A personal data security protection method, an electronic device and a storage medium

Abstract

The application discloses a personal data security protection method, an electronic device and a storage medium, and relates to the technical field of personal data security protection.The method comprises the following steps: 1, a mobile device generates user identity information, including a user master key, a public key and a private key and a user identification code, through a post password module according to user biological feature authentication, the master key and the private key are stored in the mobile device, and the identification code is fed back to the user; 2, the mobile device encrypts the private key by using the master key and the identification code, and sends the public key and the encrypted private key to a cloud backup to complete registration; 3, when a user logs in the mobile device, the user inputs the identification code to obtain the encrypted private key and a random number from the cloud, and after biological feature authentication, the master key is used for decryption and comparison and verification with the local private key; when logging in a new device, the same operation is performed to obtain the decrypted private key storage, the new device generates a new master key to encrypt the private key and sends the private key to the cloud to replace it. The application can realize the safe management of the user key, thereby effectively guaranteeing the user identity security and the user data security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of personal data security protection, in particular to a personal data security protection method, system and device. BACKGROUND

[0002] With the development of computer network communication technology, personal digitalization will play an increasingly important role in future society, and it will become the foundation and core pillar of the digitalization of the entire society, and the change in the scale of the industry it brings will far exceed that of traditional digitalization systems. However, in this process, illegal acquisition, leakage and tampering of personal data often occur. Therefore, how to effectively solve the problem of personal data security has always been a concern. Traditional data security protection is mostly based on a centralized key management system, that is, encrypted data is stored in the hands of service providers, and encryption keys are also in the hands of service providers. However, such a centralized architecture is inherently insecure, on the one hand, data can be arbitrarily used by service providers, and on the other hand, once hacked, it will cause significant losses.

[0003] The current data security architecture mainly includes five parts of identity authentication, data protection, authorization and access control, and log auditing. Among them, identity authentication mainly solves the user login problem, and mostly adopts the username and password login method, but the username and password are easy to forget and are stored in the hands of cloud service providers. Data protection mainly solves the data confidentiality problem, and mostly adopts international or domestic symmetric encryption algorithm, but the key is generated by the key management center and is in the hands of the service provider. Therefore, the user data can be arbitrarily viewed and used by the service provider, which poses a great risk to the user's privacy security. SUMMARY

[0004] The present application is to solve the above-mentioned deficiencies in the prior art, and proposes a personal data security protection method, electronic device and storage medium, in order to realize decentralized private key management and enable the user's private key to be in the user's hands, thereby effectively ensuring the user's identity security and user data security.

[0005] To achieve the above-mentioned application purposes, the following technical solutions are adopted:

[0006] The personal user data security protection method based on a mobile device is characterized in that it is applied to a network environment composed of a mobile device and a cloud server, and includes the following steps:

[0007] S1, the mobile device authenticates the user according to the user's biological characteristics, if the authentication is passed, S2 is executed, otherwise, S1 is returned;

[0008] S2. The cryptographic module on the mobile device generates user identity information, including a user master key, a user public key, a user private key, and a user identification code, and directly stores the user master key and the user private key on the mobile device, and feeds the user identification code back to the corresponding user;

[0009] S3. The mobile device encrypts the user private key based on the user master key to obtain an encrypted first private key pri_key_sec1;

[0010] At the same time, a symmetric key is generated based on the user identification code, which is used to encrypt the user private key and obtain the encrypted second private key pri_key_sec2;

[0011] Finally, the user's public key, the encrypted first private key pri_key_sec1, and the encrypted second private key pri_key_sec2 are sent to the cloud server for backup storage, thus completing the user's identity information registration;

[0012] S4. When the user logs in to the mobile device, he / she enters his / her user identification code and obtains the first encryption private key pri_key_sec1 and the first random number from the cloud server. At the same time, after the user's biometrics are authenticated on the mobile device, the user master key is obtained, and pri_key_sec1 is decrypted to obtain the decrypted first user private key.

[0013] Compare the decrypted first user private key with the locally stored user private key. If they are the same, the verification is successful and S5 is executed; otherwise, return to S4;

[0014] When a user logs in to a new mobile device, after the user's biometrics are authenticated on the mobile device, the user enters his or her own user identification code, which is used to obtain the second encrypted private key pri_key_sec2 and the second random number from the cloud server, and decrypts pri_key_sec2 based on the user identification code to obtain the decrypted second user private key and store it on the new mobile device;

[0015] The cryptographic module on the new mobile device generates a new user master key and stores it on the new mobile device, and then uses the new user master key to encrypt the decrypted second user private key to obtain the encrypted second private key pri_key_sec2' and send it to the cloud server, so that the cloud server replaces pri_key_sec1 with pri_key_sec2';

[0016] S5. Perform strong identity authentication on the user based on digital signature technology. If the authentication is successful, execute S6; otherwise, return to S4.

[0017] S6. The mobile device uses a local password module to generate an encryption key for user data, which is used to encrypt the user data to obtain encrypted user data; then uses the user public key to encrypt the encryption key to obtain an encryption key result, and the user stores the encrypted user data and the encryption key result on a cloud server or mobile device, and obtains a storage path, and finally saves the storage path on the cloud server.

[0018] The personal data security protection method described in the present invention is also characterized in that in S5, the random number is digitally signed in combination with the user's private key and the hash algorithm, and the signature result is sent to the cloud server for verification. If the cloud server uses the public key to decrypt the signature result and compares it with the random number, it means that the signature verification is successful; if the cloud server uses the public key to decrypt the signature result and compares it with the random number, it means that the signature verification fails, thereby completing the user's strong identity authentication.

[0019] The electronic device of the present invention includes a memory and a processor, and is characterized in that the memory is used to store a program that supports the processor to execute the personal data security protection method, and the processor is configured to execute the program stored in the memory.

[0020] The present invention provides a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and the computer program executes the steps of the personal data security protection method when the computer program is run by a processor.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] The present invention achieves secure management of user private keys through mobile devices. Through decentralized storage of user private keys, the user private keys are stored locally on the user's mobile device. Combined with the mobile device's biometric recognition, the private keys can be read, thereby ensuring that the user's private keys are in the hands of the user and ensuring the security of user data. The present invention securely encrypts the user's private keys by designing a user master key. Simultaneously, by designing a user identification code, it securely encrypts the backup of the user's private keys. This ensures that even when the user changes devices, the user is unaware and their identity information can be restored, thereby achieving the goal of being independent of mobile devices and widely applicable. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 Provides a schematic diagram of the overall method flow for an embodiment of the present invention;

[0024] Figure 2 A flowchart of user identity registration provided by an embodiment of the present invention;

[0025] Figure 3A flowchart of user identity authentication provided by an embodiment of the present invention;

[0026] Figure 4 A data storage flow chart provided by an embodiment of the present invention;

[0027] Figure 5 A flowchart of secure data writing provided by an embodiment of the present invention;

[0028] Figure 6 A flowchart of secure data reading provided by an embodiment of the present invention;

[0029] Figure 7 This is a block diagram of the internal units of the system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In this embodiment, Figure 1 As shown, a personal data security protection method is applied in a network environment consisting of a mobile device and a cloud server and is performed in the following steps:

[0031] Step 1: Based on the local biometric recognition of the mobile device, including face and fingerprint, if the device does not support it, gestures can be added to achieve authentication between the user and the mobile device.

[0032] In this embodiment, biometrics based on the local mobile device are used. If the device does not support biometrics, gesture recognition can be added, and fingerprint recognition and face recognition are prioritized. When the mobile device does not support biometrics, gesture authentication recognition is added.

[0033] Step 2: The password module of the mobile device generates user identity information, including: user master key, user public key, user private key, and user identification code. The user master key and user private key are stored locally on the mobile device and can only be read after biometric authentication. The user identification code is saved and memorized by the user.

[0034] In this embodiment, domestic cryptographic algorithms are used, including symmetric algorithm SM4, asymmetric algorithm SM2, and hash algorithm SM3. The symmetric key is 128 bits, the private key is 256 bits, and the public key is 512 bits. The user identification code consists of a 64-bit user master key and a 128-bit secret key. The 128-bit secret key of the user identification code is obfuscated data processed according to specific rules and is memorized and stored by the user. Furthermore, in conjunction with the local file management of the mobile device, the user master key and private key are stored in a keystore file, which is configured to be accessible only after biometric authentication.

[0035] Step 3: The mobile device encrypts the user's private key based on the user master key to obtain the first encrypted private key pri_key_sec1. The user identification code encrypts the user's private key according to a specific rule to obtain the second encrypted private key pri_key_sec2. The user's public key, the first encrypted private key pri_key_sec1, and the second encrypted private key pri_key_sec2 are uploaded to the cloud server for storage, completing user identity registration. The rule definition can be referenced as follows, or the user can define their own: The mobile device's password module generates a 128-bit symmetric key string, with all letters in uppercase. First, replace the numbers in the 128-bit symmetric key string with the following sequence: 0 and 9, 1 and 8, 2 and 7, 3 and 6, and 4 and 5. Finally, replace the letters in the 128-bit symmetric key string with the following sequence: A and Z, BY, C and X, etc. This generates a new 128-bit string. This, combined with the user master key, forms the user identification code, which the user should memorize and keep. During decryption, the above rule is reversed to generate the symmetric key.

[0036] After a user passes biometric authentication and generates their identity, the user's identity information is securely processed. Specifically, the user master key and private key are stored in a keystore, and biometric authentication is required for access. The private key is encrypted using the user master key, referred to as the first encrypted private key pri_key_sec1, and the private key is encrypted using the identification code, referred to as the second encrypted private key pri_key_sec2. The user public key, the first encrypted private key pri_key_sec1, and the second encrypted private key pri_key_sec2 are stored on a cloud server for backup.

[0037] Specifically, the following steps are also included:

[0038] a) Binding the user and the device through biometric identification of mobile devices;

[0039] b) After completing biometric identification, user identity information is generated locally on the mobile device, including the user master key, user public key, user private key, and user identification code;

[0040] c) Securely process the user identity information, use a cryptographic symmetric algorithm, and encrypt the user private key with the user master key, recorded as the first encryption private key pri_key_sec1; use the national secret symmetric algorithm, and encrypt the user private key with the user identification code according to the rules, recorded as the second encryption private key pri_key_sec2.

[0041] Specifically, the user identification code consists of a 64-bit user master key and a 128-bit secret key. The user master key is a system-generated 64-bit UUID string. The 128-bit national secret symmetric key is processed according to specific rules and is memorized by the user and not uploaded to the cloud. The rules can be defined as follows, or the user can define their own: First, the numbers in the 128-bit symmetric key string are replaced by 0 and 9, 1 and 8, 2 and 7, 3 and 6, and 4 and 5. Then, the letters in the 128-bit symmetric key string are replaced by A and Z, BY, C and X, etc. The new 128-bit string plus the user master key is the user identification code. When decrypting the encrypted private key, the cryptographic unit restores the key to obtain a 128-bit key, which is then used to decrypt the second encrypted private key pri_key_sec2.

[0042] d) The user identity information after security processing, including the user public key, the first encrypted private key pri_key_sec1 and the second encrypted private key pri_key_sec2, is backed up in the cloud server.

[0043] Step 4. When the user logs in to the mobile device, he enters the user identification code, obtains the first encrypted private key pri_key_sec1 and the first random number from the cloud server, obtains the user master key based on the biometric authentication of the mobile device, decrypts the first encrypted private key pri_key_sec1, obtains the decrypted first user private key and compares it with the local private key. If they are the same, it means that the verification is passed and step 5 is executed; otherwise, return to step 4.

[0044] When the user logs in to the new mobile device, the user enters the user identification code, obtains the second encrypted private key pri_key_sec2 and the second random number from the cloud server, decrypts the second encrypted private key pri_key_sec2 based on the user identification code, obtains the decrypted second user private key, and stores it on the new mobile device;

[0045] A new user master key is generated on the new mobile device and stored on the new mobile device. The decrypted second user private key is encrypted using the new user master key to obtain the encrypted second private key pri_key_sec2' and send it to the cloud server, so that the cloud server replaces pri_key_sec1 with pri_key_sec2'.

[0046] Step 5. Combine the user private key obtained by decryption and the hash algorithm to digitally sign the random number, and send the signature result to the cloud server for verification. If the cloud server uses the public key to decrypt the signature result and compare it with the random number, it means that the signature verification is successful; if the cloud server uses the public key to decrypt the signature result and compare it with the random number, it means that the signature verification fails, thereby completing the user's strong identity authentication, that is, based on the first layer of biometric authentication of the mobile device, and then based on the comparison of the local private key to perform the second layer of verification authentication, and finally combine the digital signature to achieve the third layer of identity authentication.

[0047] Step 6: Use the local password module of the mobile device to generate a data encryption key to encrypt personal user data, and then use the user's public key to encrypt the encryption key to form encrypted data and encryption key data. The individual user decides whether to store in the cloud or privately, and saves the data storage path on the cloud data directory server.

[0048] When users save personal data, they first select a storage location, including cloud storage and private storage (mobile phone, NAS, etc.), call the domestic cryptographic unit module, generate a data encryption key, encrypt personal user data, and record it as security data. Then, they use the user's public key to encrypt the encryption key, record it as a security key, and upload the security data and security key to the storage space according to the storage location. Then, they return to the storage location and save it on the cloud data directory server.

[0049] When a user reads personal data, the data overview and physical storage location are first returned from the data directory. The security data and security key are downloaded based on the physical storage location. The user's private key is obtained and the security key is decrypted through local biometric identification on the mobile device. The key is used to decrypt the security data and finally obtain the original data.

[0050] like Figure 2 As shown, user identity registration is carried out as follows:

[0051] Step 1. On the login and registration page, select the register button to register your user identity;

[0052] Step 2: Enable the local biometric recognition function of the mobile device. If it is not enabled, the user needs to enter biometric information. If it is already enabled, you can directly call biometric authentication. If the device does not support biometric recognition, you need to add gesture password entry to realize the identity recognition between the user and the device.

[0053] Step 3: After the biometric identification is passed, the domestic cryptographic unit and identity management unit are called to generate the user master key, user public key, user private key, and user identification code, and perform security processing on the user identity data, including encrypting the private key with the master key and the private key with the identification code, and storing the master key and private key in the local keystore;

[0054] Specifically, after biometric recognition and user identity security processing, a user identification code is generated, and the software page reminds the user to remember and save it for the recovery of the user's private key when replacing the device later.

[0055] Step 4: Back up the securely processed user identity information, including the user public key, the first encrypted private key pri_key_sec1, and the second encrypted private key pri_key_sec2, in cloud storage.

[0056] like Figure 3 As shown, user identity authentication is performed as follows:

[0057] Step 1: On the login and registration page, enter the user identification code;

[0058] Step 2. Click the login button to complete user authentication;

[0059] Determine whether the local biometric function of the mobile device is enabled. If it is not enabled, the user is required to enter biometric information; if it is enabled, biometric authentication can be called directly; if the device does not support biometrics, it is necessary to add gesture password entry to realize the identity recognition of the user and the device;

[0060] Step 3: After the biometric identification is passed, the password unit and identity management unit are called for authentication;

[0061] Specifically, determine whether the device has the user master key and user private key locally, that is, whether it is a new device. If so (re-authentication of old device), request to obtain the user encryption private key pri_key_sec1 through the user identification code, and decrypt the user private key through the local master key; if not (new device login), request to obtain the user encryption private key pri_key_sec2 through the user identification code, decrypt it, and then regenerate the master key to encrypt the user private key, and replace the user encryption private key pri_key_sec1 on the cloud server. Finally, strong authentication of user identity is achieved through digital signature.

[0062] like Figure 4As shown in the figure, the personal data storage process defines personal data types, including personal unstructured data, personal structured data, and semi-structured OCR-recognized data. Personal unstructured data is encrypted with a symmetric key and returned to its physical storage location in the data directory. Structured data is converted according to entity objects, generating a JSON file. After symmetric key encryption, it is returned to its physical storage location in the data directory. Semi-structured OCR-recognized data is converted according to entity objects, generating a JSON file. After symmetric key encryption, it is returned to its physical storage location in the data directory. The data storage location can be selected by the user, including public and private cloud storage. Secure data and security keys are packaged for storage and returned to the data's physical storage location.

[0063] like Figure 5 As shown, the personal data security writing process is as follows:

[0064] Step 1: At the current node, call the data directory unit, process personal data according to the personal data storage standard, and encrypt the personal data using the national secret symmetric algorithm to obtain secure data;

[0065] Step 2: Call the cryptographic unit to generate a data encryption symmetric key, and encrypt the symmetric key using the user's public key to obtain a security key;

[0066] Step 3. Select a personal data storage location, public cloud storage or private cloud storage, store the security data and security key together, and return the data to the physical storage location;

[0067] Step 4: Store the physical storage location of the above data in the data directory service to implement the personal data security write process.

[0068] like Figure 6 As shown in the figure, the personal data security reading process is as follows:

[0069] Step 1: At the current node, call the cloud data directory unit to obtain a data overview, including data type, data size, data identifier, data physical storage path, etc.

[0070] Step 2: View the data details and download the data from the storage space to the local device based on the data identifier and the physical storage path of the data, including the security data and security key;

[0071] Step 3: Based on the biometric authentication of the mobile device, read the local user private key to decrypt the security key, use the security key to decrypt the security data, and then display the interface.

[0072] like Figure 7As shown, the personal data security protection system includes a biometric recognition unit, a domestic password unit, an identity management unit and a data directory unit.

[0073] The biometric unit performs identity authentication through local biometrics or gestures on the mobile device. At the same time, the storage and reading of the local user master key and user private key on the device must also be subject to biometric authentication.

[0074] The domestic password generation unit is used to generate user identity information of a user master key, a user public key, a user private key, and a user identification code locally on the mobile device;

[0075] The user identity management unit is used to securely process user identity information, including local storage of user master keys and user private keys; encrypt user private keys using user master keys and encrypt user private keys using user identification codes;

[0076] In user data protection, the data directory and security unit use the national secret symmetric algorithm to encrypt personal data and encryption keys on the one hand, and store the physical address of the encrypted data in the data directory on the other hand to achieve the separation of applications and data.

[0077] It should be noted that the implementation process of the functions and effects of each unit module of this system is specifically described in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0078] A personal data security protection generating device includes: a processor, a memory, and an application, wherein the application is stored in the memory and is configured to be executed by the processor, and the processor implements the above-mentioned personal data security protection method when executing the application.

Claims

1. A personal user data security protection method based on a mobile device, characterized in that: It is applied in a network environment consisting of mobile devices and cloud servers, and includes the following steps: S1. The mobile device authenticates the user based on the user's biometrics. If the authentication is successful, S2 is executed. Otherwise, the process returns to S1. S2. The cryptographic module on the mobile device generates user identity information, including a user master key, a user public key, a user private key, and a user identification code, and directly stores the user master key and the user private key on the mobile device, and feeds the user identification code back to the corresponding user; S3. The mobile device encrypts the user private key based on the user master key to obtain an encrypted first private key pri_key_sec1; At the same time, a symmetric key is generated based on the user identification code, which is used to encrypt the user private key and obtain the encrypted second private key pri_key_sec2; Finally, the user's public key, the encrypted first private key pri_key_sec1, and the encrypted second private key pri_key_sec2 are sent to the cloud server for backup storage, thus completing the user's identity information registration; S4. When the user logs in to the mobile device, he / she enters his / her user identification code and obtains the first encryption private key pri_key_sec1 and the first random number from the cloud server. At the same time, after the user's biometrics are authenticated on the mobile device, the user master key is obtained, and pri_key_sec1 is decrypted to obtain the decrypted first user private key. Compare the decrypted first user private key with the locally stored user private key. If they are the same, the verification is successful and S5 is executed; otherwise, return to S4; When a user logs in to a new mobile device, after the user's biometrics are authenticated on the mobile device, the user enters his or her own user identification code, which is used to obtain the second encrypted private key pri_key_sec2 and the second random number from the cloud server, and decrypts pri_key_sec2 based on the user identification code to obtain the decrypted second user private key and store it on the new mobile device; The cryptographic module on the new mobile device generates a new user master key and stores it on the new mobile device, and then uses the new user master key to encrypt the decrypted second user private key to obtain the encrypted second private key pri_key_sec2' and send it to the cloud server, so that the cloud server replaces pri_key_sec1 with pri_key_sec2'; S5. Perform strong identity authentication on the user based on digital signature technology. If the authentication is successful, execute S6; otherwise, return to S4. S6. The mobile device uses a local password module to generate an encryption key for user data, which is used to encrypt the user data to obtain encrypted user data; then uses the user public key to encrypt the encryption key to obtain an encryption key result, and the user stores the encrypted user data and the encryption key result on a cloud server or mobile device, and obtains a storage path, and finally saves the storage path on the cloud server.

2. The personal user data security protection method based on mobile devices according to claim 1 is characterized in that: In S5, the random number is digitally signed by combining the user's private key and the hash algorithm, and the signature result is sent to the cloud server for verification. If the cloud server uses the public key to decrypt the signature result and compares it with the random number, it means that the signature verification is successful; if the cloud server uses the public key to decrypt the signature result and compares it with the random number, it means that the signature verification fails, thereby completing the user's strong identity authentication.

3. An electronic device comprising a memory and a processor, characterized in that: The memory is used to store a program that supports the processor to execute the personal user data security protection method based on a mobile device as described in claim 1 or 2, and the processor is configured to execute the program stored in the memory.

4. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the personal user data security protection method based on a mobile device according to claim 1 or 2 are executed.

Images