Data security protection method, system, device and storage medium

Abstract

The present application discloses a data security protection method, system, device and storage medium, which relates to the field of data security, including: the middleware application server sends a prompt message after completing the initialization operation so that the user can enter the initial password; the initial password and the random salt value are SM3 hashed, the hash value and the random salt value are encoded and stored in the target file, after successful startup, the password ciphertext of the initial password entered by the user and the password plaintext after the password ciphertext is decrypted are obtained, the hash value and the random salt value are decoded, the decoded salt value and the password plaintext are SM3 hashed, and the calculation result is compared with the decoded hash value; according to the comparison result, it is judged whether the login authentication is successful. If successful, when the instruction entered by the user corresponds to sensitive data, the encryption algorithm is used to encrypt the transmission and storage of the sensitive data to complete the security protection of the sensitive data. The present application improves the level of data security protection.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a data security protection method, system, device and storage medium. Background Art

[0002] In today's era of rapid development of information technology, data security and privacy protection have become the focus of attention of all sectors of society. With the popularization of network applications and the surge in data volume, sensitive data such as personal information and corporate secrets are facing unprecedented risks of leakage. Although traditional data encryption and login authentication technologies can ensure data security to a certain extent, their limitations are gradually emerging in the face of increasingly complex network environments and highly persistent threats. The national secret algorithm, with its high strength, high security and autonomous controllable characteristics, has shown unique advantages in ensuring data security. However, the direct application of the national secret algorithm often requires customized development for each business system, which not only increases the difficulty of implementation, but also increases the cost. As a bridge connecting applications and underlying resources, middleware can provide a unified data processing, transmission and management interface. Therefore, how to combine the national secret algorithm with middleware technology to achieve unified processing of automatic encryption, decryption and login authentication of sensitive data is an urgent problem to be solved. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a data security protection method, system, device and storage medium, which can combine the national secret algorithm with the middleware to encrypt sensitive data and log in to identify, effectively improve the level of data security protection, and reduce the implementation cost, promote the widespread application of the national secret algorithm, and provide strong support for building a secure and reliable information environment. The specific scheme is as follows:

[0004] In a first aspect, the present application discloses a data security protection method, which is applied to a middleware application server, comprising:

[0005] After completing the initialization operation, sending a prompt message for inputting an initial password to the user, so that the user can input the initial password based on the prompt message;

[0006] Perform SM3 hash calculation on the initial password and the generated random salt value to obtain a hash value, and encode the hash value and the random salt value in base64 and store them in the target file. After the startup script is successfully started, obtain the password ciphertext corresponding to the initial password entered by the user;

[0007] Obtaining the password plaintext after decrypting the password ciphertext, decoding the hash value and the random salt value stored in the target file, performing SM3 hash calculation on the corresponding decoded salt value and the password plaintext, obtaining the calculation result, and comparing the calculation result with the corresponding decoded hash value;

[0008] Whether the login authentication is successful is determined based on the corresponding comparison results. If the login authentication is successful, when the instruction entered by the user corresponds to sensitive data, the sensitive data is encrypted and transmitted based on the SM2 asymmetric encryption algorithm, and the sensitive data is encrypted and stored based on the SM4 symmetric encryption algorithm to complete the security protection of the sensitive data.

[0009] Optionally, before sending a prompt message for the user to enter an initial password after completing the initialization operation, the method further includes:

[0010] Start the initialization script and read the key parameters corresponding to the national encryption algorithm, so as to generate a key according to the key parameters, and encrypt the initial password and the sensitive data based on the key.

[0011] Optionally, before obtaining the password ciphertext corresponding to the initial password input by the user, the method further includes:

[0012] Log in by accessing the link and obtain the user name entered by the user.

[0013] Optionally, before obtaining the password ciphertext corresponding to the initial password input by the user, the method further includes:

[0014] The user name is stored in plain text, and the initial password is encrypted and transmitted based on the public key of the SM2 asymmetric encryption algorithm;

[0015] Correspondingly, the obtaining of the password plaintext after decrypting the password ciphertext includes:

[0016] Obtain the cryptographic plaintext after decrypting the cryptographic ciphertext using the private key of the SM2 asymmetric encryption algorithm.

[0017] Optionally, judging whether the login authentication is successful according to the corresponding comparison result includes:

[0018] If the calculation result is the same as the decoded hash value, the login authentication is determined to be successful;

[0019] If the calculation result is different from the decoded hash value, it is determined that the login authentication has failed, and a prompt message indicating the login failure is sent, and the operation of obtaining the initial password and user name input by the user is re-executed.

[0020] Optionally, when the instruction input by the user corresponds to sensitive data, performing an encryption transmission operation on the sensitive data based on an SM2 asymmetric encryption algorithm, and performing an encryption storage operation on the sensitive data based on an SM4 symmetric encryption algorithm, includes:

[0021] When the instruction input by the user corresponds to sensitive data, the sensitive data is encrypted using the public key of the SM2 asymmetric encryption algorithm, and the corresponding encrypted data is transmitted to a preset area;

[0022] Decrypting the encrypted data based on the private key of the SM2 asymmetric encryption algorithm to obtain the data plaintext;

[0023] The data plaintext is encrypted and stored using the SM4 symmetric encryption algorithm.

[0024] Optionally, after the login authentication is successful, the process further includes:

[0025] A corresponding functional operation is performed according to the instruction input by the user, and if the functional operation corresponds to non-sensitive data, the non-sensitive data is directly stored.

[0026] In a second aspect, the present application discloses a data security protection device, which is applied to a middleware application server, comprising:

[0027] A prompt information sending module, used for sending prompt information for inputting an initial password to the user after completing the initialization operation, so that the user can input the initial password based on the prompt information;

[0028] A password ciphertext acquisition module is used to perform SM3 hash calculation on the initial password and the generated random salt value to obtain a hash value, and store the hash value and the random salt value in a target file after base64 encoding, and obtain the password ciphertext corresponding to the initial password input by the user after successful startup through the startup script;

[0029] A comparison module is used to obtain the password plaintext after decrypting the password ciphertext, decode the hash value and the random salt value stored in the target file, perform SM3 hash calculation on the corresponding decoded salt value and the password plaintext, obtain the calculation result, and compare the calculation result with the corresponding decoded hash value;

[0030] The transmission and storage module is used to determine whether the login authentication is successful based on the corresponding comparison results. If the login authentication is successful, when the instruction input by the user corresponds to sensitive data, the sensitive data is encrypted and transmitted based on the SM2 asymmetric encryption algorithm, and the sensitive data is encrypted and stored based on the SM4 symmetric encryption algorithm to complete the security protection of the sensitive data.

[0031] In a third aspect, the present application discloses an electronic device, comprising:

[0032] Memory, used to store computer programs;

[0033] The processor is used to execute the computer program to implement the data security protection method as described above.

[0034] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned data security protection method when executed by a processor.

[0035] When the present application performs security protection on data, first, after completing the initialization operation, a prompt message for inputting an initial password is sent to the user, so that the user can input the initial password based on the prompt message; then, an SM3 hash calculation is performed on the initial password and the generated random salt value to obtain a hash value, and the hash value and the random salt value are base64 encoded and stored in a target file. After successful startup through the startup script, the password ciphertext corresponding to the initial password input by the user is obtained; and the password plaintext after decrypting the password ciphertext is obtained, the hash value and the random salt value stored in the target file are decoded, and the corresponding decoded salt value and the password plaintext are subjected to SM3 hash calculation to obtain a calculation result, and the calculation result is compared with the corresponding decoded hash value; finally, whether the login authentication is successful is determined according to the corresponding comparison result. If the login authentication is successful, when the instruction input by the user corresponds to sensitive data, the sensitive data is encrypted and transmitted based on the SM2 asymmetric encryption algorithm, and the sensitive data is encrypted and stored based on the SM4 symmetric encryption algorithm, so as to complete the security protection of the sensitive data. It can be seen that this application integrates sensitive data encryption and decryption, login authentication functions through middleware to ensure confidentiality, integrity and authentication strength during data transmission and storage. The national secret algorithm is used to keep sensitive data confidential, that is, the asymmetric encryption algorithm SM2 is used for encrypted transmission, and the SM2 private key is used for decryption and then encrypted and stored based on the SM4 symmetric encryption algorithm to ensure data privacy; at the same time, the middleware is combined to realize the automation and confidentiality of login authentication, and the user login information is calculated by SM3 hashing with salt to prevent unauthorized access, thereby providing users with a full range of highly reliable information security solutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0037] Figure 1 A flow chart of a data security protection method disclosed in this application;

[0038] Figure 2 A schematic diagram of a data security protection method disclosed in this application;

[0039] Figure 3 This is a schematic diagram of the structure of a data security protection device disclosed in this application;

[0040] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] Although traditional data encryption and login authentication technologies can ensure data security to a certain extent, their limitations are gradually emerging in the face of increasingly complex network environments and advanced persistent threats. In order to solve the above technical problems, this application discloses a data security protection method that can combine national secret algorithms with middleware to encrypt and authenticate sensitive data, effectively improve the level of data security protection, reduce implementation costs, promote the widespread application of national secret algorithms, and provide strong support for building a secure and reliable information environment.

[0043] See also Figure 1 As shown, an embodiment of the present invention discloses a data security protection method, which is applied to a middleware application server, comprising:

[0044] Step S11: After the initialization operation is completed, a prompt message for inputting an initial password is sent to the user, so that the user can input the initial password based on the prompt message.

[0045] In this embodiment, the middleware acts as a bridge connecting the application and the underlying resources, and can provide a unified data processing, transmission and management interface. Before sending a prompt message to the user to enter the initial password after completing the initialization operation, the middleware application server first starts the initialization script and reads the key parameters corresponding to the national secret algorithm, so as to generate a key based on the key parameters, and encrypt the initial password and sensitive data based on the key. Specifically, the middleware application server first starts the initialization script to load its basic configuration and services, reads and loads security configurations related to the national secret algorithm, including the selection of encryption algorithms, key parameter initialization, etc. After the initialization is completed, the user is prompted to enter the initial password of the middleware application server.

[0046] Step S12, perform SM3 hash calculation on the initial password and the generated random salt value to obtain a hash value, and store the hash value and the random salt value in a target file after base64 encoding. After the startup script is successfully started, obtain the password ciphertext corresponding to the initial password entered by the user.

[0047] In this embodiment, a random salt value is generated internally in the middleware application server, and an SM3 hash calculation is performed on the salt value and the initial password to obtain a hash value, and the hash value and the salt value are base64 encoded and stored in the admin-key file. After the middleware application server is successfully started through the startup script, it logs in by accessing the link. Before obtaining the password ciphertext corresponding to the initial password entered by the user, the user name is stored in plain text, and the initial password is encrypted and transmitted based on the public key of the SM2 asymmetric encryption algorithm. In this way, the password plaintext can be obtained after the password ciphertext is decrypted using the private key of the SM2 asymmetric encryption algorithm. In general, the user name is transmitted in plain text, and the user password is encrypted and transmitted using the public key of the SM2 asymmetric encryption algorithm stored in the session; after the middleware application server obtains the password ciphertext, it uses the private key of the static variable SM2 asymmetric encryption algorithm inside the middleware application server to decrypt the ciphertext to obtain the password plaintext.

[0048] Step S13, obtaining the password plaintext after decrypting the password ciphertext, decoding the hash value and the random salt value stored in the target file, and performing SM3 hash calculation on the corresponding decoded salt value and the password plaintext, obtaining the calculation result, and comparing the calculation result with the corresponding decoded hash value.

[0049] In this embodiment, first obtain the password plaintext after decrypting the password ciphertext, decode the salt value and hash value stored in the admin-key file, perform SM3 hash calculation on the decoded salt value and the password plaintext, and finally compare the calculation result with the decoded hash value to determine whether the login authentication is successful based on the comparison result.

[0050] Step S14, judging whether the login authentication is successful according to the corresponding comparison result; if the login authentication is successful, encrypting and transmitting the sensitive data based on the SM2 asymmetric encryption algorithm when the instruction input by the user corresponds to sensitive data, and encrypting and storing the sensitive data based on the SM4 symmetric encryption algorithm to complete the security protection of the sensitive data.

[0051] In this embodiment, the calculation result is compared with the corresponding decoded hash value, and whether the login authentication is successful is determined based on the corresponding comparison result. If the calculation result is the same as the decoded hash value, the login authentication is determined to be successful; if the calculation result is different from the decoded hash value, the login authentication is determined to have failed, and a prompt message of login failure is sent, and the operation of obtaining the initial password and user name entered by the user is re-executed.

[0052] If the login authentication is successful, when the instruction input by the user corresponds to sensitive data, the public key of the SM2 asymmetric encryption algorithm is used to encrypt the sensitive data, and the corresponding encrypted data is transmitted to the preset area; the encrypted data is decrypted based on the private key of the SM2 asymmetric encryption algorithm to obtain the data plaintext; finally, the data plaintext is encrypted and stored using the SM4 symmetric encryption algorithm. After the login authentication is successful, the corresponding functional operation is performed according to the instruction input by the user. If the functional operation corresponds to non-sensitive data, the non-sensitive data is directly stored.

[0053] In other words, after successful login, the user performs operations related to the functions. For non-sensitive data involved (such as enabled status, cluster name, etc.), it is sufficient to process in plain text. For sensitive data involved (such as database connection pool password, audit log information, etc.), it is necessary to use the public key of the SM2 asymmetric encryption algorithm to encrypt and transmit it to the application server, and use the private key of the SM2 asymmetric encryption algorithm to decrypt and obtain the plain text of the data. This operation can ensure the confidentiality of sensitive data during transmission. The decrypted plain text is encrypted and stored using the symmetric encryption algorithm SM4 to ensure that the data cannot be easily decrypted even if it is illegally obtained. It should be noted that the encryption and decryption rate using the symmetric encryption algorithm will be greatly improved. As a result, the national secret algorithm is efficiently integrated into the middleware to ensure that the execution efficiency and security of the algorithm are equally important. It can also effectively improve the level of data security protection and reduce implementation costs.

[0054] To summarize, when the present application performs security protection on data, first, after completing the initialization operation, a prompt message for inputting an initial password is sent to the user, so that the user can input the initial password based on the prompt message; then, the initial password and the generated random salt value are subjected to SM3 hash calculation to obtain a hash value, and the hash value and the random salt value are base64 encoded and stored in the target file. After successful startup through the startup script, the password ciphertext corresponding to the initial password input by the user is obtained; and the password plaintext after decrypting the password ciphertext is obtained, the hash value and the random salt value stored in the target file are decoded, and the corresponding decoded salt value and the password plaintext are subjected to SM3 hash calculation to obtain the calculation result, and the calculation result is compared with the corresponding decoded hash value; finally, whether the login authentication is successful is determined according to the corresponding comparison result. If the login authentication is successful, the sensitive data is encrypted and transmitted based on the SM2 asymmetric encryption algorithm when the instruction input by the user corresponds to sensitive data, and the sensitive data is encrypted and stored based on the SM4 symmetric encryption algorithm to complete the security protection of the sensitive data. It can be seen that this application integrates sensitive data encryption and decryption, login authentication functions through middleware to ensure confidentiality, integrity and authentication strength during data transmission and storage. The national secret algorithm is used to keep sensitive data confidential, that is, the asymmetric encryption algorithm SM2 is used for encrypted transmission, and the SM2 private key is used for decryption and then encrypted and stored based on the SM4 symmetric algorithm to ensure data privacy; at the same time, the middleware is combined to realize the automation and confidentiality of login authentication, and the user login information is calculated by SM3 hashing with salt to prevent unauthorized access, thereby providing users with a full range of highly reliable information security solutions.

[0055] Based on the previous embodiment, it can be seen that the present application discloses a data security protection method, and the specific data security protection process will be described in detail below.

[0056] like Figure 2 As shown, the middleware application server is initialized first. First, the initialization script is started to load its basic configuration and services, and the security configuration related to the national encryption algorithm is read and loaded. These configurations include the selection of encryption algorithms, key parameter initialization, etc. After the initialization is completed, the user is prompted to enter the initial password of the application server. The middleware application server generates a random salt value internally, performs SM3 hash calculation on the salt value and the initial password to obtain a hash value, and base64 encodes the hash value and the salt value and stores them in the admin-key file.

[0057] Then the middleware application server starts and performs login authentication. After the middleware application server is successfully started through the startup script, it logs in by accessing the link. On the login page, the user needs to enter the user name and password for login authentication. The specific process is as follows:

[0058] The user name is transmitted in plain text, and the user password is encrypted using the public key of the SM2 asymmetric encryption algorithm stored in the session;

[0059] After the middleware application server obtains the password ciphertext, it uses the private key of the asymmetric encryption algorithm of the static variable SM2 inside the middleware application server to decrypt the ciphertext to obtain the password plaintext;

[0060] Decode the salt value and hash value stored in the admin-key file, perform SM3 hash calculation on the decoded salt value and the plain text password, and compare the calculation result with the decoded hash value. If they are consistent, it indicates that the login authentication is successful. Otherwise, it indicates that the login failed and you need to re-enter the password and perform the above operation again.

[0061] Finally, after successful login, the user can operate related functions. For non-sensitive data (such as enabled status, cluster name, etc.), it is sufficient to process in plain text. For sensitive data (such as database connection pool password, audit log information, etc.), it is necessary to encrypt it with the public key of the SM2 asymmetric encryption algorithm and then transmit it to the application server. It is then decrypted with the private key of the SM2 asymmetric encryption algorithm to obtain the plain text of the data. This operation can ensure the confidentiality of sensitive data during transmission. The decrypted plain text is encrypted and stored using the symmetric encryption algorithm SM4.

[0062] In this way, the middleware integrates the national secret algorithm to encrypt sensitive data and log in to authenticate, ensuring confidentiality, integrity and authentication strength during data transmission and storage. This meets the comprehensive needs of information security and performance in different application scenarios. Combining the national secret algorithm with middleware technology can realize the unified processing of automatic encryption, decryption and login authentication of sensitive data, without the need to transform each business system one by one, greatly improving implementation efficiency and compatibility. Among them, data encryption uses the national secret algorithm to ensure the high security of data during transmission and storage; the login authentication mechanism enhances system access control to prevent unauthorized access.

[0063] See also Figure 3 As shown, an embodiment of the present invention discloses a data security protection device, which is applied to a middleware application server, including:

[0064] A prompt information sending module 11 is used to send a prompt information for inputting an initial password to the user after completing the initialization operation, so that the user can input the initial password based on the prompt information;

[0065] The password ciphertext acquisition module 12 is used to perform SM3 hash calculation on the initial password and the generated random salt value to obtain a hash value, and store the hash value and the random salt value in a target file after base64 encoding, and obtain the password ciphertext corresponding to the initial password input by the user after the startup script is successfully started;

[0066] A comparison module 13 is used to obtain the password plaintext after decrypting the password ciphertext, decode the hash value and the random salt value stored in the target file, perform SM3 hash calculation on the corresponding decoded salt value and the password plaintext, obtain the calculation result, and compare the calculation result with the corresponding decoded hash value;

[0067] The transmission and storage module 14 is used to determine whether the login authentication is successful based on the corresponding comparison results. If the login authentication is successful, when the instruction input by the user corresponds to sensitive data, the sensitive data is encrypted and transmitted based on the SM2 asymmetric encryption algorithm, and the sensitive data is encrypted and stored based on the SM4 symmetric encryption algorithm to complete the security protection of the sensitive data.

[0068] It can be seen that this application integrates sensitive data encryption and decryption, login authentication functions through middleware to ensure confidentiality, integrity and authentication strength during data transmission and storage. The national secret algorithm is used to keep sensitive data confidential, that is, the asymmetric encryption algorithm SM2 is used for encrypted transmission, and the SM2 private key is used for decryption and then encrypted and stored based on the SM4 symmetric algorithm to ensure data privacy; at the same time, the middleware is combined to realize the automation and confidentiality of login authentication, and the user login information is calculated by SM3 hashing with salt to prevent unauthorized access, thereby providing users with a full range of highly reliable information security solutions.

[0069] In some specific embodiments, the device may further include:

[0070] The key parameter reading module is used to start the initialization script and read the key parameters corresponding to the national encryption algorithm, so as to generate a key according to the key parameters, and encrypt the initial password and the sensitive data based on the key.

[0071] In some specific embodiments, the device may further include:

[0072] The user name acquisition module is used to log in by accessing a link and acquire the user name input by the user.

[0073] In some specific embodiments, the device may further include:

[0074] A password encryption storage module, used to store the user name in plain text and encrypt and transmit the initial password based on the public key of the SM2 asymmetric encryption algorithm;

[0075] Accordingly, the comparison module 13 includes:

[0076] The password ciphertext decryption module is used to obtain the password plaintext after decrypting the password ciphertext using the private key of the SM2 asymmetric encryption algorithm.

[0077] In some specific embodiments, the transmission and storage module 14 may specifically include:

[0078] A first judgment result execution unit, configured to determine that the login authentication is successful if the calculation result is the same as the decoded hash value;

[0079] The second judgment result execution unit is used to determine that the login authentication fails if the calculation result is different from the decoded hash value, send a prompt message of login failure, and re-execute the operation of obtaining the initial password and user name input by the user.

[0080] In some specific embodiments, the transmission and storage module 14 may specifically include:

[0081] A sensitive data encryption unit, used to encrypt the sensitive data using the public key of the SM2 asymmetric encryption algorithm when the instruction input by the user corresponds to sensitive data, and transmit the corresponding encrypted data to a preset area;

[0082] A data decryption unit, used to decrypt the encrypted data based on the private key of the SM2 asymmetric encryption algorithm to obtain data plaintext;

[0083] The encryption storage unit is used to encrypt and store the data plaintext using the SM4 symmetric encryption algorithm.

[0084] In some specific embodiments, the device may further include:

[0085] The storage module is used to perform corresponding functional operations according to the instructions input by the user. If the functional operation corresponds to non-sensitive data, the non-sensitive data is directly stored.

[0086] Furthermore, the present application also discloses an electronic device. Figure 4This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0087] Figure 4 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the data security protection method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0088] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0089] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0090] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the data security protection method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0091] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed data security protection method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0092] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0093] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0094] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0095] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0096] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A data security protection method, characterized in that: Applicable to middleware application servers, including: After completing the initialization operation, sending a prompt message for inputting an initial password to the user, so that the user can input the initial password based on the prompt message; Perform SM3 hash calculation on the initial password and the random salt value generated by the middleware application server to obtain a hash value, and store the hash value and the random salt value in a target file after base64 encoding, and obtain the password ciphertext corresponding to the initial password input by the user after successful startup through the startup script; Obtaining the password plaintext after decrypting the password ciphertext, decoding the hash value and the random salt value stored in the target file, performing SM3 hash calculation on the corresponding decoded salt value and the password plaintext, obtaining the calculation result, and comparing the calculation result with the corresponding decoded hash value; Whether the login authentication is successful is determined based on the corresponding comparison results. If the login authentication is successful, when the instruction entered by the user corresponds to sensitive data, the sensitive data is encrypted and transmitted based on the SM2 asymmetric encryption algorithm, and the sensitive data is encrypted and stored based on the SM4 symmetric encryption algorithm to complete the security protection of the sensitive data.

2. The data security protection method according to claim 1, characterized in that: Before sending a prompt message for the user to enter an initial password after the initialization operation is completed, the method further includes: Start the initialization script and read the key parameters corresponding to the national encryption algorithm, so as to generate a key according to the key parameters, and encrypt the initial password and the sensitive data based on the key.

3. The data security protection method according to claim 1, characterized in that: Before obtaining the password ciphertext corresponding to the initial password input by the user, the method further includes: Log in by accessing the link and obtain the user name entered by the user.

4. The data security protection method according to claim 3, characterized in that: Before obtaining the password ciphertext corresponding to the initial password input by the user, the method further includes: The user name is stored in plain text, and the initial password is encrypted and transmitted based on the public key of the SM2 asymmetric encryption algorithm; Correspondingly, the obtaining of the password plaintext after decrypting the password ciphertext includes: Obtain the cryptographic plaintext after decrypting the cryptographic ciphertext using the private key of the SM2 asymmetric encryption algorithm.

5. The data security protection method according to claim 1, characterized in that: The step of judging whether the login authentication is successful according to the corresponding comparison result includes: If the calculation result is the same as the decoded hash value, the login authentication is determined to be successful; If the calculation result is different from the decoded hash value, it is determined that the login authentication has failed, and a prompt message indicating the login failure is sent, and the operation of obtaining the initial password and user name input by the user is re-executed.

6. The data security protection method according to claim 1, characterized in that: When the instruction input by the user corresponds to sensitive data, performing an encryption transmission operation on the sensitive data based on the SM2 asymmetric encryption algorithm, and performing an encryption storage operation on the sensitive data based on the SM4 symmetric encryption algorithm, includes: When the instruction input by the user corresponds to sensitive data, the sensitive data is encrypted using the public key of the SM2 asymmetric encryption algorithm, and the corresponding encrypted data is transmitted to a preset area; Decrypting the encrypted data based on the private key of the SM2 asymmetric encryption algorithm to obtain the data plaintext; The data plaintext is encrypted and stored using the SM4 symmetric encryption algorithm.

7. The data security protection method according to any one of claims 1 to 6, characterized in that: After the login authentication is successful, the method further includes: A corresponding functional operation is performed according to the instruction input by the user, and if the functional operation corresponds to non-sensitive data, the non-sensitive data is directly stored.

8. A data security protection system, characterized in that: Applicable to middleware application servers, including: A prompt information sending module, used for sending prompt information for inputting an initial password to the user after completing the initialization operation, so that the user can input the initial password based on the prompt information; A password ciphertext acquisition module is used to perform SM3 hash calculation on the initial password and the random salt value generated by the middleware application server to obtain a hash value, and store the hash value and the random salt value in a target file after base64 encoding, and obtain the password ciphertext corresponding to the initial password input by the user after successful startup through the startup script; A comparison module is used to obtain the password plaintext after decrypting the password ciphertext, decode the hash value and the random salt value stored in the target file, perform SM3 hash calculation on the corresponding decoded salt value and the password plaintext, obtain the calculation result, and compare the calculation result with the corresponding decoded hash value; The transmission and storage module is used to determine whether the login authentication is successful based on the corresponding comparison results. If the login authentication is successful, when the instruction input by the user corresponds to sensitive data, the sensitive data is encrypted and transmitted based on the SM2 asymmetric encryption algorithm, and the sensitive data is encrypted and stored based on the SM4 symmetric encryption algorithm to complete the security protection of the sensitive data.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, used to execute the computer program to implement the data security protection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein the computer program, when executed by a processor, implements the data security protection method as described in any one of claims 1 to 7.

Images