code of the sub-data according to the plaintext of the verification key obtained by decryption and the sub-data; Verifying the integrity of the sub-data according to the check code of the sub-data and the verification code of the sub-data; When the integrity verification of each sub-data is passed, the loaded data is combined according to the segmentation order of each sub-data and returned to the cloud storage client.

[0015] Furthermore, in some embodiments, After determining the encryption block of each sub-data, the method further includes: Determine metadata of each sub-data according to the encrypted block of each sub-data; Determining whether the cloud storage data is complete according to the metadata of each sub-data; If not, the loading function is called to re-download the cloud storage data.

[0016] The embodiment of this specification also provides a data processing device based on a security aspect, the device is applied to a terminal, the cloud storage client of the terminal has a pre-deployed aspect base, and the device includes: an interception module, in response to the cloud storage client calling the upload function, intercepting the call request for calling the upload function through a slice program, and determining the data to be stored carried in the intercepted call request, wherein the slice program is pre-configured by the slice base into the cloud storage client; The ciphertext module calls the software password module in the aspect program to generate a plaintext of the encryption key and a ciphertext of the encryption key under the security protection mechanism preset by the software password module; An encryption module, according to the security protection mechanism, encrypts the data to be stored by using the plain text of the encryption key to obtain encrypted data; The storage module assembles the encrypted data and the ciphertext of the encryption key through the aspect program to obtain cloud storage data and sends it to the cloud storage server, so that the cloud storage server stores the assembled cloud storage data.

[0017] The embodiments of the present specification also provide a computer program product, wherein the computer program product stores at least one instruction, and the at least one instruction is suitable for being loaded by a processor and executing the above method steps.

[0018] The embodiments of the present specification also provide a storage medium, wherein the storage medium stores a computer program, and the computer program is suitable for being loaded by a processor and executing the steps of the above method.

[0019] An embodiment of the present specification also provides an electronic device, comprising: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the steps of the above method.

[0020] In the embodiments of the present specification, the data to be stored to be uploaded to the cloud storage server is intercepted by a slice program pre-inserted in the cloud storage client, the data to be stored is encrypted by an encryption key generated under the preset security protection mechanism of the slice program, and the ciphertext of the encryption key and the encrypted data are assembled together and uploaded to the cloud storage server. Then, when loading data from the cloud storage server, the encryption key obtained by decryption based on the ciphertext of the encryption key can be used to restore the data. The data transmitted between the terminal and the cloud storage server is encrypted, and the encryption process is protected by the security protection mechanism, and the plaintext of the encryption key is always protected. On the one hand, the security of data transmission is enhanced, and on the other hand, the possibility of key leakage when the cloud storage client is attacked is reduced, thereby improving the security of cloud storage data from multiple angles. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flowchart of a data processing method based on a security aspect is provided for the embodiments of this specification; Figure 2 A schematic diagram of a data processing flow provided in an embodiment of this specification; Figure 3 A schematic diagram of a data processing flow provided in an embodiment of this specification; Figure 4 A schematic diagram of a data processing flow provided in an embodiment of this specification; Figure 5 A schematic diagram of a data structure provided in an embodiment of this specification; Figure 6 A schematic diagram of a data processing scenario provided in an embodiment of this specification; Figure 7 A schematic diagram of the structure of a data processing device based on a security aspect provided in an embodiment of this specification; Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0023] With the development of cloud storage business, OSS services are becoming more and more widely used because of their simplicity, security, suitability for storing and processing unstructured data, and closer to the usage habits of ordinary consumers. However, the existing method of solving the security problem of data transmission through HTTPS secure links not only increases the line cost, but also makes it difficult to avoid the risk of malicious behavior in the background of OSS services. Therefore, there is a need to comprehensively solve the data security problem of OSS services.

[0024] A flow chart of a data storage method is provided for the embodiments of this specification. Through the security aspect, the aspect program pre-inserted in the cloud storage client intercepts the data to be uploaded to the cloud storage server, encrypts the data to be stored through the encryption key generated under the security protection mechanism of the aspect program, and assembles the ciphertext of the encryption key and the encrypted data together and uploads them to the cloud storage server. When loading data from the cloud storage server, the encryption key obtained by decryption can be restored based on the ciphertext of the encryption key under the same security protection mechanism.

[0025] The security aspect mentioned above refers to a method of dynamically adding or modifying aspect programs used to implement aspect services in the operation logic of business applications without modifying business applications by adopting aspect-oriented programming (AOP). This allows the program of security aspect services to be decoupled from business applications while implementing security aspect services, thereby avoiding development iteration problems caused by high coupling.

[0026] The aspect program mentioned here is an enhancement program that implements aspect business based on business operation logic. The aspect program can be injected into the corresponding point of the business application by adopting aspect-oriented programming. The aspect program is triggered and executed during the execution of the business application to implement the required security aspect business function.

[0027] In the embodiment of this specification, the business application is a cloud storage client of the OSS service, and when the cloud storage client executes the business, the cloud storage client usually executes the business through calls between methods. Therefore, any method in the cloud storage client can be used as the entry point of the aspect program, that is, the above-mentioned pointcut, and the aspect program is injected into the corresponding pointcut. When the cloud storage client executes to the pointcut, that is, when the method of the cloud storage client corresponding to the pointcut is called, the aspect program injected at the pointcut is executed.

[0028] Generally, the code responsible for injecting the aspect program into the cut-point has high reusability. Therefore, the program that implements this process is usually abstracted into a service module, namely the aspect base. The aspect base can obtain the aspect program to be deployed and the cut-point injected by the aspect program in the cloud storage client from the aspect server that provides the security aspect service. It is awakened after the application container is started and injects the corresponding aspect program at the cut-point of the cloud storage client. Generally, the aspect server that provides the security aspect service can be called the aspect engine.

[0029] Of course, from the above description, it can be seen that in order to decouple the program of the security aspect business from the cloud storage client, this specification adopts an aspect-oriented programming method to make the program of the security aspect business and the cloud storage client intertwined during business execution, but parallel to each other and can be maintained independently. Therefore, unlike the service provider of the cloud storage client, the third party that provides the security aspect service can manage the content involved in the security aspect service through the aspect engine, such as the configuration of the security aspect service management and control strategy, the version iteration of the aspect program, the deployment rule configuration of the aspect program, etc. Of course, the security aspect service can be provided by a third party or a service provider.

[0030] When managing the content involved in the security aspect business, the aspect engine can record various configuration information through the configuration file, such as the configuration of various policies, the deployment rule configuration of the aspect program, etc. This allows the aspect base to complete the deployment of the aspect program according to the configuration file, or implement the security aspect business according to the configuration file.

[0031] In the scenario where services are executed based on security aspects, the service provider or a third-party server providing security aspect services can provide an aspect engine, manage the content involved in the security aspect services through the aspect engine, and deploy the aspect base in the application container. The aspect program is injected into the cloud storage client in the application container through the aspect base to provide security aspect service support for the service provider's application container.

[0032] Therefore, the aspect base can be deployed in the application container of the service provider in advance. Generally, when the application container is started, the operating system provided to the application container can be called up, and the pre-deployed aspect base can be run. The aspect program and the cut-off point of the cloud storage client can be obtained from the aspect engine through the aspect base, and the aspect program can be injected into the cut-off point of the cloud storage client in the application container. In addition, the aspect base can also obtain the cut-off point of the aspect program and the cloud storage client from the aspect engine during the execution of the cloud storage client, and inject the aspect program into the cut-off point of the cloud storage client in the application container. Among them, the application container can be understood as a terminal operating environment in a broad sense, or an environment for running a cloud storage client.

[0033] Of course, how the aspect base obtains the information required for deploying the aspect program from the aspect engine can be set as needed. For example, the aspect base can actively pull the required information from the aspect engine according to the configuration file, or the aspect engine can actively send the required information to the aspect base.

[0034] After the aspect program is injected into the cut-off point of the cloud storage client, the cloud storage client can trigger the aspect program during execution to implement the corresponding security aspect business functions.

[0035] Based on this, please see Figure 1 , the following will focus on Figure 1 The process shown is described in detail. The data processing method is applied to a terminal, in which a cloud storage client is installed, and the cloud storage client has a pre-deployed facet base. The method may specifically include the following steps: S100: In response to the cloud storage client calling the upload function, intercepting the call request for calling the upload function through a slice program, and determining the data to be stored carried in the intercepted call request, wherein the slice program is pre-configured by the slice base into the cloud storage client.

[0036] In one or more embodiments of the present specification, the terminal can receive the cut-off point and cut-off program of the cloud storage client sent by the cut-off engine through the pre-deployed cut-off base, and the cut-off point is located at the upload function of the cloud storage client. After the terminal injects the cut-off program into the upload function of the cloud storage client through the cut-off base, the terminal can intercept the call request sent by the cloud storage client to the upload function through the cut-off program, and determine the data to be stored that needs to be encrypted based on the call request. In the subsequent steps, the cut-off program encrypts the data to be stored to obtain encrypted cloud storage data, and then transmits it to the cloud storage server through the upload function to ensure the security of data transmission and storage in the cloud. Thus, the Figure 1 The data processing process shown can be regarded as the stage of data encryption during the data storage process.

[0037] Specifically, when the cloud storage client in the terminal executes the cloud storage service, it must first determine the local data to be stored, and then call the upload function of the cloud storage client. Since the slice program has been injected into the upload function through the above steps, the slice program can intercept the call request of the upload function and determine the data to be stored according to the call request.

[0038] Of course, since in the embodiments of this specification, data encryption is needed to solve the data security problem, in order to still be able to identify the data after encryption, the aspect program can also determine the identification of the data to be stored and other information, which is used to construct the data header of the uploaded cloud storage data. In the embodiments of this specification, this specification does not limit what information the data header specifically contains, but at least the data header needs to contain information for identifying different cloud storage data, so that the cloud storage server and the cloud storage client can determine the data that needs to be uploaded or loaded.

[0039] S102: calling the software cryptographic module in the aspect program, and generating a plaintext of an encryption key and a ciphertext of the encryption key under a security protection mechanism preset in the software cryptographic module.

[0040] In one or more embodiments of the present specification, after the aspect program obtains the data to be stored, the data to be stored can be encrypted. In order to improve the security of data encryption, the aspect program may include a software cryptographic module (Software Security Module, SSM). The aspect program can generate an encryption key under the security protection mechanism preset by the SSM and encrypt the data to be stored.

[0041] Among them, in the embodiments of this specification, the preset security protection mechanism can be specifically set as needed, for example, by setting up a trusted execution environment (TEE) in the SSM to achieve the security of data that needs to be protected, such as encryption keys, or by performing key splitting, obfuscation or randomization through white-box cryptography to achieve data security. Of course, this specification does not limit the specific security protection mechanism to be adopted, and it can be set as needed. For the convenience of description, the security protection mechanism is a trusted execution environment as an example for explanation.

[0042] It can be seen that through the trusted execution environment or white box cryptography technology, the encryption key is well protected in the aspect program. For example, when the encryption key is generated through the trusted execution environment, the encryption key does not leave the trusted execution environment, and the data is encrypted in the trusted execution environment, so that even if the cloud storage client is attacked, the encryption key cannot be obtained and the encrypted data cannot be cracked, thereby improving data security.

[0043] Specifically, the aspect program can call its own built-in SMM to generate the plaintext of the encryption key and the ciphertext of the encryption key in the trusted execution environment constructed by the SSM. Among them, the SSM can adopt a three-layer or two-layer key structure. Taking the three-layer key structure as an example, the SSM can first generate a top-level key (Top-Level Key / Master Key). The top-level key is used to encrypt the key encryption key (Key Encryption Key, KEK), and is only decrypted in specific business steps for use. Afterwards, the KEK is generated based on the top-level key encryption. Finally, the data encryption key (Data Encryption Key, DEK), that is, the plaintext of the encryption key, is generated, and the DEK is encrypted using the KEK to obtain the ciphertext of the encryption key. The KEK is used to encrypt the DEK, thereby protecting the DEK from unauthorized access. The KEK itself is protected by the root key, which means that before using the KEK, it must be decrypted with the top-level key.

[0044] The ciphertext of the encryption key can flow out of the trusted execution environment, but because the KEK for decrypting it is in the trusted execution environment, even if the ciphertext of the encryption key is leaked, it will not cause data leakage.

[0045] In addition, a two-layer key structure may also be used, and the top-level key and KEK may be the same key. This reduces the pressure of SSM data encryption. In the embodiments of this specification, the settings may be selected according to the needs of business flow and data security level, and no specific limitation is made to this.

[0046] S104: According to the security protection mechanism, the data to be stored is encrypted using the plain text of the encryption key to obtain encrypted data.

[0047] In one or more embodiments of the present specification, after the encryption key is generated, the aspect program can encrypt the data to be stored according to the security protection mechanism to obtain encrypted data that can be securely stored and transmitted in the cloud.

[0048] Specifically, the aspect program can transfer the data to be stored into the trusted execution environment of the SSM, and in the trusted execution environment, encrypt the data using the plain text of the encryption key to obtain the encrypted data corresponding to the data to be stored. Since the ciphertext of the encryption key and the encrypted data are not plain text, even if they flow out of the trusted execution environment, they will not cause security risks to the data to be stored.

[0049] S106: Assembling the encrypted data and the ciphertext of the encryption key through the aspect program to obtain cloud storage data and sending the cloud storage data to a cloud storage server, so that the cloud storage server stores the assembled cloud storage data.

[0050] In one or more embodiments of the present specification, after obtaining the encrypted data, the aspect program can assemble the ciphertext of the encryption key and the encrypted data to obtain cloud storage data for transmission to the cloud storage server, and send it to the cloud storage server to complete the business of storing the data in the cloud.

[0051] Specifically, the aspect program may first determine the data header of the cloud storage data. The data header may include metadata for identifying the data, and the ciphertext of the encryption key. After the cloud storage data is stored in the cloud, data query or retrieval may be performed based on the data header, and when the terminal subsequently downloads the cloud storage data, the encrypted data may be decrypted through the aspect program based on the ciphertext of the encryption key in the data header.

[0052] Then, the slice program can use the encrypted data as the data body, assemble the data header and the data body, and obtain the cloud storage data.

[0053] Finally, through the upload function, the cloud storage data is sent to the cloud storage server, so that the cloud storage server receives the cloud storage data and stores it. It can be seen that the cloud storage data transmitted by calling the upload function at this time is already the cloud storage data, which contains encrypted data. Since the plaintext of the encryption key is still retained in the trusted execution environment of the SSM of the aspect program, even if the cloud storage data is intercepted during the transmission process, the party that intercepts the data cannot decrypt the encrypted data, so that the user data will not be leaked.

[0054] Similarly, in the embodiments of the present specification, since the cloud storage data stored in the cloud storage server includes encrypted data, even if the provider of the cloud storage service obtains the cloud storage data from the cloud storage server, it cannot be decrypted and will not cause leakage of user data.

[0055] based on Figure 1 The data processing method shown intercepts the data to be uploaded to the cloud storage server through a slice program pre-inserted in the cloud storage client, encrypts the data to be stored through an encryption key generated under the preset security protection mechanism of the slice program, and assembles the ciphertext of the encryption key and the encrypted data together and uploads them to the cloud storage server. When loading data from the cloud storage server, the same security protection mechanism can be used to decrypt the encryption key based on the ciphertext of the encryption key to restore the data. The data transmitted between the terminal and the cloud storage server is encrypted, and the encryption process is protected by the security protection mechanism, and the plaintext of the encryption key is always protected. On the one hand, the security of data transmission is enhanced, and on the other hand, the possibility of key leakage when the cloud storage client is attacked is reduced, thereby improving the security of cloud storage data from multiple angles.

[0056] In addition, in one or more embodiments of this specification, this specification also provides another data processing method for securely decrypting cloud storage data when the cloud storage client of the terminal obtains cloud storage data from the cloud storage server to avoid leaking the encryption key. Figure 2 As shown, this process belongs to the stage of data decryption in the data processing process. The method may specifically include the following steps: S200: In response to the cloud storage client calling a load function, intercepting the cloud storage data obtained by the load function from the cloud storage server through a slice program, wherein the slice program is pre-configured by the slice base into the cloud storage client.

[0057] In one or more embodiments of this specification, Figure 2 The data processing process execution subject and Figure 1 Therefore, this description will not be repeated in detail in the embodiments of this specification, and reference can be made to Figure 1 A description of the terminal, the cloud storage client, the aspect program, the software encryption module and the cloud storage server.

[0058] Specifically, the insertion point of the aspect program is the loading function of the cloud storage client. The loading function is used to respond to the call of the cloud storage client and send a loading request to the cloud storage server. Then, the cloud storage server determines the data to be downloaded by the cloud storage client from the cloud storage data stored in the cloud storage server according to the loading request, and returns it to the cloud storage client. However, at this time, the cloud storage data is encrypted data, so the aspect program needs to obtain the cloud storage data, and then the cloud storage data is decrypted by the aspect program by continuing to execute subsequent steps.

[0059] Therefore, in one or more embodiments of the present specification, the terminal can intercept the cloud storage data downloaded from the cloud storage server through the slice program when the cloud storage client calls the loading function.

[0060] In addition, in the embodiment of this specification, since the cloud storage server stores all the operational storage data, when the loading function sends a loading request to the cloud storage server, the loading request carries information for identifying the cloud storage data. The cloud storage server can use this information to compare the data headers of each cloud storage data and determine the cloud storage data to be loaded by the loading request.

[0061] S202: Determine the encrypted data and the ciphertext of the encryption key according to the cloud storage data.

[0062] In one or more embodiments of the present specification, after acquiring the cloud storage data, the aspect program can determine the data header contained in the cloud storage data to determine the ciphertext of the encryption key, and also needs to determine the encrypted data as the data body. The encrypted data can then be decrypted to determine the loading data. It should be noted that in the present specification, the data to be stored in the data encryption stage is the loading data that needs to be obtained in the data decryption stage. That is, in the encryption stage, the data to be stored is encrypted to obtain the encrypted data, and in the decryption stage, the encrypted data is decrypted to obtain the loading data.

[0063] Specifically, the aspect program can intercept the cloud storage data sent by the cloud storage server to the cloud storage client. Then, determine the data header and data body of the cloud storage. Finally, determine the ciphertext of the encryption key contained in the data header. Since the aforementioned encryption stage has been made public, in addition to the ciphertext of the encryption key, the data header can also contain metadata for data identification. The metadata can be used by the cloud storage server to determine the data to be transmitted. Therefore, after the aspect program obtains the cloud storage data, the aspect program can further determine the ciphertext of the encryption key in the data header so that it can be decrypted in the subsequent steps.

[0064] S204: Calling the software cryptographic module in the aspect program, and decrypting the ciphertext of the encryption key under the security protection mechanism of the software cryptographic module to determine the plaintext of the encryption key.

[0065] S206: According to the security protection mechanism, the encrypted data is decrypted using the plain text of the encryption key to obtain the loading data.

[0066] In one or more embodiments of the present specification, in order to avoid leakage of encryption keys, the aspect program may decrypt the encrypted data through SSM under a preset security protection mechanism.

[0067] Specifically, the aspect program may first call the SSM to pass the ciphertext of the encryption key and the encrypted data into the trusted execution environment of the SSM. Afterwards, in the trusted execution environment, the ciphertext of the encryption key is decrypted to determine the plaintext of the encryption key. Finally, the encrypted data is decrypted using the plaintext of the encryption key. Of course, referring to the process of determining the encryption key in step S102 and encrypting the data in step S104, the specific encryption method used is then obtained through the corresponding decryption process in the trusted execution environment of the SSM to obtain the loaded data.

[0068] S208: Return the loaded data to the cloud storage client.

[0069] In one or more embodiments of the present specification, when the slice program has finally determined the loading data, the loading data in the trusted execution environment can be used as the data that the user needs to obtain, and the loading function is returned so that the cloud storage client obtains the loading data. Then the user obtains the plaintext data through the cloud storage client.

[0070] It should be noted that in the above Figure 1 as well as Figure 2 In the process of cloud storage, there is no need to update the cloud storage client, and only the aspect program that needs to be decoupled from it can be used. The data that needs to be stored in the cloud can be encrypted without the user's awareness. In addition, the encryption key is well protected by the security protection mechanism preset in the aspect program. Even if an attacker attacks the cloud client or the cloud storage server, it is difficult to obtain the plaintext data, which improves the security of the cloud storage business.

[0071] Furthermore, for Figure 1 In the encryption phase of the public data processing process, in step S106, when the aspect program determines the data header of the cloud storage data, the metadata can also be used to verify the integrity of the data to be stored. For example, the metadata includes the size of the encrypted data. The metadata can be used to determine whether the encrypted data of the cloud storage data obtained from the cloud storage server in the decryption phase is normal.

[0072] However, metadata is plain text, so it is easier to tamper with encrypted data, and its data set verification capability is weak. Therefore, the aspect program can also determine a check code for verifying the integrity of the data to be stored, and determine the data header based on the check code and the ciphertext of the encryption key. Of course, the check code can be regarded as data different from metadata or as a type of metadata, and this manual does not limit this. That is to say, in this manual, the metadata can be data that describes the data, and can also include a check code for verifying the integrity of the data, which can be set according to needs.

[0073] Specifically, in step S106, the aspect program may first determine a check code for verifying the integrity of the data to be stored. The present application does not limit the specific method for determining the check code, and it may be set as needed. For example, the aspect program may calculate the hash value of the data to be stored, or determine the hash value of the encrypted data, and so on. Of course, the above process of determining the check code may also be performed in the trusted execution environment of the SSM of the aspect program, as is the process of generating an encryption key. This is to avoid leakage of the process of determining the check code.

[0074] Afterwards, the slice program can determine the data header based on the check code and the ciphertext of the encryption key. As mentioned above, the data header can also contain metadata, or the check code can be used as a kind of metadata.

[0075] Then, the aspect program can use the encrypted data as the data body, assemble the data header and the data body, and obtain the cloud storage data.

[0076] Finally, the cloud storage data is sent to the cloud storage server through the upload function.

[0077] Of course, the above process has been described in step S106. For the specific process, please refer to the description of step S106, and this specification will not repeat it in detail.

[0078] Furthermore, in one or more embodiments of the present specification, the aspect program may also perform encryption calculations when generating the verification code, thereby further improving the security of the verification code. Furthermore, the encryption calculation process may be the same as or different from the method for generating an encryption key to encrypt the data to be stored. If different methods are used, the accuracy of the data integrity check can be further improved. In other words, even if the encryption key is cracked, it does not mean that the encryption method of the verification code is also cracked. Moreover, the difficulty of cracking two different encryption methods is also multiplied. Through integrity verification, it can still be determined whether the data has been tampered with, thereby ensuring the security of data use.

[0079] Specifically, in step S106, when determining the verification code for verifying the integrity of the data to be stored, the aspect program may first call the Key Management Service (KMS), and generate the plaintext of the verification key for the data to be stored and the ciphertext of the verification key through KMS. It should be noted that after the above call to KMS, the plaintext of the verification key and the ciphertext of the verification key are generated in the KMS server. Among them, the plaintext of the verification key does not leave the domain where the KMS server is located to ensure the security of the verification code.

[0080] Therefore, the aspect program can receive the ciphertext of the verification key returned by the key management service.

[0081] Finally, the aspect program can call the SSM, and according to the security protection mechanism, generate the verification code of the data to be stored based on the ciphertext of the verification key and the data to be stored. That is, in the trusted execution environment of the SSM, the ciphertext of the verification key is decrypted to obtain the plaintext of the verification key, and then the verification code of the data to be stored is further calculated. Of course, there is no restriction on the specific method used, such as the use of the Hash-based Message Authentication Code (HMAC) function method. The process of determining the verification code is carried out in the feasible execution environment of the SSM to ensure that the process of obtaining the encrypted data is safe.

[0082] In addition, in the above process, the aspect program can also perform hash calculation on the data to be stored, pass the obtained hash value and the ciphertext of the verification key to the trusted execution environment of the SSM, and after obtaining the plaintext of the verification key, use the HMAC function to calculate the hash value to determine the verification code. Of course, the hash value of the data to be stored or the data to be stored, or the result of other processing of the data to be stored, can be passed into the trusted execution environment of the SSM to determine the verification code, which can be set as needed. As long as the data passed in can globally uniquely represent the data to be stored, it can be used.

[0083] Therefore, in the above-mentioned embodiment of determining the verification code through KMS, the aspect program can determine the data header according to the verification code of the data to be stored, the ciphertext of the verification key and the ciphertext of the encryption key.

[0084] Furthermore, in view of the situation that the above-mentioned data header is composed of the verification code of the data to be stored, the ciphertext of the verification key, and the ciphertext of the encryption key, when the cloud storage client of the terminal obtains the loaded data from the cloud storage server, the aspect program may also first perform an integrity check on the encrypted data, and after the integrity check passes, decrypt it to determine the loaded data. If the integrity check fails, it means that there is an error in the instruction data, and the user can be notified that the data may be tampered with, or the data can be downloaded again, etc. The specific processing can be set as needed, and this instruction manual does not impose any restrictions. However, as long as the integrity check fails, it means that the cloud storage data obtained from the cloud storage server is wrong and is not the data that the user needs to obtain.

[0085] Specifically, in the above Figure 2 Based on this, the terminal executes Figure 3 The following steps are shown: S300: In response to the cloud storage client calling a load function, intercepting the cloud storage data obtained by the load function from the cloud storage server through a slice program, wherein the slice program is pre-configured by the slice base into the cloud storage client.

[0086] In one or more embodiments of the present specification, the specific content of step S300 can refer to the description of step S200, and will not be repeated in this specification.

[0087] S302: Determine, according to the data header of the cloud storage data, the verification code of the data to be stored, the ciphertext of the verification key, and the ciphertext of the encryption key.

[0088] In one or more embodiments of the present specification, due to the change of the data header, step S302 is similar to step S202, but the ciphertext of the verification key in the data header is also required.

[0089] S304: calling the software cryptographic module, determining the plaintext of the encryption key according to the ciphertext of the encryption key according to the security protection mechanism, and decrypting the encrypted data through the plaintext of the encryption key to obtain the loading data.

[0090] In one or more embodiments of this specification, step S304 may refer to Figure 2 In the process of step S204 and step S206, the loading data is obtained.

[0091] S306: Decrypt the ciphertext of the verification key according to the security protection mechanism, and generate a verification code of the loaded data according to the plaintext of the verification key and the loaded data.

[0092] In one or more embodiments of the present specification, the aspect program can decrypt the ciphertext of the verification key in the trusted execution environment of the SSM. Specifically, the ciphertext of the verification key can be decrypted based on the KEK in the trusted execution environment to determine the plaintext of the verification key. Then, based on the obtained loading data and the plaintext of the verification key, the verification code of the loading data is determined using the same process as the aforementioned process of obtaining the verification code.

[0093] S308: Verify the integrity of the loaded data according to the check code of the data to be stored and the verification code of the loaded data.

[0094] In one or more embodiments of the present specification, since the data header contains the verification code determined when the data is uploaded, and the verification code of the plain text (i.e., the loaded data) corresponding to the encrypted data is also obtained in the feasible execution environment, the integrity of the loaded data can be determined by comparing the verification code of the data to be stored and the verification code of the loaded data. If they are consistent, it means that the loaded data is complete and has not been tampered with. If they are inconsistent, it means that the loaded data has been tampered with and is no longer usable.

[0095] S310: When the integrity verification of the loaded data passes, the loaded data is returned to the cloud storage client.

[0096] In one or more embodiments of the present specification, when it is determined that the integrity verification of the loaded data has passed, the aspect program can return the loaded data to the cloud storage client through the loading function. This process is consistent with step S208 and will not be described in detail in the present specification.

[0097] Through the above process of generating the check code and Figure 3 As can be seen from the process, by using a different encryption method for the stored data, the verification key is obtained and the data integrity is verified. Encryption and verification are independent of each other, and the security protection mechanism of SSM can be used to achieve independent data encryption and data verification at the same time. While ensuring data security, the integrity of the data is further verified, which improves the security of the cloud storage service. At the same time, the integrity verification is also implemented by the aspect program, which makes the user unaware and decoupled from the cloud storage business, making the security protection of data more reliable.

[0098] In addition, in one or more embodiments of the present specification, in order to improve the success rate of data transmission, reduce transmission pressure, and reduce the requirements for network performance between the terminal and the cloud storage server, the data to be stored can also be divided into sub-data, and the above encryption and verification code determination methods are respectively used for each sub-data to obtain the processing results of each sub-data, which are combined into cloud storage data and then uploaded to the cloud storage server for storage.

[0099] Specifically, in Figure 1 In step S102 of the data processing process shown in FIG. 1 , the sectioning program can also execute Figure 4 The steps shown include: S1020: calling the slice program, dividing the data to be stored according to the configuration file, and determining a number of sub-data.

[0100] In one or more embodiments of the present specification, the configuration file is sent by the slice engine to the slice base, and the slice base configures the slice program. For example, it may include: the size of the encrypted data block, the encryption and decryption calculation method, the cryptographic algorithm suite used for the check code, etc. Then, the slice program can divide the data to be stored according to the size of the encrypted data block in the configuration file to obtain a number of sub-data.

[0101] S1022: For each sub-data, determine the encryption method of the sub-data according to the configuration file.

[0102] S1024: Generate the plaintext of the encryption key of the sub-data and generate the ciphertext of the encryption key through the software cryptographic module according to the encryption method.

[0103] In one or more embodiments of this specification, the slice program can use Figure 1 The process of the domestic step determines the ciphertext of the encryption key of the sub-data. And in step S104, the aspect program can obtain the encrypted data of each sub-data through the plaintext of the encryption key of the sub-data according to the security protection mechanism.

[0104] Furthermore, in one or more embodiments of the present specification, when determining the encryption data of each sub-data, in step S104, the aspect program may also use the following steps to determine the cloud storage data.

[0105] First, the sectioning program is used to determine a check code for verifying the integrity of the sub-data, and the metadata of the sub-data is determined according to the segmentation of the data to be stored.

[0106] Secondly, based on the check code of the sub-data, the ciphertext of the encryption key of the sub-data and the metadata of the sub-data, the data header of the sub-data is determined.

[0107] Then, the encrypted data of the sub-data is used as the data body, and the encrypted block of the sub-data is obtained according to the data header of the sub-data and the data body.

[0108] Figure 5 This is a schematic diagram of the structure of the encryption block provided in the embodiment of this specification. Of course, if the data to be stored is not segmented, the data header part does not need more data. Figure 5As can be seen in the figure, the data header includes: Encryption block identifier ENC_BLOCK: a fixed field, a specific hexadecimal identifier can be set, such as 0xEBDA, which represents enc-block-data, indicating that this data block is an encryption block that can provide data confidentiality and integrity protection. File name FILE_NAME: the name of the file to be stored in the cloud storage server plus the absolute path, which can be obtained through the storage directory information and file name of the file. Total number of encryption blocks ENC_BLOCK_TOTAL: the total number of sub-data into which the data to be stored is divided. The total number of sub-data after the data to be stored is divided according to the block size in the configuration file. Encryption block sequence ENC_BLOCK_SEQ: the number of blocks in the entire data block to be stored. That is, by numbering the sub-data, it is convenient to restore the data later. Encryption key ciphertext ENC_KEY. Verification key ciphertext MAC_KEY. Verification code RAWDATA_MAC. Ciphertext data size ENC_DATA_SIZE: the number of bytes of the encrypted data of the data body after the data header. Finally, the encrypted data ENC_DATA as the data body.

[0109] Finally, the encrypted blocks of each sub-data are assembled to obtain cloud storage data, and are sent to the cloud storage server through the upload function.

[0110] It should be noted that in the embodiments of this specification, the granularity of the aforementioned encryption key can be set as needed, sent by the aspect engine to the aspect base, and configured by the aspect base into the aspect program. Among them, for each sub-data, the aspect program can use the same encryption key for encryption, or for each sub-data, determine the encryption key of the sub-data, so that the encryption keys of different sub-data are different. Improve data security, so that even if the encryption key of a certain sub-data is obtained, the complete data plaintext cannot be obtained.

[0111] In addition, as in the aforementioned process of generating a check code, a check code for each sub-data can also be generated for the sub-data. And for each sub-data, the check key required to generate the check code can also be of different granularity like the encryption key mentioned above. For each sub-data, the aspect program can use the same check key to determine the check code, or for each sub-data, determine the check key of the sub-data, so that the check keys of different sub-data are different, and the integrity verification is more reliable.

[0112] Furthermore, in the embodiments of this specification, the granularity of the encryption key and the granularity of the verification key may also be different. Of course, different granularities are used for data with different security requirements. The higher the security requirement, the smaller the granularity is used to ensure data security and prevent tampering.

[0113] In one or more embodiments of the present specification, in the decryption stage of data processing, if the data to be stored is divided into multiple sub-data during the encryption stage, they also need to be decrypted separately in the decryption stage and then combined to obtain the loaded data.

[0114] Specifically, first, the terminal can respond to the cloud storage client calling the loading function and intercept the cloud storage data obtained by the loading function from the cloud storage server through the aspect program, wherein the aspect program is pre-configured by the aspect base into the cloud storage client.

[0115] Next, the encryption blocks of each sub-data are determined based on the cloud storage data.

[0116] Afterwards, for each encrypted block of sub-data, a verification code of the sub-data, a ciphertext of the verification key of the sub-data, and a ciphertext of the encryption key of the sub-data are determined according to the encrypted block of the sub-data.

[0117] Then, the software cryptographic module is called to determine the plain text of the encryption key according to the cipher text of the encryption key of the sub-data, and the encrypted data of the sub-data is decrypted to obtain the sub-data.

[0118] Then, the ciphertext of the verification key of the sub-data is decrypted, and a verification code of the sub-data is generated according to the plaintext of the verification key obtained by decryption and the sub-data.

[0119] Afterwards, the integrity of the sub-data is verified based on the check code of the sub-data and the verification code of the sub-data.

[0120] Finally, when the integrity verification of each sub-data is passed, the loaded data is combined according to the segmentation order of each sub-data and returned to the cloud storage client.

[0121] The above process can refer to the description of the above process and will not be repeated in this specification. Of course, it should be noted that only when the integrity verification of each sub-data is passed, the segmentation order of each sub-data can be determined according to the data header. And the sub-data are combined according to the segmentation order to obtain the loaded data and return it to the cloud storage client.

[0122] In addition, in one or more embodiments of the present specification, after determining the encryption block of each sub-data, the interface program can determine the metadata of each sub-data based on the encryption block of each sub-data. According to the metadata of each sub-data, it is judged whether the cloud storage data is complete. In other words, whether there are any encryption blocks that have not been downloaded. If so, the verification code of the sub-data, the ciphertext of the verification key of the sub-data, and the ciphertext of the encryption key of the sub-data are determined, and subsequent steps are performed. If not, the specification data is downloaded incorrectly, and the loading function can be re-called to re-download the cloud storage data.

[0123] In one or more embodiments of this specification, a scenario diagram of the data processing process is provided, such as Figure 6 , to facilitate understanding of the various embodiments of this specification. Among them, it can be seen that the aspect engine is used to set the configuration file, and each aspect program cuts into those applications. The cloud storage client in the middle can obtain the data to be stored from the local, encrypt it through the aspect program, and then upload it to the cloud storage server. The cloud storage server downloads data, and the aspect program also decrypts it before returning it to the cloud storage client.

[0124] See also Figure 7 , is a schematic diagram of a data processing device based on a security aspect provided in an embodiment of this specification. Figure 7 As shown, the data processing device based on the security aspect can be implemented as all or part of the electronic device through software, hardware or a combination of both. According to some embodiments, the data processing device based on the security aspect includes an interception module 401, a ciphertext module 402, an encryption module 403, and a storage module 404, specifically including: The interception module 401, in response to the cloud storage client calling the upload function, intercepts the call request of calling the upload function through the aspect program, and determines the data to be stored carried in the intercepted call request, wherein the aspect program is pre-configured by the aspect base into the cloud storage client; The ciphertext module 402 calls the software password module in the aspect program to generate a plaintext of the encryption key and a ciphertext of the encryption key under the security protection mechanism preset by the software password module; The encryption module 403 encrypts the data to be stored by using the plain text of the encryption key according to the security protection mechanism to obtain encrypted data; The storage module 404 assembles the encrypted data and the ciphertext of the encryption key through the slice program to obtain cloud storage data and sends it to the cloud storage server, so that the cloud storage server stores the assembled cloud storage data.

[0125] Optionally, the device further includes: a processing module 405, a decryption module 406, and a loading module 407; The interception module 401 is further used to intercept the cloud storage data obtained by the load function from the cloud storage server through the aspect program in response to the cloud storage client calling the load function, wherein the aspect program is pre-configured by the aspect base into the cloud storage client; The processing module 405 determines the encrypted data and the ciphertext of the encryption key according to the cloud storage data; The ciphertext module 402 is further used to call the software password module in the aspect program, and decrypt the ciphertext of the encryption key under the security protection mechanism of the software password module to determine the plaintext of the encryption key; The decryption module 406 decrypts the encrypted data using the plain text of the encryption key according to the security protection mechanism to obtain the loaded data; The loading module 407 returns the loaded data to the cloud storage client.

[0126] Optionally, the storage module 404 determines, through the aspect program, a check code for verifying the integrity of the data to be stored, determines a data header based on the check code and the ciphertext of the encryption key, uses the encrypted data as the data body, assembles the data header and the data body to obtain cloud storage data, and sends the cloud storage data to the cloud storage server through the upload function.

[0127] Optionally, the storage module 404 calls the key management service through the aspect program, generates the plaintext of the verification key for the data to be stored and the ciphertext of the verification key, receives the ciphertext of the verification key returned by the key management service, calls the software cryptographic module, and generates a verification code for the data to be stored according to the ciphertext of the verification key and the data to be stored in accordance with the security protection mechanism.

[0128] Optionally, the storage module 404, the slice program, determines the data header based on the verification code of the data to be stored, the ciphertext of the verification key and the ciphertext of the encryption key.

[0129] Optionally, the processing module 405 determines, according to the data header of the cloud storage data, the verification code of the data to be stored, the ciphertext of the verification key, and the ciphertext of the encryption key; decrypts the ciphertext of the verification key according to the security protection mechanism, and generates a verification code of the loaded data according to the plaintext of the verification key and the loaded data; verifies the integrity of the loaded data according to the verification code of the data to be stored and the verification code of the loaded data; The decryption module 406 calls the software password module, determines the plaintext of the encryption key according to the ciphertext of the encryption key according to the security protection mechanism, and decrypts the encrypted data through the plaintext of the encryption key to obtain the loading data; The loading module 407 returns the loaded data to the cloud storage client when the integrity verification of the loaded data passes.

[0130] Optionally, the ciphertext module 402 calls the slice program, divides the data to be stored according to the configuration file, determines a number of sub-data, determines an encryption method for each sub-data according to the configuration file, generates a plaintext of an encryption key for the sub-data according to the encryption method through the software cryptographic module, and generates a ciphertext of the encryption key; The encryption module 403 obtains the encrypted data of the sub-data through the plain text of the encryption key of the sub-data according to the security protection mechanism.

[0131] Optionally, the storage module 404 determines, through the slice program, a check code for verifying the integrity of the sub-data, and determines the metadata of the sub-data based on the segmentation of the data to be stored, determines the data header of the sub-data based on the check code of the sub-data, the ciphertext of the encryption key of the sub-data and the metadata of the sub-data, uses the encrypted data of the sub-data as the data body, obtains the encrypted block of the sub-data based on the data header of the sub-data and the data body, assembles the encrypted blocks of each sub-data to obtain cloud storage data, and sends it to the cloud storage server through the upload function.

[0132] Optionally, the processing module 405 determines the encryption block of each sub-data according to the cloud storage data; decrypts the ciphertext of the verification key of the sub-data, and generates a verification code of the sub-data according to the plaintext of the verification key obtained by decryption and the sub-data; and verifies the integrity of the sub-data according to the verification code of the sub-data and the verification code of the sub-data; The ciphertext module 402 determines, for each encrypted block of sub-data, a check code of the sub-data, a ciphertext of a check key of the sub-data, and a ciphertext of an encryption key of the sub-data according to the encrypted block of the sub-data; The decryption module 406 calls the software cryptographic module to determine the plain text of the encryption key according to the cipher text of the encryption key of the sub-data, and decrypts the encrypted data of the sub-data to obtain the sub-data; The loading module 407, when the integrity verification of each sub-data is passed, combines the sub-data in the segmentation order to obtain the loading data and returns it to the cloud storage client.

[0133] Optionally, the device also includes a retry module 408, which determines the metadata of each sub-data according to the encryption block of each sub-data, and judges whether the cloud storage data is complete according to the metadata of each sub-data. If not, calls the loading function to re-download the cloud storage data.

[0134] The above device embodiments correspond to the method embodiments. For specific descriptions, please refer to the description of the method embodiments, which will not be repeated here. The device embodiments are obtained based on the corresponding method embodiments and have the same technical effects as the corresponding method embodiments. For specific descriptions, please refer to the corresponding method embodiments.

[0135] The present specification also provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded and executed by a processor as described above. Figure 1 to Figure 4 The method of the embodiment shown in the figure can be specifically executed by referring to Figure 1 to Figure 4 The specific description of the illustrated embodiment will not be repeated here.

[0136] The present specification also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 1 to Figure 4 The method of the embodiment shown in the figure can be specifically executed by referring to Figure 1 to Figure 4 The specific description of the illustrated embodiment will not be repeated here.

[0137] The embodiments of this specification also provide Figure 8 The structural diagram of the electronic device shown in FIG. Figure 8 At the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement the above data processing method.

[0138] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the executor of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0139] In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with hardware entity modules. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0140] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0141] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0142] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0143] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0144] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0145] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0146] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0147] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0148] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0149] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0150] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0151] It should be understood by those skilled in the art that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0152] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0153] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0154] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A data processing method based on security aspects, the method is applied to a terminal, the cloud storage client of the terminal has a pre-deployed aspect base, the method comprises: In response to the cloud storage client calling the upload function, intercepting the call request for calling the upload function through a slice program, and determining the data to be stored carried in the intercepted call request, wherein the slice program is pre-configured by the slice base into the cloud storage client; Calling the software password module in the aspect program, and generating a plain text of the encryption key and a cipher text of the encryption key under the security protection mechanism preset by the software password module; According to the security protection mechanism, the data to be stored is encrypted by using the plain text of the encryption key to obtain encrypted data; The encrypted data and the ciphertext of the encryption key are assembled through the aspect program to obtain cloud storage data and send it to a cloud storage server, so that the cloud storage server stores the assembled cloud storage data.

2. The method of claim 1, further comprising: In response to the cloud storage client calling a load function, intercepting the cloud storage data obtained by the load function from the cloud storage server through a slice program, wherein the slice program is pre-configured into the cloud storage client by the slice base; Determining the encrypted data and the ciphertext of the encryption key according to the cloud storage data; Calling the software cryptographic module in the aspect program, and decrypting the ciphertext of the encryption key under the security protection mechanism of the software cryptographic module to determine the plaintext of the encryption key; According to the security protection mechanism, the encrypted data is decrypted by using the plain text of the encryption key to obtain the loading data; The loaded data is returned to the cloud storage client.

3. The method according to claim 1, assembling the encrypted data and the ciphertext of the encryption key through the slice program to obtain the cloud storage data and send it to the cloud storage server, specifically comprising: Determining, by means of the sectioning program, a check code for checking the integrity of the data to be stored; Determining a data header based on the check code and the ciphertext of the encryption key; Using the encrypted data as the data body, assembling the data header and the data body to obtain cloud storage data; The cloud storage data is sent to the cloud storage server through the upload function.

4. The method according to claim 3, determining a check code for checking the integrity of the data to be stored, specifically comprising: By means of the aspect program, a key management service is called to generate a plain text of a verification key for the data to be stored and a cipher text of the verification key; Receiving the ciphertext of the verification key returned by the key management service; The software cryptographic module is called to generate a verification code of the data to be stored according to the security protection mechanism, the ciphertext of the verification key and the data to be stored.

5. The method according to claim 4, determining the data header based on the verification code, the ciphertext of the encryption key and the metadata of the encrypted data, specifically comprising: The slice program determines the data header based on the verification code of the data to be stored, the ciphertext of the verification key and the ciphertext of the encryption key.

6. The method of claim 5, further comprising: In response to the cloud storage client calling a load function, intercepting the cloud storage data obtained by the load function from the cloud storage server through a slice program, wherein the slice program is pre-configured into the cloud storage client by the slice base; Determining, according to the data header of the cloud storage data, a verification code of the data to be stored, a ciphertext of the verification key, and a ciphertext of the encryption key; Calling the software cryptographic module, determining the plaintext of the encryption key according to the ciphertext of the encryption key according to the security protection mechanism, and decrypting the encrypted data by the plaintext of the encryption key to obtain the loading data; According to the security protection mechanism, decrypt the ciphertext of the verification key, and generate a verification code of the loaded data according to the plaintext of the verification key and the loaded data; Verifying the integrity of the loaded data according to the check code of the data to be stored and the verification code of the loaded data; When the integrity verification of the loaded data passes, the loaded data is returned to the cloud storage client.

7. The method according to claim 1, calling the software password module in the aspect program, generating a plain text of the encryption key and a cipher text of the encryption key under the security protection mechanism preset by the software password module, specifically comprising: Calling the slice program to slice the data to be stored according to the configuration file to determine a number of sub-data; For each sub-data, determining an encryption method for the sub-data according to the configuration file; Generate a plain text of the encryption key of the sub-data and generate a cipher text of the encryption key by using the software cryptographic module according to the encryption method; According to the security protection mechanism, the data to be stored is encrypted by the plain text of the encryption key to obtain the encrypted data, specifically including According to the security protection mechanism, the encrypted data of the sub-data is obtained through the plain text of the encryption key of the sub-data.

8. The method according to claim 7, assembling the encrypted data and the ciphertext of the encryption key through the slice program to obtain cloud storage data and sending it to the cloud storage server, specifically comprising: Determine, by means of the sectioning program, a check code for verifying the integrity of the sub-data, and determine, according to the segmentation of the data to be stored, metadata of the sub-data; Determine a data header of the sub-data based on the check code of the sub-data, the ciphertext of the encryption key of the sub-data, and the metadata of the sub-data; Using the encrypted data of the sub-data as the data body, and obtaining the encrypted block of the sub-data according to the data header of the sub-data and the data body; The encrypted blocks of each sub-data are assembled to obtain cloud storage data, and are sent to the cloud storage server through the upload function.

9. The method of claim 8, further comprising: In response to the cloud storage client calling a load function, intercepting the cloud storage data obtained by the load function from the cloud storage server through a slice program, wherein the slice program is pre-configured into the cloud storage client by the slice base; Determining encryption blocks of each sub-data according to the cloud storage data; For each encrypted block of sub-data, determine the verification code of the sub-data, the ciphertext of the verification key of the sub-data, and the ciphertext of the encryption key of the sub-data according to the encrypted block of the sub-data; Calling the software cryptographic module, determining the plaintext of the encryption key according to the ciphertext of the encryption key of the sub-data, and decrypting the encrypted data of the sub-data to obtain the sub-data; Decrypting the ciphertext of the verification key of the sub-data, and generating a verification code of the sub-data according to the plaintext of the verification key obtained by decryption and the sub-data; Verifying the integrity of the sub-data according to the check code of the sub-data and the verification code of the sub-data; When the integrity verification of each sub-data is passed, the loaded data is combined according to the segmentation order of each sub-data and returned to the cloud storage client.

10. The method according to claim 8, after determining the encryption block of each sub-data, the method further comprises: Determine metadata of each sub-data according to the encrypted block of each sub-data; Determining whether the cloud storage data is complete according to the metadata of each sub-data; If not, the loading function is called to re-download the cloud storage data.

11. A data processing device based on security aspect, the device is applied to a terminal, the cloud storage client of the terminal has a pre-deployed aspect base, the device comprises: an interception module, in response to the cloud storage client calling the upload function, intercepting the call request for calling the upload function through a slice program, and determining the data to be stored carried in the intercepted call request, wherein the slice program is pre-configured by the slice base into the cloud storage client; The ciphertext module calls the software password module in the aspect program to generate a plaintext of the encryption key and a ciphertext of the encryption key under the security protection mechanism preset by the software password module; An encryption module, according to the security protection mechanism, encrypts the data to be stored by using the plain text of the encryption key to obtain encrypted data; The storage module assembles the encrypted data and the ciphertext of the encryption key through the aspect program to obtain cloud storage data and sends it to the cloud storage server, so that the cloud storage server stores the assembled cloud storage data.

12. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

13. An electronic device, characterized in that: include: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the steps of the method as claimed in any one of claims 1 to 10.

14. A computer program product having at least one instruction stored thereon, characterized in that: When the at least one instruction is executed by the processor, the steps of the method described in any one of claims 1 to 10 are implemented.

Images