Data access method and device, electronic equipment and program product

Abstract

The embodiment of the invention provides a data access method and device, electronic equipment and a program product, and the data access method comprises the steps: receiving an access request of a to-be-verified user, the access request being used for requesting to access target encrypted data; in response to the access request, verifying the identity of the user to be verified; under the condition that the verification is passed, determining a first data pointer of the target encrypted data; determining an anonymous target file corresponding to the target encrypted data according to the first data pointer; and sending the anonymous target file to the user to be verified.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a data access method, device, electronic device, storage medium and program product. Background Art

[0002] With the rapid advancement of information technology and the tide of digital transformation, using lightweight encryption security systems to manage and protect massive amounts of electronic health record data has become a key path to improving the quality and efficiency of medical services.

[0003] In some scenarios, Mobile Edge Computing (MEC) can be used to manage and protect massive amounts of electronic health record data. MEC is a distributed network architecture that migrates computing, storage, networking and other services of cloud computing from traditional cloud data centers to the edge of the network, providing mobile and cloud computing capabilities such as storage, computing and services at the edge of the network. The emerging development of MEC can be used for secure healthcare applications such as remote patient monitoring, diagnosis and treatment, but if unauthorized illegal users remotely access the user's electronic health record data, data leakage will occur, and the data security is low. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a data access method, device, electronic device and storage medium to solve the problem of low data security.

[0005] In order to solve the above technical problems, the embodiments of the present application are implemented as follows:

[0006] In a first aspect, an embodiment of the present application provides a data access method, which includes: receiving an access request from a user to be verified, the access request being used to request access to target encrypted data; in response to the access request, verifying the identity of the user to be verified; if the verification is successful, determining a first data pointer of the target encrypted data; determining an anonymous target file corresponding to the target encrypted data based on the first data pointer; and sending the anonymous target file to the user to be verified.

[0007] In a second aspect, an embodiment of the present application provides a data access device, which includes: a receiving module, used to receive an access request from a user to be verified, the access request is used to request access to target encrypted data; a verification module, used to verify the identity of the user to be verified in response to the access request; a determination module, used to determine a first data pointer of the target encrypted data if the verification is successful; the determination module is also used to determine an anonymous target file corresponding to the target encrypted data based on the first data pointer; and a sending module, used to send the anonymous target file to the user to be verified.

[0008] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus; wherein the processor, the communication interface and the memory communicate with each other via the communication bus; the memory is used to store computer programs; and the processor is used to execute the programs stored in the memory to implement the steps of the data access method mentioned in the first aspect.

[0009] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the data access method mentioned in the first aspect are implemented.

[0010] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the steps of the data access method mentioned in the first aspect.

[0011] Through the technical solution disclosed in the embodiment of the present application, the identity of the user to be verified is verified by receiving an access request from the user to be verified and then responding to the access request. In the case of successful verification, the first data pointer of the target encrypted data is determined, and then the anonymous target file corresponding to the target encrypted data is determined according to the first data pointer, and finally the anonymous target file is sent to the user to be verified. In this way, by verifying the identity of the user to be verified, access to the data is allowed only after the verification is passed, thereby avoiding the problem of data leakage caused by illegal users accessing the data; and the target encrypted data to be accessed is the anonymous target file corresponding to the target encrypted data determined by the first data pointer, and the anonymous target file is sent to the user, thereby avoiding directly sending the original data to the user, and further improving the security of user access to data. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0013] Figure 1 A flowchart of a data access method provided in an embodiment of the present application;

[0014] Figure 2 A schematic diagram of a module composition of a model training device provided in an embodiment of the present application;

[0015] Figure 3A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0016] The purpose of the embodiments of the present application is to provide a data access method, device, electronic device and storage medium to solve the problem of low data security.

[0017] In order to enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0018] For example, Figure 1 As shown, the embodiment of the present application provides a data access method, the execution subject of the method may be a server, and the data access method may specifically include the following steps:

[0019] In step S101, an access request from a user to be authenticated is received.

[0020] The access request is used to request access to target encrypted data.

[0021] Specifically, the user to be verified refers to the user who accesses the data stored on the cloud server. When the user accesses the data stored on the cloud server, the identity of the user to be verified needs to be verified. The type of user to be verified can be a medical staff or the patient himself or other personnel. The target encrypted data refers to the encrypted data stored on the cloud server, such as the patient's medical health data and the patient's personal privacy data.

[0022] In step S103, in response to the access request, the identity of the user to be authenticated is authenticated.

[0023] Specifically, anonymous authentication can be used to verify the identity of the user to be verified, thereby protecting the user's personal privacy data from being leaked. For the patient data storage system, users can be registered to facilitate legitimate users to access the encrypted data stored in the cloud server.

[0024] In a possible implementation, before receiving an access request from the user to be verified, the method also includes: obtaining an identity identifier and pseudo-identity information of the user to be registered, the pseudo-identity information being determined by a password and a random number of the user to be registered; determining a public key of the user to be registered based on the pseudo-identity information and the password; determining a first identity parameter based on the identity identifier and the password, and determining a second identity parameter based on the first identity parameter and the pseudo-identity information; and sending a smart card to the user to be registered to complete registration, the smart card including a public key, a random number, a password, a first identity parameter, and a second identity parameter.

[0025] Specifically, the user to be registered first enters the password PW DC and your own identity DID i , the identity identifier DID i It can be used as the ID of the user to be registered, and then use the password PW DC And the random number R1 to determine the pseudo identity information of the user to be registered Then the user's terminal sends a message M1 to the edge server, where M1 = {DID i ||J D ||T}, where T is the time interval. The edge server calculates the following identity parameters based on the identity identifier, pseudo-identity information and password: AP i =h(DID i ||X), X is equivalent to the password PW DC , BP i =h(AP i ), Then select the master key M k =J D , and calculate the public key PK D =h(M k ||X). Among the above parameters, BP i Equivalent to the first identity parameter, VP i Equivalent to the second identity parameter.

[0026] At this point, the edge server can provide a smart card to the user to be registered, which includes the following parameters (DID i , BP1, VP1, PK D , R1). It is worth noting that the user to be registered in the embodiment of the present application may be a medical staff or the patient himself.

[0027] Furthermore, the user to be registered can also register in the following manner: the user to be registered can send his identity to the edge server, the edge server randomly selects a value from the integer set, and uses the value and the identity to generate a public key, wherein the identity carries a hash password, and the hash password can be randomly generated.

[0028] The user to be registered can enter the hashed password h(PW pi ) identity (PID i ) is sent to the edge server. The edge server then Select a value Y and generate a public key PK P =h(PID i ||Y), and then send a message M2 to the user to be registered = {PID i ||PK P}, and the registration is completed.

[0029] It is worth noting that the user to be registered in the embodiment of the present application can be the patient himself or the medical staff. Further, when registering, the medical staff can register by using a smart card, and the patient himself can register by using a hash password h(PW pi ) identity (PID i ) to register.

[0030] Furthermore, when verifying the identity of the user to be verified, the following method can be used: obtain the verification parameters carried in the access request; extract the identity identifier and password of the user to be verified from the verification parameters; calculate the first identity parameters of the user to be verified based on the identity identifier and password; and confirm that the user to be verified has passed the verification if there is a first identity parameter matching the first identity parameter of the user to be verified in the registration library.

[0031] Specifically, when a user wants to access encrypted data, he or she can enter a smart card and a random value randomly selected from a set of integers. The access request carries verification parameters, including but not limited to the identity and password of the user to be verified and a random value, etc., and then extracts the first identity parameter BP1 from the smart card input by the user. The first identity parameter BP1 is generated when the user corresponding to the smart card registers. The user to be verified enters his identity DID i and password X, calculate AP i ′=h(DID i ||X), BP i '=h(AP1),BP i ' is the first identity parameter of the user to be verified, judging BP i 'Is it equal to BP1? If it matches, it means it is a legal user.

[0032] After the user to be verified has passed the first verification, a token of the target encrypted data to be accessed is generated for the user to be verified. The token is used as a first data pointer, and the first data pointer points to the anonymous target file of the target encrypted data. The first data pointer can be determined in the following way: the user to be verified selects a random value from an integer set. And calculate α1=ω.DID i , α2=ω.PK D , α3=h(querystring,l)ω, α4=ω.PK P ,TokenTK=(l||α2||α4||T2), PK D PK is the public key of the user to be verified. P The public key of the user corresponding to the target encrypted data that the user to be verified wants to access. For example, when the user to be verified is a medical staff, PK D is the public key of the medical staff, PK P The public key of the patient corresponding to the target encrypted data to be accessed, where l is the length of the query string, querystring is the data to be accessed, i.e. the query string, and T2 is the query time interval. Token TK can be used as the first data pointer, which corresponds to the target encrypted data. The user to be verified can be a user with certain permissions, such as a medical staff.

[0033] Furthermore, when verifying the identity of the user to be verified, the following method can also be used: obtain the verification parameters carried in the access request; extract the identity of the user to be verified from the verification parameters; calculate the token of the user to be verified based on the identity, and verify the identity of the user to be verified based on the token.

[0034] Specifically, when a user to be verified wants to access encrypted data, the user to be verified can select a random value from a set of integers. And use the random value and the identity PID of the user to be verified i Calculate the public key of the user to be verified, PK P =h(PID i ||δ), determine the public key PK of the corresponding registered user according to the first data pointer corresponding to the target encrypted data that the user wants to access D , and generate a token. The token can be determined in the following way: Token TK = (l||β2||β4||T1), where β1 = β.PID i , β2=δ.PK D , β3=h(querystring,l)δ, β4=δ.PK P Querystring is the data you want to access, that is, the query string, and l is the length of the query string. Extract β2 and β4 from the token and verify whether β2 and β4 are the same as the registered PK D and PK P If they match, the verification is passed.

[0035] Furthermore, after the user to be verified has undergone the first verification, a token of the target encrypted data that the user to be verified needs to access is generated for the user to be verified. The token can be used as a data pointer for the user to be verified. The user to be verified can be the patient himself.

[0036] In step S105, when the verification is successful, the first data pointer of the target encrypted data is determined.

[0037] Specifically, through the above method embodiment, after the user registers and passes the first verification, a data pointer will be allocated to each user and the data accessed by the user, and the data pointer points to the corresponding target file target encrypted data. Therefore, after the verification is passed, the first data pointer of the target encrypted data is determined.

[0038] In one possible implementation, when the verification is successful, determining the first data pointer of the target encrypted data includes: when the user to be verified is a first type of user, determining the second data pointer of the target encrypted data, the first data pointer corresponds to the first type of user, and the second data pointer corresponds to the second type of user; based on the mapping relationship between the first data pointer and the second data pointer, determining the first data pointer corresponding to the second data pointer.

[0039] Specifically, the first type of user can be the patient himself, and the second type of user can be a medical staff. When the user to be verified is a medical staff, the data pointer corresponding to the medical staff is the first data pointer, and the first data pointer indicates the anonymous file of the target encrypted data. When the user to be verified is a patient, the patient's data pointer is the second data pointer, and the second data pointer points to the target encrypted data. The first data pointer and the second data pointer have a mapping relationship. When the patient accesses the target encrypted data, the first data pointer is determined according to the mapping relationship between the first data pointer and the second data pointer, so that the anonymous file of the target encrypted data corresponding to the first data pointer can be returned to the patient, thereby protecting the security of the patient's personal privacy data.

[0040] In step S107, an anonymous target file corresponding to the target encrypted data is determined according to the first data pointer.

[0041] Specifically, the anonymous target file refers to the anonymization of the personal privacy data of the target encrypted data. For example, the target encrypted data is the patient's health information and the patient's personal data (such as gender, name, and contact information, etc.). The anonymous target file includes the patient's health information and the patient's personal data anonymous information, that is, the patient's health information is only displayed to the user to be verified, thereby protecting the security of the patient's personal privacy data.

[0042] In step S109, the anonymous target file is sent to the user to be authenticated.

[0043] Specifically, after the anonymous target file is obtained, the anonymous target file is returned to the user to be verified in an anonymous identity.

[0044] Through the technical solution disclosed in the embodiment of the present application, the identity of the user to be verified is verified by receiving an access request from the user to be verified and then responding to the access request. In the case of successful verification, the first data pointer of the target encrypted data is determined, and then the anonymous target file corresponding to the target encrypted data is determined according to the first data pointer, and finally the anonymous target file is sent to the user to be verified. In this way, by verifying the identity of the user to be verified, access to the data is allowed only after the verification is passed, thereby avoiding the problem of data leakage caused by illegal users accessing the data; and the target encrypted data to be accessed is the anonymous target file corresponding to the target encrypted data determined by the first data pointer, and the anonymous target file is sent to the user, thereby avoiding directly sending the original data to the user, and further improving the security of user access to data.

[0045] Among them, the encryption method of the target encrypted data can be adopted in the following manner: obtaining the user data to be encrypted and the public deoxyribonucleic acid sequence; converting the user data into at least one data block, the data block is a two-dimensional matrix; generating an initial key for each data block according to the public deoxyribonucleic acid sequence; generating a key for each data block according to the initial key of each data block; encrypting the user data with the key to obtain encrypted data.

[0046] Specifically, the user data may be patient health information, and the user data is converted into at least one data block, which is a two-dimensional matrix, wherein the size BSize of the data block may be calculated by the following formula:

[0047] BSize=(N×8)*(N×8)where N≥1

[0048] The number of data blocks TotNoBlocks can be calculated using the following formula:

[0049] TotNoBlocks=Size of PHI / Bsize

[0050] Where N is the number of rows, Size is the total amount of user data, PHI represents user data, and Bsize is the size of the data block.

[0051] The initial key can be selected from a public deoxyribonucleic acid (DNA) sequence. There are about 163 million public DNA sequences. Therefore, the probability of an attacker cracking the key is very small. The user data is encrypted based on the initial key, thereby further improving the security of the data. The initial key of each data block extracted from the DNA sequence can be a DNA fragment of any sequence segment selected from the DNA sequence as the initial key, or a row array, a column array and a mutation array are extracted from the DNA sequence as the initial key according to the size of the data block or the index of the user data determined by the user.

[0052] Among them, the following methods can be used to extract row arrays, column arrays and mutation arrays from the DNA sequence as the initial key: determine the row array and column array of the data block according to the number of rows and columns of the two-dimensional matrix; map the deoxyribonucleic acid sequence to the row array and column array respectively based on the conversion rule; generate a mutation array according to the row array and column array; and use the row array, column array and mutation array as the initial key of the data block.

[0053] Specifically, the row array of the data block is determined according to the number of rows of the two-dimensional matrix, that is, the row array is an array of multiple rows and one column, and the column array is an array of multiple columns and one row. The conversion rules can be shown in the following table:

[0054] R-1 R-2 R-3 R-4 R-5 R-6 R-7 R-8 A 00 00 01 01 10 10 11 11 C 01 10 11 00 11 00 10 01 G 10 01 00 11 00 11 01 10 T 11 11 10 10 01 01 00 00

[0055] In the table above, the possible letters of the DNA sequence are only A, C, G and T, which represent the four nucleotides that make up DNA, namely adenine, cytosine, guanine and thymine. Each letter represents a base, and two bases form a base pair. The pairing rule of base pairs is fixed, that is, AT and CG. Typically, they are arranged together without spacing, such as the sequence AAAGTCTGAC. Any string of nucleotides greater than 4 is called a sequence. In binary, 0 and 1 are complementary, so 00 and 11 are complementary, and 01 and 10 are also complementary. Therefore, the four base pairs of A, C, G, and T are used to encode 00, 01, 10, and 11.

[0056] In the embodiment of the present application, the row array can be represented by RowArray, the column array can be represented by ColumnArray, the mutation array can be represented by MutationArray, and the following algorithm can be used to extract the row array, column array and mutation array from the DNA sequence:

[0057]

[0058]

[0059] Wherein, Data(SSize) represents the input user data, and DNA Sequence represents the DNA sequence. Wherein, the mutation array MutationArray can be obtained by performing a bitwise XOR operation on the data in the row array and the data in the column array.

[0060] After obtaining the initial key, the key of each data block can be generated in the following manner: perform logical XOR operations on the two-dimensional matrix and the row array, and on the two-dimensional matrix and the column array, respectively, to obtain the first target row array and the first target column array; perform a XOR operation on the first target row array and the first target column array, and then perform a circular right rotation to obtain the second target row array; perform a XOR operation on the second target row array and the mutation array, and then perform a circular right rotation to obtain the third target row array; perform a XOR operation on the first target column array and the mutation array, and obtain the second target column array; use the third target row array and the second target column array of each data block as the key of each data block.

[0061] Specifically, an XOR operation is performed between each data block and the row array and the column array, a logical XOR operation is performed between the bits of the row array and the bits of the corresponding data block to obtain a first target row array, and a logical XOR operation is performed between the bits of the column array and the bits of the corresponding data block to obtain a first target column array.

[0062] Furthermore, for each data block, a unique "RowArray" and "ColumnArray" are required. These new "RowArray" and "ColumnArray" arrays can be generated using "MutationArray". At this level, an XOR operation is performed between each bit of the first target row array RowArray and the corresponding bit of the first target column array ColumnArray, and then, determined by the dimension x of the chaotic map, a circular right rotation of any number of bits is performed to generate the second target row array RowArray. Subsequently, an XOR operation is performed between the second target row array RowArray and the mutation array MutationArray, followed by a circular right rotation of any number of bits to generate a unique "newRowArray" (third target row array) for the data block. Similarly, the number of arbitrary bits of circular right rotation is determined by the dimension y of the chaotic map. The second target column array "newcolumnArray" is generated by performing an XOR operation on the mutation array MutationArray and the first target column array ColumnArray, thereby using the third target row array and the second target column array as the key for each data block. In this way, by selecting the initial key from the DNA sequence and generating the key according to the initial key, the difficulty of cracking the key is increased, and the security of the data is further improved.

[0063] Furthermore, the encryption performance provided by the embodiments of the present application can also be analyzed:

[0064] First, the memory of the terminal device is limited, so memory analysis is necessary. The total size of keys required for the key can be calculated by the following formula:

[0065]

[0066] In the above formula, Size of blocks represents the size of the data block, and Number of Keys represents the key.

[0067] Secondly, encryption time is an important parameter for comparing lightweight encryption algorithms. Encryption time is the total time required to encrypt data. Encryption and decryption time should be shorter to make the encryption system lightweight.

[0068] Then, information entropy is the degree of uncertainty of the data. The higher the value of information entropy, the better, because it is difficult to predict the content of the data. The calculation formula of information entropy IE is as follows:

[0069]

[0070] where L is the total number of distinct data values, It is the xth i The probability of data.

[0071] Finally, avalanche effect analysis, the main purpose of this analysis is to check the strength of the key against brute force attacks. A small change in the data or key should change most of the encrypted data. A good encryption scheme should have an avalanche effect greater than 50%. The calculation formula for avalanche effect AE (%) is as follows:

[0072]

[0073] Thus, through the above-mentioned indicators, the encryption scheme provided by the embodiment of the present application is analyzed, the key of the embodiment of the present application requires less memory, consumes less memory, and takes less time to encrypt, making the encryption more lightweight. The information entropy is high, so it is difficult to predict the content of the encrypted user data, and the data security is good. The avalanche effect is higher than 50%, indicating that the key has a high strength against brute force attacks, which further ensures the security of user data.

[0074] Corresponding to the data access method provided in the above embodiment, based on the same technical concept, the embodiment of the present application also provides a data access device, Figure 2 A schematic diagram of the module composition of a data access device provided in an embodiment of the present application, wherein the data access device is used to execute Figure 1 Describes data access methods such as Figure 2As shown, the data access device 200 includes: a receiving module 201, used to receive an access request from a user to be verified, the access request is used to request access to target encrypted data; a verification module 202, used to verify the identity of the user to be verified in response to the access request; a determination module 203, used to determine the first data pointer of the target encrypted data when the verification is successful; the determination module 203 is also used to determine the anonymous target file corresponding to the target encrypted data based on the first data pointer; and a sending module is used to send the anonymous target file to the user to be verified.

[0075] It can be seen from the technical solution provided by the above embodiments of the present application that the identity of the user to be verified is verified by receiving an access request from the user to be verified and then responding to the access request. If the verification is successful, the first data pointer of the target encrypted data is determined, and then the anonymous target file corresponding to the target encrypted data is determined based on the first data pointer, and finally the anonymous target file is sent to the user to be verified. In this way, by verifying the identity of the user to be verified, access to the data is allowed only after the verification is successful, thereby avoiding the problem of data leakage caused by illegal users accessing the data; and the target encrypted data to be accessed is the anonymous target file corresponding to the target encrypted data determined by the first data pointer, and the anonymous target file is sent to the user, thereby avoiding directly sending the original data to the user, and further improving the security of user access to data.

[0076] In a possible implementation, the determination module 203 is also used to determine the second data pointer of the target encrypted data when the user to be verified is a first type of user, the first data pointer corresponds to the first type of user, and the second data pointer corresponds to the second type of user; based on the mapping relationship between the first data pointer and the second data pointer, determine the first data pointer corresponding to the second data pointer.

[0077] In a possible implementation, it also includes: an acquisition module, used to acquire user data to be encrypted and a public deoxyribonucleic acid sequence; a conversion module, used to convert the user data into at least one data block, the data block is a two-dimensional matrix; a generation module, used to generate an initial key for each data block according to the public deoxyribonucleic acid sequence; the generation module is also used to generate a key for each data block according to the initial key of each data block; an encryption module, used to encrypt the user data using the key to obtain encrypted data.

[0078] In a possible implementation, the generation module is further used to determine the row array and column array of the data block according to the number of rows and columns of the two-dimensional matrix; map the deoxyribonucleic acid sequence to the row array and column array respectively based on the conversion rule; generate a mutation array according to the row array and column array; and use the row array, column array and mutation array as the initial key of the data block.

[0079] In a possible implementation, the generation module is further used to perform logical XOR operations on the two-dimensional matrix and the row array, and on the two-dimensional matrix and the column array, respectively, to obtain a first target row array and a first target column array; perform a circular right rotation after performing an XOR operation on the first target row array and the first target column array, to obtain a second target row array; perform a circular right rotation after performing an XOR operation on the second target row array and the mutation array, to obtain a third target row array; perform an XOR operation on the first target column array and the mutation array, to obtain a second target column array; and use the third target row array and the second target column array of each data block as the key of each data block.

[0080] In a possible implementation, the acquisition module is also used to obtain the identity identification and pseudo-identity information of the user to be registered, and the pseudo-identity information is determined by the password of the user to be registered and a random number; the determination module 203 is also used to determine the public key of the user to be registered based on the pseudo-identity information and the password; determine the first identity parameter based on the identity identification and the password, and determine the second identity parameter based on the first identity parameter and the pseudo-identity information; send a smart card to the user to be registered to complete the registration, and the smart card includes a public key, a random number, a password, a first identity parameter and a second identity parameter.

[0081] In one possible implementation, the verification module 202 is also used to obtain the verification parameters carried in the access request; extract the identity identifier and password of the user to be verified from the verification parameters; calculate the first identity parameters of the user to be verified based on the identity identifier and password; and confirm that the user to be verified has passed the verification if there is a first identity parameter matching the first identity parameter of the user to be verified in the registration library.

[0082] The data access device provided in the embodiment of the present application can implement each process in the embodiment corresponding to the above-mentioned data access method, and has the same or similar beneficial effects. To avoid repetition, it will not be described here.

[0083] It should be noted that the data access device provided in the embodiment of the present application and the data access method provided in the embodiment of the present application are based on the same application concept, so the specific implementation of this embodiment can refer to the implementation of the aforementioned data access method, and has the same or similar beneficial effects, and the repeated parts will not be repeated.

[0084] Corresponding to the data access method provided in the above embodiment, based on the same technical concept, the embodiment of the present application also provides an electronic device, which is used to execute the above data access method. Figure 3 A schematic diagram of the structure of an electronic device for implementing each embodiment of the present application is shown in FIG. Figure 3As shown. The electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors 301 and memory 302, and the memory 302 may store one or more storage applications or data. Among them, the memory 302 may be a temporary storage or a permanent storage. The application stored in the memory 302 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the electronic device.

[0085] Furthermore, the processor 301 can be configured to communicate with the memory 302 to execute a series of computer executable instructions in the memory 302 on the electronic device. The electronic device can also include one or more power supplies 303, one or more wired or wireless network interfaces 304, one or more input and output interfaces 305, and one or more keyboards 306.

[0086] Specifically in this embodiment, the electronic device includes a processor, a communication interface, a memory and a communication bus; wherein the processor, the communication interface and the memory communicate with each other through the bus; the memory is used to store computer programs; the processor is used to execute the programs stored in the memory to achieve the above Figure 1 The various steps in the method embodiment are similar to those in the method embodiment, and have the beneficial effects of the above method embodiments. To avoid repetition, the embodiments of the present application will not be described again here.

[0087] This embodiment also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the above Figure 1 Each step in the method embodiment has the beneficial effects of the above method embodiments. To avoid repetition, the embodiments of the present application will not be described again here.

[0088] The present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the above Figure 1 Each step in the method embodiment has the beneficial effects of the above method embodiments. To avoid repetition, the embodiments of the present application will not be described again here.

[0089] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0090] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0091] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0092] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0093] In a typical configuration, an electronic device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0094] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0095] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0096] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0097] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0098] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A data access method, characterized in that: The data access method comprises: receiving an access request from a user to be authenticated, the access request being used to request access to target encrypted data; In response to the access request, verifying the identity of the user to be verified; If the verification is successful, determining a first data pointer of the target encrypted data; Determine an anonymous target file corresponding to the target encrypted data according to the first data pointer; The anonymous target file is sent to the user to be authenticated.

2. The data access method according to claim 1, characterized in that: In the case where the verification is passed, determining the first data pointer of the target encrypted data includes: In a case where the user to be verified is a user of the first type, determining a second data pointer of the target encrypted data, the first data pointer corresponding to the user of the first type, and the second data pointer corresponding to the user of the second type; According to the mapping relationship between the first data pointer and the second data pointer, a first data pointer corresponding to the second data pointer is determined.

3. The data access method according to claim 1 or 2, characterized in that: Before receiving the access request of the user to be authenticated, the method further includes: Obtaining user data to be encrypted and public DNA sequences; Convert the user data into at least one data block, wherein the data block is a two-dimensional matrix; generating an initial key for each of the data blocks according to the public deoxyribonucleic acid sequence; Generating a key for each of the data blocks according to an initial key for each of the data blocks; The user data is encrypted using the key to obtain encrypted data.

4. The data access method according to claim 3, characterized in that: Generating the initial key of each data block according to the public deoxyribonucleic acid sequence includes: Determine the row array and column array of the data block according to the number of rows and columns of the two-dimensional matrix; Mapping the deoxyribonucleic acid sequence to the row array and the column array respectively based on a conversion rule; Generate a mutation array according to the row array and the column array; The row array, the column array and the mutation array are used as initial keys of the data block.

5. The data access method according to claim 4, characterized in that: Generating the key of each data block according to the initial key of each data block comprises: Performing logical exclusive OR operations on the two-dimensional matrix and the row array, and on the two-dimensional matrix and the column array, respectively, to obtain a first target row array and a first target column array; Performing an XOR operation on the first target row array and the first target column array and then performing a circular right rotation to obtain a second target row array; Performing an XOR operation on the second target row array and the mutation array and then performing a circular right rotation to obtain a third target row array; Performing an XOR operation on the first target column array and the mutation array to obtain a second target column array; The third target row array and the second target column array of each data block are used as the key of each data block.

6. The data access method according to claim 1, characterized in that: Before receiving the access request of the user to be authenticated, the method further includes: Obtaining an identity identifier and pseudo identity information of the user to be registered, wherein the pseudo identity information is determined by a password and a random number of the user to be registered; Determine the public key of the user to be registered according to the pseudo identity information and the password; Determine a first identity parameter according to the identity identifier and the password, and determine a second identity parameter based on the first identity parameter and the pseudo identity information; Sending a smart card to the user to be registered to complete the registration, the smart card including the public key, the random number, the password, the first identity parameter and the second identity parameter.

7. The data access method according to claim 6, characterized in that: The verifying the identity of the user to be verified includes: Obtaining verification parameters carried in the access request; Extracting the identity identifier and password of the user to be authenticated from the authentication parameters; Calculate the first identity parameter of the user to be authenticated according to the identity identifier and password; In the case that there is a first identity parameter matching the first identity parameter of the user to be authenticated in the registration database, it is confirmed that the user to be authenticated has passed the authentication.

8. A data access device, characterized in that: include: A receiving module, used for receiving an access request from a user to be verified, wherein the access request is used for requesting access to target encrypted data; A verification module, configured to verify the identity of the user to be verified in response to the access request; A determination module, used to determine a first data pointer of the target encrypted data if the verification is passed; The determination module is further used to determine the anonymous target file corresponding to the target encrypted data according to the first data pointer; A sending module is used to send the anonymous target file to the user to be verified.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus; wherein the processor, the communication interface and the memory communicate with each other through the communication bus; the memory is used to store computer programs; the processor is used to execute the programs stored in the memory to implement the data access method steps as described in any one of claims 1-7.

10. A computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer is caused to execute the steps of the data access method as described in any one of claims 1 to 7.

Images