A data updating method, device and equipment

Abstract

The present invention provides a data updating method, device and equipment. The method comprises: obtaining certificate data; performing format conversion on the certificate data to obtain an index identifier; encrypting the certificate data to obtain an encrypted data packet; updating first pre-stored data according to the index identifier and the encrypted data packet to obtain first update data; updating second pre-stored data according to the first update data to obtain target update data. The present invention obtains certificate data, performs format conversion on the certificate data to obtain an index identifier, encrypts the certificate data to obtain an encrypted data packet, updates the first pre-stored data according to the index identifier and the encrypted data packet to obtain the first update data, and then updates the second pre-stored data according to the first update data to obtain the target update data. The certificate data can be updated in a timely manner, and has the advantages of high updating efficiency and high security.

Description

Technical Field

[0001] The present invention relates to the field of information processing technology, and also to a data updating method, device and equipment. Background Art

[0002] With the development of domestic information technology, the verification of certificate chains has become a necessary measure to ensure the feasibility and security of digital certificates. Due to the large number of certificate issuing authorities and certain differences in technology and business specifications, in order to avoid clients trusting questionable certificates, the certificate chain needs to be updated in a timely manner. The existing certificate chain update method has the problems of low efficiency and untimely updates, which will cause some risky or controversial certificates that should have been removed from the shelves to be trusted by clients due to the above problems that have not been revoked in time, which greatly affects the security of data. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a data updating method, device and equipment, which can update the certificate data in time, thus improving the efficiency and security of certificate data updating.

[0004] In order to solve the above technical problems, the technical solution of the present invention is as follows:

[0005] A first aspect of the present invention provides a data updating method, comprising:

[0006] Get certificate data;

[0007] Convert the certificate data into a format to obtain an index identifier;

[0008] Encrypting the certificate data to obtain an encrypted data packet;

[0009] The first pre-stored data is updated according to the index identifier and the encrypted data packet to obtain first updated data;

[0010] The second pre-stored data is updated according to the first update data to obtain target update data.

[0011] Optionally, the certificate data is formatted to obtain an index identifier, including:

[0012] Performing binary conversion on the certificate data to obtain binary data;

[0013] Performing hash value calculation on the binary data to obtain a hash value;

[0014] The hash value is formatted to obtain an index identifier.

[0015] Optionally, encrypting the certificate data to obtain an encrypted data packet includes:

[0016] Obtaining a key and a data vector according to the certificate data;

[0017] Obfuscating the key and the data vector to obtain obfuscated data;

[0018] An encrypted data packet is obtained according to the obfuscated data and the certificate data.

[0019] Optionally, obtaining a data vector according to the certificate data includes:

[0020] Preprocessing the certificate data to obtain preprocessed data;

[0021] Performing feature extraction on the preprocessed data to obtain feature data;

[0022] The characteristic data is converted into numerical values ​​to obtain a data vector.

[0023] Optionally, performing obfuscation processing on the key and the data vector to obtain obfuscated data includes:

[0024] Performing expansion processing on the key to obtain an expanded key;

[0025] Performing transformation processing on the data vector to obtain a transformation vector;

[0026] Performing a permutation process on the extended key and the transformation vector to obtain permutation data;

[0027] The replacement data is obfuscated to obtain obfuscated data.

[0028] Optionally, updating the first pre-stored data according to the index identifier and the encrypted data packet to obtain first updated data includes:

[0029] The index status table in the first pre-stored data is updated according to the index identifier to obtain an updated index status table;

[0030] updating the revocation status table in the first pre-stored data according to the encrypted data packet to obtain an updated revocation status table;

[0031] First update data is obtained according to the updated index status table and the updated revocation status table.

[0032] Optionally, updating the second pre-stored data according to the first update data to obtain target update data includes:

[0033] Obtaining data to be updated according to the target index identifier in the second pre-stored data and the index table in the first update data;

[0034] The second pre-stored data is updated according to the data to be updated to obtain target updated data.

[0035] A second aspect of the present invention provides a data updating device, comprising:

[0036] Acquisition module, used to obtain certificate data;

[0037] A processing module is used to convert the format of the certificate data to obtain an index identifier; encrypt the certificate data to obtain an encrypted data packet; update the first pre-stored data according to the index identifier and the encrypted data packet to obtain first update data; update the second pre-stored data according to the first update data to obtain target update data.

[0038] According to a third aspect of the present invention, a computing device is provided, comprising: a processor and a memory storing a computer program, wherein when the computer program is executed by the processor, the method according to the first aspect is executed.

[0039] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions, which, when executed on a computer, causes the computer to execute the method described in the first aspect.

[0040] The above solution of the present invention includes at least the following beneficial effects:

[0041] The above-mentioned scheme of the present invention obtains certificate data, converts the format of the certificate data, obtains an index identifier, encrypts the certificate data, obtains an encrypted data packet, updates the first pre-stored data according to the index identifier and the encrypted data packet, obtains the first update data, and then updates the second pre-stored data according to the first update data to obtain the target update data. The certificate data can be updated in a timely manner and has the advantages of high update efficiency and high security. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 is a flow chart of a data updating method in an embodiment of the present invention;

[0043] Figure 2 is a flowchart of a specific embodiment of the data updating method in the embodiment of the present invention;

[0044] Figure 3 It is a structural diagram of a data updating device in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0046] like Figure 1 As shown, an embodiment of the present invention provides a data updating method, comprising the following steps:

[0047] Step 101, obtaining certificate data;

[0048] Step 102, converting the format of the certificate data to obtain an index identifier;

[0049] Step 103, encrypting the certificate data to obtain an encrypted data packet;

[0050] Step 104, updating the first pre-stored data according to the index identifier and the encrypted data packet to obtain first updated data;

[0051] Step 105: Update the second pre-stored data according to the first update data to obtain target update data.

[0052] The data updating method of the embodiment of the present invention obtains certificate data, converts the format of the certificate data to obtain an index identifier, encrypts the certificate data to obtain an encrypted data packet, updates the first pre-stored data according to the index identifier and the encrypted data packet to obtain first update data, and then updates the second pre-stored data according to the first update data to obtain target update data. The certificate data can be updated in a timely manner and has the advantages of high updating efficiency and high security.

[0053] In an optional embodiment of the present invention, the certificate data in step 101 includes:

[0054] Certificates and certificate revocation lists provided by certificate authorities.

[0055] Specifically, the certificate authority (CA) can also be a manufacturer, and the certificate revocation list (CRL) is a list of revoked digital certificates maintained by the certificate authority. By processing certificates and certificate revocation lists and timely updating pre-stored data (including pre-stored certificates and pre-stored certificate revocation lists), certificate security and data security issues caused by revoked certificates still being trusted by users can be avoided, thereby improving data security.

[0056] In an optional embodiment of the present invention, step 102 includes:

[0057] Step 1021, performing binary conversion on the certificate data to obtain binary data;

[0058] Specifically, the certificate data can be converted into binary data by searching for the encoding value of the certificate data in a preset encoding method and converting the encoding value into binary form. The preset encoding method can be determined according to the data type and structure of the certificate data. The data type can be any type of text, number, image, audio, etc., and the data structure can involve simple values, arrays, objects, or more complex nested structures. Converting the certificate data into binary data facilitates the subsequent encryption and indexing of the certificate data, facilitates searching, and improves processing efficiency.

[0059] Step 1022, performing hash value calculation on the binary data to obtain a hash value;

[0060] Specifically, the binary data is first padded to obtain padded data, the length of which is an integer multiple of 512 bits; the padding method is to first add a 1-bit 1, then add several 0 bits, until the data length difference is 64 bits, and finally fill in a 64-bit number to represent the length of the original binary data. The padded data is then divided into multiple 512-bit (64-byte) data blocks; four 32-bit registers A, B, C, and D are used, which are initialized to specific values: A=0x67452301, B=0xEFCDAB89, C=0x98BADCFE, and D=0x10325476; each data block and the four registers are input into the compression function, and the compression function is used to perform circular shift, logical AND, logical OR, logical XOR, and addition operations (these operations are combined with a 32-bit constant K (the value of K changes in each iteration) and the current data block to modify the hash state) for iteration (a total of 64 iterations); after 64 iterations, the values ​​of A, B, C, and D are updated to the new hash state; after processing all the data blocks, the values ​​of A, B, C, and D are concatenated to form a 128-bit hash value.

[0061] Step 1023: format the hash value to obtain an index identifier.

[0062] Specifically, the 128-bit hash value is converted into a 32-bit hexadecimal string, namely the index identifier. This index identifier is the identifier of the certificate data, and the corresponding certificate data can be found through the index identifier. It should be noted that the certificate data of each manufacturer or certificate authority has a unique and non-repetitive index identifier to ensure the accuracy of data search and update.

[0063] In an optional embodiment of the present invention, step 103 includes:

[0064] Step 1031, obtaining a key and a data vector according to the certificate data;

[0065] Specifically, the certificate data is converted into binary data and a key is generated from the binary data using a preset hash algorithm. At the same time, the certificate data also needs to be converted into a data vector to facilitate subsequent encryption of the certificate data according to the key and data vector, thereby improving data security.

[0066] Step 1032, performing obfuscation processing on the key and the data vector to obtain obfuscated data;

[0067] Specifically, obfuscating keys and data vectors is an important step in increasing security during the encryption process. The purpose of obfuscation is to make the relationship between keys and vectors complex and unpredictable, thereby increasing the difficulty for attackers to crack encryption and improving the security of data storage.

[0068] Step 1033: Obtain an encrypted data packet according to the obfuscated data and the certificate data.

[0069] Specifically, the obfuscated data is added to the certificate data to generate a final encrypted data packet for storage, so as to facilitate the subsequent finding of the corresponding encrypted data packet according to the index identifier for data transmission and update.

[0070] In an optional embodiment of the present invention, obtaining a data vector according to the certificate data in step 1031 includes:

[0071] Step 10311, preprocessing the certificate data to obtain preprocessed data;

[0072] Specifically, the preprocessing of certificate data includes: cleaning data, removing irrelevant information, missing values, outliers, etc.; data conversion, converting non-numeric data (such as text, date, etc.) into numeric data; feature selection, selecting the most useful features or attributes from the certificate data. The preprocessed data is obtained by preprocessing to improve the effectiveness of the subsequent data vector and encryption of the certificate data.

[0073] Step 10312, extracting features from the preprocessed data to obtain feature data;

[0074] Specifically, features are extracted from the preprocessed data to obtain feature data, which may include subject information, serial number, type, validity period, etc.

[0075] Step 10313, convert the feature data into numerical values ​​to obtain a data vector.

[0076] Specifically, the feature data is processed as follows to convert it into numerical features: discretization. For discrete features, you can directly use their category labels (usually integers or strings); standardization. For continuous features, standardization is required, such as scaling the feature value to between 0 and 1, or converting it to a standard score; encoding. For categorical features, you can use One-Hot Encoding or Label Encoding to convert it into a numerical vector. Finally, the numerical features are combined into a vector, namely a data vector, and each element of this data vector corresponds to the value of a feature.

[0077] In this embodiment, for string information such as the subject name, a hash function can be used to convert it into a fixed-length digital vector, or other string encoding methods (such as one-hot encoding, etc.) can be used to convert the string into a digital sequence; the validity start date and expiration date are converted into a timestamp or date sequence, and the timestamp or date sequence can be further processed into two independent digital vectors; the certificate type is converted into a digital code or identifier, which can be encoded using an enumeration value or a bit mask; for a purely digital serial number, it can be used directly as a digital vector; the subject information vector, serial number vector, type vector and validity period vector that have been numerically converted are concatenated into a complete data vector; if the lengths of the data vectors are inconsistent, padding or truncation is required to ensure that all vectors have the same length, and the data can also be normalized to improve the effect of subsequent processing.

[0078] In an optional embodiment of the present invention, step 1032 includes:

[0079] Step 10321, performing expansion processing on the key to obtain an expanded key;

[0080] Specifically, the key may be expanded into a longer key sequence by using a hash function or a nonlinear transformation, etc. For example, the key may be hashed using a SHA-256 hash function to obtain a 256-bit hash value as the extended key.

[0081] Step 10322, transform the data vector to obtain a transformation vector;

[0082] Specifically, it is necessary to select a basis, i.e., a standard basis (i.e., a unit vector on each coordinate axis), for the vector space V where the data vector is located and the vector space W where the transformation vector is located; determine the transformation matrix F according to the standard basis; multiply the coordinate vector of the data vector by the transformation matrix F to obtain the coordinate vector of the transformation vector. That is, if v is the coordinate vector of the data vector, then Fv is the coordinate vector w of the transformed vector. The transformation process can change the spatial distribution and statistical characteristics of the data vector, making it more difficult to predict and improving the encryption effect.

[0083] Step 10323, performing permutation processing on the extended key and the transformation vector to obtain permuted data;

[0084] Specifically, a pseudo-random number generator can be used to generate a permutation sequence, and then the extended key is permuted according to the sequence to scramble the positions of the elements in the extended key to obtain a permuted key; and a permuted vector is obtained by multiplying a preset permutation matrix by a transformation vector. The permutation data includes the permuted key and the permuted vector.

[0085] Step 10324, obfuscate the replacement data to obtain obfuscated data.

[0086] Specifically, the permuted key is XORed with a randomly generated mask to obtain the final obfuscated key. The reversibility of the XOR operation ensures that the same mask and inverse permutation sequence can be used to restore the original key during decryption. The permuted vector is encrypted using the obfuscated key to obtain obfuscated data. Obfuscated data is encrypted data that can be restored through decryption operations.

[0087] In an optional embodiment of the present invention, step 104 includes:

[0088] Step 1041, updating the index status table in the first pre-stored data according to the index identifier to obtain an updated index status table;

[0089] Specifically, the first pre-stored data is the certificate data of each manufacturer stored on the server side. The first pre-stored data includes an index table and multiple unit data (each unit data corresponds to the certificate data of a manufacturer). The index table includes a data index status table (including manufacturer name, update time, index identifier) ​​and a data revocation status table (including manufacturer name, time, revocation data type, object serial number, revocation time, and revocation reason). The corresponding existing unit data can be found through the existing index identifier in the data index status table. If the new index identifier does not exist in the data index status table, it is added to the data index status table to update the index status table.

[0090] Step 1042, updating the revocation status table in the first pre-stored data according to the encrypted data packet to obtain an updated revocation status table;

[0091] Specifically, since the encrypted data packet includes a certificate and a certificate revocation list, if the certificate revocation list does not exist in the revocation status table in the first pre-stored data, the certificate revocation list needs to be added to the revocation status table in the first pre-stored data to update the revocation status table.

[0092] Step 1043: Obtain first update data according to the updated index status table and the updated revocation status table.

[0093] Specifically, after the index status table and the revocation status table in the index table in the first pre-stored data and the unit data in the first pre-stored data are updated, the first updated data is obtained.

[0094] In an optional embodiment of the present invention, step 105 includes:

[0095] Step 1051, obtaining the data to be updated according to the target index identifier in the second pre-stored data and the index table in the first update data;

[0096] Specifically, the second pre-stored data is the same as the first pre-stored data, both including an index table (including a data index status table and a data revocation status table) and unit data, but the second pre-stored data is certificate data stored on the client. When updating it, it is necessary to compare the target index identifier in the index table in the second pre-stored data with the index identifier in the index table in the first updated data. If they are different, find the different parts according to the index table in the first updated data, such as the index identifier in the index status table, the revocation data type in the revocation status table, etc., as the data to be updated, so as to facilitate the subsequent fast and accurate updating of the second pre-stored data.

[0097] Step 1052: Update the second pre-stored data according to the data to be updated to obtain target updated data.

[0098] Specifically, the data to be updated is the data that is inconsistent between the second pre-stored data and the first updated data. The second pre-stored data is updated according to the inconsistent data. If there is an index identifier M in the index table in the first updated data, but there is no index identifier M in the index table in the second pre-stored data, then the index identifier M is the data to be updated; the unit data corresponding to the index identifier M is downloaded to the client, and the index identifier M is added to the second pre-stored data to implement the update of the second pre-stored data. Similarly, the second pre-stored data can be updated by addition, deletion, modification, etc., and processed according to the actual situation to improve accuracy.

[0099] like Figure 2 As shown, a specific embodiment of the data updating method of the embodiment of the present invention includes:

[0100] Step 111, obtaining certificate data;

[0101] Certificate data includes certificates or certificate revocation lists (CRLs) provided by multiple certificate authorities (CAs) or vendors.

[0102] Step 112, determining the index identifier;

[0103] A unit index entry (i.e., index identifier) ​​is created based on the manufacturer name, current time, and certificate or certificate revocation list. The certificate data packet can be converted into an octet string sequence encoding, and the index identifier is calculated using a preset hash algorithm to facilitate the subsequent addition of the index identifier to the index table on the server.

[0104] Step 113, encrypting the certificate data into an encrypted data packet;

[0105] The octet string sequence encoding converted from the certificate data packet is encrypted. The encryption rule is to perform hash calculation on the sequence encoding to form a key and a vector, and then encrypt the key and the vector after obfuscation operation. The generated ciphertext is added to the certificate data packet to form the final encrypted data packet.

[0106] Step 114, updating the first pre-stored data;

[0107] All index identifiers are added to the data index status table of the index table. When new index identifiers are added later, they will also be added to the existing data index status table for update; each index identifier corresponds to a unit data (i.e., an encrypted data packet), such as index identifier M corresponds to unit data M of manufacturer M. Among them, the index table is protected by an asymmetric signature algorithm to prevent tampering, and the unit data is encrypted by a symmetric algorithm to prevent leakage and increase transmission security. The service address of the certificate revocation list provided by the manufacturer can also be stored in the unit data to make up for the problem that the revocation status of the certificate cannot be queried when the manufacturer has not deployed an external certificate revocation list service. The generated index table and unit data can be uploaded to the server, and the data itself is signed and encrypted, so the security requirements for the transmission channel can be reduced.

[0108] Here, the index table includes the data type (such as certificate or certificate revocation list), the timestamp of the last update, the timestamp of the next update, the generation timestamp (the timestamp of unit data generation), the data index status table of each manufacturer and the data revocation status table of each manufacturer; the data index status table includes: manufacturer name, update time, index identifier; the data revocation status table includes: manufacturer name, time, revocation data type (such as certificate or certificate revocation list), object serial number, revocation time, and revocation reason.

[0109] Step 115: Update the second pre-stored data.

[0110] The updating of the second pre-stored data mainly includes the incremental updating of the client data and the decremental updating of the client data.

[0111] Client data incremental update: First download the index table in the first update data and verify the signature.

[0112] According to the index table in the first updated data, check if the certificate data (i.e., unit data) in the first updated data does not exist locally (the second pre-stored data), then download the unit data packet according to the index identifier of each node in the index table, decrypt the unit data packet, and the decryption rule is consistent with the encryption rule. At the same time, modify the last update time of the server-side index table to the current time, and modify the next update time to a specified future time, which can be used as a credential to trigger automatic update. The index table and data packet are encoded and compressed into a full amount of data and saved in the second pre-stored data.

[0113] According to the index table in the first update data, if there is certificate data (i.e. unit data) locally (second pre-stored data), it is necessary to compare each node in the index table, mainly the manufacturer name. If the index identifier of the local data is inconsistent with the index identifier of the server, it is necessary to download and decrypt the unit data and overwrite the local data; for newly added manufacturers, the unit data is directly written to the local data package. Trust certificates can be added manually, and the certificate is saved in the local data package as an unprotected item.

[0114] Client data reduction and update: First, the server's index table needs to add a revocation item. After receiving the index table, the client synchronizes the revocation item to the index of the local data packet, and searches for the revocation target in the local data packet according to the revocation status and deletes it from the local data packet.

[0115] The next update time in the local data package can be used as a basis for automatically executing automatic updates. Each update compares the current time and the next update time. Automatic updates are triggered when the current time is greater than the next update time.

[0116] The data updating method of the embodiment of the present invention realizes the increase and decrease of data by comparing the index table, and applies the cryptographic algorithm to keep the data trustworthy and the transmission safe, which has the advantages of improving the security and efficiency of data updating.

[0117] like Figure 3 As shown, an embodiment of the present invention provides a data updating device 200, comprising:

[0118] Acquisition module 201, used to acquire certificate data;

[0119] The processing module 202 is used to convert the format of the certificate data to obtain an index identifier; encrypt the certificate data to obtain an encrypted data packet; update the first pre-stored data according to the index identifier and the encrypted data packet to obtain first update data; update the second pre-stored data according to the first update data to obtain target update data.

[0120] Optionally, the certificate data is formatted to obtain an index identifier, including:

[0121] Performing binary conversion on the certificate data to obtain binary data;

[0122] Performing hash value calculation on the binary data to obtain a hash value;

[0123] The hash value is formatted to obtain an index identifier.

[0124] Optionally, encrypting the certificate data to obtain an encrypted data packet includes:

[0125] Obtaining a key and a data vector according to the certificate data;

[0126] Obfuscating the key and the data vector to obtain obfuscated data;

[0127] An encrypted data packet is obtained according to the obfuscated data and the certificate data.

[0128] Optionally, obtaining a data vector according to the certificate data includes:

[0129] Preprocessing the certificate data to obtain preprocessed data;

[0130] Performing feature extraction on the preprocessed data to obtain feature data;

[0131] The characteristic data is converted into numerical values ​​to obtain a data vector.

[0132] Optionally, performing obfuscation processing on the key and the data vector to obtain obfuscated data includes:

[0133] Performing expansion processing on the key to obtain an expanded key;

[0134] Performing transformation processing on the data vector to obtain a transformation vector;

[0135] Performing a permutation process on the extended key and the transformation vector to obtain permutation data;

[0136] The replacement data is obfuscated to obtain obfuscated data.

[0137] Optionally, updating the first pre-stored data according to the index identifier and the encrypted data packet to obtain first updated data includes:

[0138] The index status table in the first pre-stored data is updated according to the index identifier to obtain an updated index status table;

[0139] updating the revocation status table in the first pre-stored data according to the encrypted data packet to obtain an updated revocation status table;

[0140] First update data is obtained according to the updated index status table and the updated revocation status table.

[0141] Optionally, updating the second pre-stored data according to the first update data to obtain target update data includes:

[0142] Obtaining data to be updated according to the target index identifier in the second pre-stored data and the index table in the first update data;

[0143] The second pre-stored data is updated according to the data to be updated to obtain target updated data.

[0144] The data updating device of the embodiment of the present invention obtains certificate data, converts the format of the certificate data to obtain an index identifier, encrypts the certificate data to obtain an encrypted data packet, updates the first pre-stored data according to the index identifier and the encrypted data packet to obtain first update data, and then updates the second pre-stored data according to the first update data to obtain target update data. The certificate data can be updated in a timely manner and has the advantages of high updating efficiency and high security.

[0145] It should be noted that the device is a device corresponding to the above method, and all implementations in the above method embodiment are applicable to the embodiment of the device and can achieve the same technical effect. This embodiment will not be repeated.

[0146] The embodiment of the present invention further provides a computing device, comprising: a processor, and a memory storing a computer program, wherein when the computer program is executed by the processor, the method described in any one of the above embodiments is executed. All implementations in the above method embodiments are applicable to the embodiments of the device, and can achieve the same technical effects. They will not be described in detail in this embodiment.

[0147] The embodiment of the present invention further provides a computer-readable storage medium on which instructions are stored. When the instructions are executed on a computer, the computer executes the method as described in any one of the above embodiments. All implementations in the above method embodiments are applicable to the embodiments of the device and can achieve the same technical effects. They will not be described in detail in this embodiment.

[0148] It should be noted that in the apparatus and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent solutions of the present invention. In addition, the steps of performing the above series of processes can naturally be performed in chronological order according to the order of description, but do not necessarily need to be performed in chronological order. Some steps can be performed in parallel, crosswise or independently of each other.

[0149] It should be noted that, in the above-mentioned embodiments, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "include one..." do not exclude the existence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the implementation of the above-mentioned embodiments is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in the opposite order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0150] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data updating method, characterized in that: include: Get certificate data; Convert the certificate data into a format to obtain an index identifier; Encrypting the certificate data to obtain an encrypted data packet; The first pre-stored data is updated according to the index identifier and the encrypted data packet to obtain first updated data; wherein the first pre-stored data is the certificate data of each manufacturer stored on the server; the first pre-stored data includes an index table and a plurality of unit data; wherein each unit data corresponds to the certificate data of a manufacturer; the index table includes a data index status table and a data revocation status table; updating the second pre-stored data according to the first update data to obtain target update data; wherein the second pre-stored data is certificate data stored in the client; The certificate data is encrypted to obtain an encrypted data packet, including: According to the certificate data, a key and a data vector are obtained; Obfuscating the key and the data vector to obtain obfuscated data; Obtaining an encrypted data packet according to the obfuscated data and the certificate data; Wherein, according to the certificate data, a data vector is obtained, including: Preprocessing the certificate data to obtain preprocessed data; Performing feature extraction on the preprocessed data to obtain feature data; Performing numerical conversion on the characteristic data to obtain a data vector; The step of performing obfuscation processing on the key and the data vector to obtain obfuscated data includes: Performing an expansion process on the key to obtain an extended key; wherein the key is hashed using a SHA-256 hash function to obtain a 256-bit hash value as the extended key; The data vector is transformed to obtain a transformation vector; wherein a standard basis is determined according to a vector space V where the data vector is located and a vector space W where the transformation vector is located, and the standard basis is a unit vector on each coordinate axis; a transformation matrix F is determined according to the standard basis; and a coordinate vector of the data vector is multiplied by the transformation matrix F to obtain a coordinate vector of the transformation vector; The extended key and the transformation vector are permuted to obtain permuted data; wherein a permutation sequence is generated using a pseudo-random number generator, and the extended key is permuted according to the sequence to obtain a permuted key; the permuted vector is obtained according to the product of a preset permutation matrix and the transformation vector; the permuted data includes the permuted key and the permuted vector; The permuted data is obfuscated to obtain obfuscated data; wherein, the permuted key is XORed with a randomly generated mask to obtain an obfuscated key; and the permuted vector is encrypted using the obfuscated key to obtain obfuscated data.

2. The data updating method according to claim 1, characterized in that: The certificate data is formatted to obtain an index identifier, including: Performing binary conversion on the certificate data to obtain binary data; Performing hash value calculation on the binary data to obtain a hash value; The hash value is formatted to obtain an index identifier.

3. The data updating method according to claim 1, characterized in that: The first pre-stored data is updated according to the index identifier and the encrypted data packet to obtain first updated data, including: The index status table in the first pre-stored data is updated according to the index identifier to obtain an updated index status table; updating the revocation status table in the first pre-stored data according to the encrypted data packet to obtain an updated revocation status table; First update data is obtained according to the updated index status table and the updated revocation status table.

4. The data updating method according to claim 1, characterized in that: Updating the second pre-stored data according to the first update data to obtain target update data includes: Obtaining data to be updated according to the target index identifier in the second pre-stored data and the index table in the first update data; The second pre-stored data is updated according to the data to be updated to obtain target updated data.

5. A data updating device, characterized in that: include: Acquisition module, used to obtain certificate data; A processing module, used for converting the format of the certificate data to obtain an index identifier; Encrypting the certificate data to obtain an encrypted data packet; The first pre-stored data is updated according to the index identifier and the encrypted data packet to obtain the first updated data; the second pre-stored data is updated according to the first updated data to obtain the target updated data; wherein the first pre-stored data is the certificate data of each manufacturer stored on the server; the first pre-stored data includes an index table and a plurality of unit data; wherein each unit data corresponds to the certificate data of a manufacturer; the index table includes a data index status table and a data revocation status table; the second pre-stored data is the certificate data stored on the client; The certificate data is encrypted to obtain an encrypted data packet, including: According to the certificate data, a key and a data vector are obtained; Obfuscating the key and the data vector to obtain obfuscated data; Obtaining an encrypted data packet according to the obfuscated data and the certificate data; Wherein, according to the certificate data, a data vector is obtained, including: Preprocessing the certificate data to obtain preprocessed data; Performing feature extraction on the preprocessed data to obtain feature data; Performing numerical conversion on the characteristic data to obtain a data vector; The step of performing obfuscation processing on the key and the data vector to obtain obfuscated data includes: Performing an expansion process on the key to obtain an extended key; wherein the key is hashed using a SHA-256 hash function to obtain a 256-bit hash value as the extended key; The data vector is transformed to obtain a transformation vector; wherein a standard basis is determined according to a vector space V where the data vector is located and a vector space W where the transformation vector is located, and the standard basis is a unit vector on each coordinate axis; a transformation matrix F is determined according to the standard basis; and a coordinate vector of the data vector is multiplied by the transformation matrix F to obtain a coordinate vector of the transformation vector; The extended key and the transformation vector are permuted to obtain permuted data; wherein a permutation sequence is generated using a pseudo-random number generator, and the extended key is permuted according to the sequence to obtain a permuted key; the permuted vector is obtained according to the product of a preset permutation matrix and the transformation vector; the permuted data includes the permuted key and the permuted vector; The permuted data is obfuscated to obtain obfuscated data; wherein, the permuted key is XORed with a randomly generated mask to obtain an obfuscated key; and the permuted vector is encrypted using the obfuscated key to obtain obfuscated data.

6. A computing device, characterized in that include: A processor and a memory storing a computer program, wherein when the computer program is executed by the processor, the method according to any one of claims 1 to 4 is performed.

7. A computer-readable storage medium, characterized in that: Instructions are stored, and when the instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 4.

Images