Data storage method and device, equipment and storage medium

Abstract

The invention discloses a data storage method and device, equipment and a storage medium, and relates to the technical field of data storage, and the method comprises the steps: receiving user data sent by a business system based on a user certificate; and encrypting and storing the user data through a double-encryption and double-storage strategy. According to the method and the device, the security of the user data can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of data storage, and in particular to a data storage method, apparatus, device and storage medium. Background Art

[0002] Encrypting and storing data is an important means to protect information security and privacy.

[0003] Currently, most systems store user sensitive data and business data together in the business database. Even if user sensitive data is encrypted, it is encrypted using a soft algorithm. This encryption and storage method can easily lead to data being cracked after a leak, reducing data security.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present application is to provide a data storage method, device, equipment and storage medium, aiming to solve the technical problem that current methods easily reduce the security of data.

[0006] To achieve the above objectives, the present application proposes a data storage method, which is applied to a sensitive data system. The method comprises the following steps:

[0007] Receive user data sent by the business system based on user credentials;

[0008] The user data is encrypted and stored using a double encryption and double storage strategy.

[0009] In one embodiment, the step of encrypting and storing the user data using a dual encryption and dual storage strategy includes:

[0010] Read the soft algorithm key and signature verification key from the system cache;

[0011] Verifying the signature of the user data by using the signature verification key;

[0012] If the signature verification is successful, the user data is encrypted by an encryption machine to obtain first ciphertext data, and the first ciphertext data is stored in a database;

[0013] The user data is encrypted by using the soft algorithm key to obtain second ciphertext data, and the second ciphertext data is stored in the Redis storage system.

[0014] In one embodiment, the step of encrypting and storing the user data using the dual encryption and dual storage strategy includes:

[0015] In response to a user data query instruction, determining whether the second ciphertext data can be obtained from the Redis storage system;

[0016] If so, the second ciphertext data is decrypted using the soft algorithm key to obtain second plaintext data, and the second plaintext data is returned to the business system.

[0017] In one embodiment, the step of determining whether the second ciphertext data can be obtained from the Redis storage system in response to the user data query instruction includes:

[0018] If not, obtaining the first ciphertext data from the database;

[0019] The first ciphertext data is decrypted by the encryption machine to obtain the first plaintext data, and the first plaintext data is returned to the business system.

[0020] In one embodiment, the step of decrypting the first ciphertext data by the encryption machine to obtain the first plaintext data and returning the first plaintext data to the business system includes:

[0021] The first plaintext data is encrypted by using the soft algorithm key to obtain third ciphertext data, and the third ciphertext data is stored in the Redis storage system.

[0022] In one embodiment, the step of encrypting the user data by using the soft algorithm key to obtain second ciphertext data, and storing the second ciphertext data in the Redis storage system includes:

[0023] The data in the Redis storage system is cleaned up based on a preset data cache period.

[0024] The present application also proposes a data storage method, which is applied to a business system, and the method comprises the following steps:

[0025] Based on the user credentials, the user data is sent to the sensitive data system so that the sensitive data system encrypts and stores the user data through a double encryption and double storage strategy.

[0026] In addition, to achieve the above-mentioned purpose, the present application also proposes a data storage device, which is arranged in a sensitive data system, and the device comprises:

[0027] A data receiving module, used to receive user data sent by the business system based on user credentials;

[0028] The encryption storage module is used to encrypt and store the user data through a double encryption and double storage strategy.

[0029] In addition, to achieve the above objectives, the present application also proposes a data storage device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the data storage method described above.

[0030] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the data storage method described above are implemented.

[0031] One or more technical solutions proposed in this application have at least the following technical effects:

[0032] This application uses a dual encryption and dual storage strategy to encrypt and store the user data, ensuring that the user data cannot be decrypted even if it is stolen or leaked, while the dual storage increases the backup and recovery capabilities of the user data and reduces the risk caused by single point failures. This method combines the advantages of encryption and decentralized storage to provide more comprehensive protection for user data. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0034] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0035] Figure 1 A flowchart of the first embodiment of the data storage method of the present application is provided;

[0036] Figure 2 A detailed flowchart of the data storage method for this application;

[0037] Figure 3 This is a schematic diagram of the module structure of the data storage device according to an embodiment of the present application;

[0038] Figure 4 Schematic diagram of the device structure of the hardware operating environment involved in the data storage method in the embodiment of the present application.

[0039] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0040] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0041] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0042] The main solution of the embodiment of the present application is: receiving user data sent by the business system based on user credentials; encrypting and storing the user data through a double encryption and double storage strategy.

[0043] In this embodiment, for the convenience of description, the following description is made with the data storage system as the execution subject.

[0044] Since most current systems store user sensitive data and business data together in the business database, even if user sensitive data is encrypted, it is encrypted using a soft algorithm. This encryption and storage method can easily lead to data being cracked after a leak, reducing data security.

[0045] To this end, the present application provides a solution, which uses a dual encryption and dual storage strategy to encrypt and store the user data, ensuring that the user data cannot be decrypted even if it is stolen or leaked, while the dual storage increases the backup and recovery capabilities of the user data and reduces the risks caused by single point failures. This method combines the advantages of encryption and decentralized storage to provide more comprehensive protection for user data.

[0046] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device, a data storage device, etc. that can realize the above functions, or an electronic system, a data storage system, etc. that can realize the above functions. The following takes the data storage system as an example to illustrate this embodiment and the following embodiments.

[0047] Based on this, the embodiment of the present application provides a data storage method, referring to Figure 1 , Figure 1 A flowchart of the first embodiment of the data storage method of the present application is provided.

[0048] In this embodiment, applied to a sensitive data system, the data storage method includes steps S10 to S20:

[0049] Step S10, receiving user data sent by the business system based on the user credentials;

[0050] As an implementation method, the data storage system may include a business system and a sensitive data system. When the business system obtains user authentication credentials, the business system sends the user data to the sensitive data system, and the sensitive data system encrypts and stores the user data using a double encryption and double storage strategy.

[0051] As another implementation method, the data storage system may also include a mini-program end, a business system, a sensitive data system, a key management system, etc.; the modules involved in the data storage method include a user module and an algorithm module; the functions involved include user real-name information entry, verification, and query; sensitive data include user real-name information, bank card information, delivery address, etc.

[0052] For example, a user clicks to enter the mini program, and an unauthenticated user clicks to enter the real-name page and enters the real-name information on the page. The mini program transmits the information entered by the user and the user's WeChat openid to the business system and WeChat system for real-name information verification. After the verification is passed, the business system updates the user's real-name status to "authenticated". At this time, the business system has the user's credentials and can send user data to the sensitive data system based on the user credentials.

[0053] Step S20: encrypt and store the user data using a double encryption and double storage strategy.

[0054] It should be noted that dual encryption refers to at least two encryption methods for user data, and dual storage refers to at least two storage methods for encrypted user data.

[0055] As an implementation mode, the user data may be encrypted at the client and the server, respectively, and the encrypted user data may be stored at the client and the server, respectively.

[0056] As another implementation, user data may be encrypted in a sensitive data system using different encryption methods, and the encrypted user data may be stored in different storage spaces.

[0057] This embodiment provides a data storage method, which encrypts and stores the user data through a dual encryption and dual storage strategy, ensuring that the user data cannot be decrypted even if it is stolen or leaked, and the dual storage increases the backup and recovery capabilities of the user data and reduces the risks caused by single point failures. This method combines the advantages of encryption and decentralized storage to provide more comprehensive protection for user data.

[0058] Considering that current similar systems store user sensitive data and business data together in the business database, even if the user data is encrypted, it is encrypted using a soft algorithm. This encryption method can easily lead to user data being leaked and cracked. If an encryption machine is used for encrypted storage, in high-concurrency scenarios, the encryption machine will become a system performance bottleneck and the system stability will be insufficient.

[0059] To this end, Example 2 of the present application is proposed.

[0060] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the first embodiment can refer to the above description, and will not be repeated in the following. On this basis, step S20 encrypts and stores the user data through a dual encryption and dual storage strategy, and the data storage method further includes steps S21 to S24:

[0061] Step S21, reading the soft algorithm key and the signature verification key from the system cache;

[0062] Among them, the soft algorithm key and the signature verification key are pre-stored in the system cache.

[0063] Among them, soft algorithms are algorithms implemented at the software level, such as symmetric encryption algorithms and asymmetric encryption algorithms. Soft algorithm keys are keys used when using encryption algorithms implemented by software.

[0064] Step S22, verifying the signature of the user data using the signature verification key;

[0065] It should be noted that when a sensitive data system receives user data, it can verify the user data with the signature verification key to ensure that the data has not been tampered with during transmission. The signature verification process checks whether the data matches the signature. If the data is modified or damaged, the signature verification will fail, indicating that the data may have been tampered with.

[0066] In addition, the signature verification key can confirm that the user data does come from the claimed source. The key generated by the signature is user- or system-specific, so it can be verified whether the data was generated by the legitimate sender. Through the signature mechanism, sensitive data systems can also verify the validity and source of data, thereby preventing malicious users from forging data or performing replay attacks (i.e. repeatedly sending previous data to commit fraud).

[0067] Step S23: If the signature verification is successful, the user data is encrypted by an encryption machine to obtain first ciphertext data, and the first ciphertext data is stored in a database;

[0068] Among them, the first ciphertext data can only be decrypted by the corresponding encryption machine. Even if the database data is leaked, it cannot be decrypted without the encryption machine, thus ensuring data security;

[0069] Step S24: encrypt the user data using the soft algorithm key to obtain second ciphertext data, and store the second ciphertext data in the Redis storage system.

[0070] Among them, the application system algorithm program is called to encrypt the user data, and the output second ciphertext data is stored in Redis. After the data is cached successfully, the system realizes double encryption and double storage of user sensitive information.

[0071] It should be noted that the user data stored in the database is encrypted by an encryption machine, and then encrypted by a soft algorithm and stored in the Redis cache. It can be quickly obtained from the cache when reading. This application uses two encryption methods, encryption machine and soft algorithm, and two storage methods, database and Redis, which not only ensures the security of user sensitive data stored in the database, but also ensures the stability of high concurrent operation of the application system.

[0072] This embodiment verifies the signature of user data through the signature verification key, which improves the security of data transmission and ensures the reliability of data exchanged on the Internet or other unsafe environments. In addition, this application adopts two encryption methods, encryption machine and soft algorithm, and two storage methods, database and Redis, which not only ensures the security of user sensitive data stored in the database, but also ensures the stability of high concurrent operation of the application system.

[0073] Based on the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the second embodiment can be referred to the above description, and will not be repeated in the following. On this basis, step S20, after encrypting and storing the user data through the dual encryption dual storage strategy, also includes steps S30 and S70:

[0074] Step S30, in response to the user data query instruction, determining whether the second ciphertext data can be obtained from the Redis storage system;

[0075] Step S70: If yes, decrypt the second ciphertext data using the soft algorithm key to obtain second plaintext data, and return the second plaintext data to the business system.

[0076] As an implementation method, the business system calls the sensitive data system to query user information. The system obtains the user real-name information ciphertext (second ciphertext data) from Redis according to the user ID, and calls the soft algorithm to decrypt the user information ciphertext (second ciphertext data) to obtain the user information ciphertext. In high-concurrency scenarios, the Redis cache reading method is used to greatly improve system performance.

[0077] This embodiment decrypts the second ciphertext data by using the soft algorithm key to obtain second plaintext data, and returns the second plaintext data to the business system. In a high-concurrency scenario, the Redis cache reading method is adopted to greatly improve the system performance.

[0078] Based on the third embodiment of the present application, in the fourth embodiment of the present application, the same or similar contents as those in the third embodiment can be referred to the above description, and will not be described in detail later. On this basis, step S30, in response to the user data query instruction, determines whether the second ciphertext data can be obtained from the Redis storage system, and further includes steps S40 to S50:

[0079] Step S40: if not, obtaining the first ciphertext data from the database;

[0080] Step S50: decrypt the first ciphertext data through the encryption machine to obtain the first plaintext data, and return the first plaintext data to the business system.

[0081] It should be noted that if the second ciphertext data cannot be obtained from the Redis storage system, the first ciphertext data is obtained from the database.

[0082] The second ciphertext data is consistent with the plaintext after decryption of the first ciphertext data.

[0083] This embodiment encrypts and stores the user data through a dual encryption and dual storage strategy. If the data is not in Redis, the data is obtained from the database and decrypted, ensuring the reliability and integrity of data query. Even if Redis has problems, the system can still obtain data from the database to ensure business continuity and stability.

[0084] Based on the fourth embodiment of the present application, in the fifth embodiment of the present application, the same or similar contents as those in the fourth embodiment can be referred to the above description, and will not be described in detail later. On this basis, step S50, decrypting the first ciphertext data by the encryption machine to obtain the first plaintext data, and returning the first plaintext data to the business system includes step S60:

[0085] Step S60: encrypt the first plaintext data using the soft algorithm key to obtain third ciphertext data, and store the third ciphertext data in the Redis storage system.

[0086] It should be noted that if the user data is not in Redis, the data is obtained from the database and decrypted, and the decrypted first plaintext data is encrypted to obtain the third ciphertext data, and the third ciphertext data is stored in Redis. Subsequent queries of unified data can be directly queried in Redis, which improves the convenience of subsequent data queries and improves system performance.

[0087] In this embodiment, the first plaintext data is encrypted by the soft algorithm key to obtain third ciphertext data, and the third ciphertext data is stored in the Redis storage system. Subsequent queries of unified data can be directly queried in Redis, which can improve the convenience of subsequent data queries and improve system performance.

[0088] Based on the second embodiment of the present application, in the sixth embodiment of the present application, the same or similar contents as those in the second embodiment can be referred to the above description, and will not be described in detail later. On this basis, step S24, encrypting the user data by the soft algorithm key to obtain the second ciphertext data, and storing the second ciphertext data in the Redis storage system also includes step S25:

[0089] Step S25, clearing the data in the Redis storage system based on a preset data cache period.

[0090] For example, the user's login session data is cached in Redis. The preset cache period for each session data is 30 minutes. When a session data is cached, it will survive for 30 minutes. After the 30 minutes expire, Redis will automatically clear the session data from the cache. This ensures that only valid and recently used data is retained in the cache, avoiding expired data from occupying memory resources.

[0091] As another implementation method, the following eight strategies can be used to clean up data in the Redis storage system:

[0092] (1) Dynamically adjust cache expiration policy: Dynamically adjust cache expiration time according to business needs and access patterns. For example, for frequently accessed data, the cache expiration period can be extended; for seldom accessed data, the cache expiration period can be shortened, thereby optimizing memory usage.

[0093] (2) Adaptive cache management strategy: Implement intelligent cache algorithms to dynamically adjust cache strategies based on factors such as data access frequency and data importance, such as using LRU (least recently used) or LFU (least recently used) algorithms to clean up the cache.

[0094] (3) Hierarchical cleaning strategy: Implement a hierarchical cleaning strategy and set different cleaning strategies based on the importance and frequency of data use. For example, a soft deletion strategy can be used for low-priority data to ensure that high-priority data is always retained in the cache.

[0095] (4) Batch cleaning and asynchronous cleaning strategies: Batch cleanup of cached data to reduce the impact on system performance. Asynchronous execution of cleaning tasks allows cleaning work to be processed in the background to avoid interference with real-time queries.

[0096] (5) Cache health monitoring strategy: Monitor Redis memory usage, hit rate, number of expired data, and other indicators. Track the health status of the cache through the dashboard or log system to promptly identify and resolve cache problems.

[0097] (6) Automatic alarm strategy: Set up an alarm mechanism for the cache system to promptly notify the operation and maintenance personnel to intervene when it is found that the memory usage is too high, the cache hit rate is reduced, or the cleanup strategy fails.

[0098] (7) Cache preheating strategy: After the system starts or the cache is cleaned, some frequently used data is preloaded into the cache. By preheating the cache, the delay during the first access is reduced and the system response speed is improved.

[0099] (8) Intelligent preloading strategy: Based on historical access data or prediction algorithms, intelligently select the data that needs to be preloaded into the cache to ensure that the data that is most likely to be accessed is always available.

[0100] This embodiment cleans up the data in the Redis storage system based on a preset data cache period, which can optimize memory usage and prevent expired data from occupying memory resources.

[0101] The present application also provides a data storage method, which is applied to a business system. The data storage method includes step S1000:

[0102] Step S1000: sending user data to a sensitive data system based on user credentials, so that the sensitive data system encrypts and stores the user data through a double encryption and double storage strategy.

[0103] Among them, the data storage system may include a business system and a sensitive data system. When the business system obtains the user authentication credentials, the business system sends the user data to the sensitive data system, and the sensitive data system encrypts and stores the user data through a double encryption and double storage strategy.

[0104] For example, to help understand the implementation process of the data storage method of the above embodiment, please refer to Figure 2 , Figure 2This is a detailed flowchart of the data storage method of this application. Specifically, the process includes the following steps:

[0105] S301, business data is input into the business system, and the business system calls the relevant interface of the sensitive data system to encrypt and store the business data.

[0106] S302, the sensitive data system reads the soft algorithm key, signature verification key, etc. from the application cache.

[0107] S303, the sensitive data system verifies and decrypts the transmitted data.

[0108] S304, the sensitive data system calls the encryption machine to encrypt the sensitive data to obtain a first ciphertext.

[0109] S305, the sensitive data system stores the first ciphertext in the database.

[0110] S306, the sensitive data system encrypts the sensitive data using the soft algorithm key to obtain a second ciphertext.

[0111] S307, the sensitive data system stores the second ciphertext in Redis.

[0112] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the data storage method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0113] The present application also provides a data storage device, please refer to Figure 3 , the data storage device is arranged in a sensitive data system, and includes:

[0114] A data receiving module 10, used to receive user data sent by the business system based on user credentials;

[0115] The encryption storage module 20 is used to encrypt and store the user data through a double encryption and double storage strategy.

[0116] The data storage device provided by the present application adopts the data storage method in the above embodiment, which can solve the technical problem that the current method easily reduces the security of data. Compared with the prior art, the beneficial effects of the data storage device provided by the present application are the same as the beneficial effects of the data storage method provided by the above embodiment, and the other technical features of the data storage device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0117] The present application provides a data storage device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data storage method in the above-mentioned embodiment one.

[0118] Reference below Figure 4 , which shows a schematic diagram of the structure of a data storage device suitable for implementing the embodiment of the present application. The data storage device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 4 The data storage device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0119] like Figure 4 As shown, the data storage device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the data storage device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. Communication device 1009 can allow data storage device to communicate with other devices wirelessly or wired to exchange data. Although data storage device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0120] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0121] The data storage device provided by the present application adopts the data storage method in the above embodiment, which can solve the technical problem that the current method easily reduces the security of data. Compared with the prior art, the beneficial effects of the data storage device provided by the present application are the same as the beneficial effects of the data storage method provided by the above embodiment, and the other technical features in the data storage device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0122] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0123] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0124] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the data storage method in the above-mentioned embodiment.

[0125] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0126] The computer-readable storage medium may be included in a data storage device; or may exist independently without being assembled into a data storage device.

[0127] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the data storage device, the data storage device: receives user data sent by the business system based on user credentials; and encrypts and stores the user data through a double encryption and double storage strategy.

[0128] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0129] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0130] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0131] The readable storage medium provided in the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned data storage method, and can solve the technical problem that the current method easily reduces the security of data. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in the present application are the same as the beneficial effects of the data storage method provided in the above-mentioned embodiment, and will not be repeated here.

[0132] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A data storage method, characterized in that: Applied to sensitive data systems, the method comprises the following steps: Receive user data sent by the business system based on user credentials; The user data is encrypted and stored using a double encryption and double storage strategy.

2. The method according to claim 1, characterized in that The step of encrypting and storing the user data using a double encryption and double storage strategy comprises: Read the soft algorithm key and signature verification key from the system cache; Verifying the signature of the user data by using the signature verification key; If the signature verification is successful, the user data is encrypted by an encryption machine to obtain first ciphertext data, and the first ciphertext data is stored in a database; The user data is encrypted by using the soft algorithm key to obtain second ciphertext data, and the second ciphertext data is stored in the Redis storage system.

3. The method according to claim 2, characterized in that The step of encrypting and storing the user data by the double encryption and double storage strategy includes: In response to a user data query instruction, determining whether the second ciphertext data can be obtained from the Redis storage system; If so, the second ciphertext data is decrypted using the soft algorithm key to obtain second plaintext data, and the second plaintext data is returned to the business system.

4. The method according to claim 3, characterized in that After the step of responding to the user data query instruction and determining whether the second ciphertext data can be obtained from the Redis storage system, the following steps are included: If not, obtaining the first ciphertext data from the database; The first ciphertext data is decrypted by the encryption machine to obtain the first plaintext data, and the first plaintext data is returned to the business system.

5. The method according to claim 4, characterized in that The step of decrypting the first ciphertext data by the encryption machine to obtain the first plaintext data and returning the first plaintext data to the business system includes: The first plaintext data is encrypted by using the soft algorithm key to obtain third ciphertext data, and the third ciphertext data is stored in the Redis storage system.

6. The method according to claim 2, characterized in that The step of encrypting the user data by using the soft algorithm key to obtain second ciphertext data, and storing the second ciphertext data in the Redis storage system includes: The data in the Redis storage system is cleaned up based on a preset data cache period.

7. A data storage method, characterized in that: Applied to a business system, the method comprises the following steps: Based on the user credentials, the user data is sent to the sensitive data system so that the sensitive data system encrypts and stores the user data through a double encryption and double storage strategy.

8. A data storage device, characterized in that: Set in a sensitive data system, the device includes: A data receiving module, used to receive user data sent by the business system based on user credentials; The encryption storage module is used to encrypt and store the user data through a double encryption and double storage strategy.

9. A data storage device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the data storage method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the data storage method according to any one of claims 1 to 7 are implemented.

Images