Data processing method and device, electronic equipment and storage medium

Abstract

The invention discloses a data processing method and device, electronic equipment and a storage medium, and the method comprises the steps: generating a target message authentication code based on a target user identifier carried in a first information query request; querying a target key pair identifier corresponding to a first logout account associated with the target message authentication code in a database, obtaining a private key in the corresponding target key pair, and decrypting the user personal information of the first logout account by using the private key; outputting first target information at least comprising the decrypted user personal information of the first logout account; wherein the account identifier, the key pair identifier and the message authentication code corresponding to each logout account are stored in the database, and the user personal information of each logout account is information encrypted by using a public key in the corresponding key pair. By applying the technical scheme provided by the invention, the reduction tracing in a specific business scene can be supported while the anonymization processing compliance requirement is met.

Description

Technical Field

[0001] The present application relates to the field of computer application technology, and in particular to a data processing method, device, electronic device and storage medium. Background Art

[0002] In the Internet era, companies that serve customers (Consumer, C) inevitably collect and process a lot of user personal information in their daily business operations. With the improvement of personal information protection awareness and the improvement of relevant laws and regulations, how to effectively protect this information while meeting the requirements of relevant laws and regulations has become the focus of corporate data compliance work. Relevant regulations point out that after the user cancels the application account, the data processor needs to anonymize the user's personal information.

[0003] At present, commonly used anonymization methods include data masking (for example, displaying a mobile phone number as "123****7890") and data obfuscation.

[0004] Although applying these methods to process data can meet relevant compliance requirements to a certain extent, the processed data is difficult to restore and trace in specific business scenarios. For example, in the scenario of traceability audit by regulatory authorities, the data processed by these methods is not available, which increases the difficulty of tracing. Summary of the invention

[0005] The purpose of this application is to provide a data processing method, device, electronic device and storage medium, so that the data processing performed when an account is cancelled can meet the compliance requirements of anonymization processing while supporting restoration and tracing in specific business scenarios.

[0006] In order to solve the above technical problems, this application provides the following technical solutions:

[0007] In a first aspect, a data processing method is provided, comprising:

[0008] receiving a first information query request, wherein the first information query request carries a target user identifier;

[0009] Based on the target user identifier, generating a target message authentication code;

[0010] Querying the database for a target key pair identifier corresponding to the first cancelled account associated with the target message authentication code, and obtaining a private key in the target key pair corresponding to the target key pair identifier through a key management service;

[0011] Decrypting the user personal information of the first cancelled account using the private key in the target key pair;

[0012] Outputting first target information of the first cancelled account in response to the first information query request, the first target information at least including decrypted user personal information of the first cancelled account;

[0013] The database stores user personal information and associated information of multiple cancelled accounts;

[0014] For each cancelled account, the associated information of the currently cancelled account includes at least the account identifier, key pair identifier, and message authentication code corresponding to the currently cancelled account; the user personal information of the currently cancelled account is the information encrypted using the public key in the key pair corresponding to the currently cancelled account.

[0015] Optionally, the generating a target message authentication code based on the target user identifier includes:

[0016] authenticating the requester of the first information query request;

[0017] When the identity authentication is passed, a target message authentication code is generated based on the target user identifier.

[0018] Optionally, the first information query request further carries target identity information, and the identity verification of the requester of the first information query request includes:

[0019] matching the target identity information with pre-authorized identity information;

[0020] Based on the matching result, it is determined whether the identity authentication of the requester of the first information query request is passed.

[0021] Optionally, the first information query request further carries a target query key, and the generating a target message authentication code based on the target user identifier includes:

[0022] Generate a hash value of the target user identifier;

[0023] Based on the target query key, generating a first key and a second key;

[0024] A target message authentication code is generated according to the hash value, the first key and the second key.

[0025] Optionally, generating a target message authentication code according to the hash value, the first key and the second key includes:

[0026] Performing a hash operation on the hash value and the first key to generate a hash value;

[0027] A hash operation is performed on the hash value and the second key to generate a target message authentication code.

[0028] Optionally, querying the database for a target key pair identifier corresponding to the first cancelled account associated with the target message authentication code includes:

[0029] Querying a database for a first cancelled account associated with the target message authentication code;

[0030] If the first cancelled account is within the corresponding storage period, the target key pair identifier corresponding to the first cancelled account is obtained.

[0031] Optionally, the method further comprises:

[0032] Receiving a logout request for a target user account;

[0033] According to the deregistration request, generating and storing a key pair for the target user account through the key management service;

[0034] Based on the user identifier of the target user account, generating a message authentication code for the target user account;

[0035] Encrypting the user personal information of the target user account using the public key in the key pair for the target user account;

[0036] Storing the associated information of the target user account and the encrypted user personal information in the database;

[0037] A logout success message of the target user account is sent to the requester of the logout request, wherein the logout success message carries an account identifier corresponding to the target user account.

[0038] Optionally, the method further comprises:

[0039] receiving a second information query request, wherein the second information query request carries a target account identifier;

[0040] Querying the database for a second cancelled account associated with the target account identifier;

[0041] Output second target information of the second cancelled account in response to the second information query request, wherein the second target information at least includes encrypted user personal information of the second cancelled account.

[0042] Optionally, the outputting the second target information of the second cancelled account includes:

[0043] Determining whether the second cancelled account is within the corresponding storage period time limit;

[0044] If it is within the corresponding storage period time limit, the second target information of the second cancelled account is output.

[0045] In a second aspect, a data processing device is provided, comprising:

[0046] A receiving module, configured to receive a first information query request, wherein the first information query request carries a target user identifier;

[0047] A generating module, used for generating a target message authentication code based on the target user identifier;

[0048] A query module, configured to query a database for a target key pair identifier corresponding to a first cancelled account associated with the target message authentication code, and obtain a private key in a target key pair corresponding to the target key pair identifier through a key management service;

[0049] A processing module, configured to use a private key in the target key pair to decrypt the user personal information of the first cancelled account;

[0050] an output module, configured to output first target information of the first cancelled account in response to the first information query request, wherein the first target information at least includes decrypted user personal information of the first cancelled account;

[0051] The database stores user personal information and associated information of multiple cancelled accounts;

[0052] For each cancelled account, the associated information of the currently cancelled account includes at least the account identifier, key pair identifier, and message authentication code corresponding to the currently cancelled account; the user personal information of the currently cancelled account is the information encrypted using the public key in the key pair corresponding to the currently cancelled account.

[0053] In a third aspect, an electronic device is provided, including:

[0054] Memory for storing computer programs;

[0055] A processor is used to implement the steps of the data processing method as described in the first aspect when executing the computer program.

[0056] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the data processing method described in the first aspect are implemented.

[0057] In a fifth aspect, a computer program product is provided, which includes computer instructions, which are stored in a computer-readable storage medium and are suitable for being read and executed by a processor, so that a computer device having the processor performs the steps of the data processing method described in the first aspect.

[0058] By applying the technical solution provided in the embodiment of the present application, each cancelled account corresponds to an account identifier, a key pair identifier, and a message authentication code. The user personal information of each cancelled account is the information encrypted using the public key in the corresponding key pair, which can meet the compliance requirements for anonymization processing. When a first information query request is received, a target message authentication code is generated based on the target user identifier carried in the first information query request, and the target key pair identifier corresponding to the first cancelled account associated with the target message authentication code is queried in the database, and the private key in the target key pair corresponding to the target key pair identifier is obtained. The user personal information of the first cancelled account is decrypted using the private key in the target key pair, and the first target information including at least the decrypted user personal information is output in response to the first information query request. In this way, the user personal information of the cancelled account can be restored and traced in specific business scenarios.

[0059] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0061] Figure 1 This is a flowchart of a data processing method in an embodiment of the present application;

[0062] Figure 2 This is a schematic diagram of the structure of a data processing device in an embodiment of the present application;

[0063] Figure 3 This is a schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0064] The technical solutions in the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of the present application.

[0065] The terms "first", "second", etc. of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first" and "second" are generally of one type, and the number of objects is not limited, for example, the first object can be one or more. In addition, "or" in the present application represents at least one of the connected objects. For example, the protection scope of "A or B" covers at least three schemes, that is, scheme one: including A and excluding B; scheme two: including B and excluding A; scheme three: including both A and B. In addition, the terms "A and / or B", "at least one of A and B", and "at least one of A or B" also cover at least the above three schemes respectively. The character " / " generally indicates that the objects associated before and after are in an "or" relationship.

[0066] The core of this application is to provide a data processing method, which can be applied to scenarios where data / information processing and data / information query are required when a user account is logged out or after the account is logged out.

[0067] In related technologies, when a user account is cancelled, if data masking or data obfuscation is used to anonymize user personal information, although relevant compliance requirements can be met, it cannot support the restoration and tracing of anonymized user personal information in specific business scenarios. If a unified encryption key is used to anonymize user personal information, once the unified encryption key is leaked, it will lead to security risks for batches of user personal information and cannot meet the confidentiality requirements of anonymization.

[0068] Therefore, while realizing the anonymization of user personal information, we are faced with the challenge of finding a balance between protecting user privacy and supporting regulatory traceability. The anonymization processing methods in related technologies either cannot meet the needs of regulatory traceability or have security risks, making it difficult to achieve the dual goals of protecting user privacy and supporting regulatory traceability.

[0069] Based on this, the embodiment of the present application uses an asymmetric encryption algorithm to generate a key pair and a message authentication code for each cancelled account separately, and stores the user personal information and associated information of multiple cancelled accounts in the database. For each cancelled account, the associated information of the current cancelled account at least includes the account identifier, key pair identifier, and message authentication code corresponding to the current cancelled account. The user personal information of the current cancelled account is the information encrypted using the public key in the key pair corresponding to the current cancelled account. If the private key in the key pair corresponding to the cancelled account is not obtained, the user personal information of the cancelled account cannot be decrypted, so the anonymization processing requirements of the user personal information are met. In the case where the private key in the key pair corresponding to the cancelled account is obtained through a series of verifications, the user personal information of the cancelled account can be decrypted, which can meet the traceability requirements of the user personal information in special scenarios, such as meeting the traceability audit requirements of the regulatory authorities within the statutory storage period of the user personal information.

[0070] The currently deregistered account is the deregistered account that the current operation is targeting.

[0071] See also Figure 1 FIG. 1 is a flowchart of a data processing method according to an embodiment of the present application. The method may include the following steps:

[0072] S110: Receive a first information query request.

[0073] The first information query request carries a target user identifier, which may be a mobile phone number, ID card number, social security number, etc., or a character string generated based on the above numbers, such as the MD5 value of a mobile phone number.

[0074] The requester of the first information query request may be a regulator or other person with query authority.

[0075] After receiving the first information query request, you can continue to execute the subsequent steps.

[0076] S120: Generate a target message authentication code based on the target user identifier.

[0077] Upon receiving the first information query request, the target user identifier carried in the first information query request may be obtained, and a target message authentication code may be generated based on the target user identifier. For example, a preset hash algorithm may be used to perform a hash operation on the target user identifier to generate the target message authentication code.

[0078] Based on the target user identifier, the target message authentication code is generated in the same manner as the message authentication code corresponding to each cancelled account stored in the database.

[0079] S130: Query the database for a target key pair identifier corresponding to the first cancelled account associated with the target message authentication code, and obtain a private key in the target key pair corresponding to the target key pair identifier through a key management service.

[0080] In an embodiment of the present application, user personal information and associated information of multiple cancelled accounts are stored in a database; for each cancelled account, the associated information of the currently cancelled account includes at least the account identifier, key pair identifier, and message authentication code corresponding to the currently cancelled account; the user personal information of the currently cancelled account is information encrypted using the public key in the key pair corresponding to the currently cancelled account.

[0081] It can be understood that each deregistered account has a corresponding account ID, key pair ID, and message authentication code. Different deregistered accounts have different corresponding account IDs, key pair IDs, and message authentication codes. A key pair ID uniquely corresponds to a key pair. Each key pair includes a public key and a private key.

[0082] After generating the target message authentication code based on the target user identifier carried in the first information query request, the first cancelled account associated with the target message authentication code can be queried in the database. Optionally, the target message authentication code can be matched with the message authentication codes corresponding to each cancelled account in the database, and the cancelled account corresponding to the successfully matched message authentication code is used as the first cancelled account. Furthermore, the target key pair identifier corresponding to the first cancelled account can be queried.

[0083] The corresponding key pair can be generated and stored for the deregistered account through the Key Management Service (KMS). After the target key pair identifier is obtained from the database, the target key pair corresponding to the target key pair identifier can be obtained through the Key Management Service, thereby obtaining the private key in the target key pair.

[0084] S140: Use the private key in the target key pair to decrypt the user personal information of the first cancelled account.

[0085] In the embodiment of the present application, the user personal information of each cancelled account is the information encrypted using the public key in the key pair corresponding to the corresponding cancelled account. For example, for the cancelled account A, the cancelled account A corresponds to the account identifier A, the key pair identifier A, and the message authentication code A. The key pair identifier A corresponds to the key pair A, including the public key A and the private key A. The user personal information of the cancelled account A is encrypted using the public key A.

[0086] After receiving the first information query request, a target message authentication code is generated based on the target user identifier carried in the first information query request, and the target key pair identifier corresponding to the first cancelled account associated with the target message authentication code is queried in the database. After obtaining the private key in the target key pair corresponding to the target key pair identifier through the key management service, the private key in the target key pair can be used to decrypt the user personal information of the first cancelled account.

[0087] In an embodiment of the present application, user personal information may include personal sensitive information, such as name, ID number, mobile phone number, home address, bank card number and other information.

[0088] S150: Outputting first target information of the first cancelled account in response to the first information query request.

[0089] The first target information at least includes the decrypted user personal information of the first cancelled account.

[0090] In an embodiment of the present application, after decrypting the user personal information of the first cancelled account using the private key in the target key pair corresponding to the first cancelled account, the decrypted user personal information can be obtained. The decrypted user personal information can be included in the output first target information of the first cancelled account, and of course other information can also be included, such as the user's operation records and other information. The other information can be understood as non-sensitive information.

[0091] The first target information of the first cancelled account is output in response to the first information query request, so that the requester of the first information query request can obtain the first target information of the first cancelled account.

[0092] By applying the method provided in the embodiment of the present application, each cancelled account corresponds to an account identifier, a key pair identifier, and a message authentication code. The user personal information of each cancelled account is the information encrypted using the public key in the corresponding key pair, which can meet the compliance requirements for anonymization processing. When a first information query request is received, a target message authentication code is generated based on the target user identifier carried in the first information query request, and the target key pair identifier corresponding to the first cancelled account associated with the target message authentication code is queried in the database, and the private key in the target key pair corresponding to the target key pair identifier is obtained through the key management service. The user personal information of the first cancelled account is decrypted using the private key in the target key pair, and the first target information including at least the decrypted user personal information is output in response to the first information query request. In this way, the user personal information of the cancelled account can be restored and traced in specific business scenarios.

[0093] In some embodiments of the present application, step S120 generates a target message authentication code based on the target user identifier, which may include the following steps:

[0094] authenticating the requester of the first information query request;

[0095] When the identity authentication is successful, a target message authentication code is generated based on the target user identifier.

[0096] In an embodiment of the present application, after receiving the first information query request, the identity of the requester of the first information query request can be authenticated to confirm whether it has the corresponding query authority.

[0097] It is understandable that for any user account, if the user account is cancelled, the user personal information of the user account should be anonymized to protect the user personal information. Only in scenarios such as supervision is the anonymized user personal information allowed to be decrypted and queried, so the requesting party needs to have a legal query identity.

[0098] When the identity authentication of the requester of the first information query request is passed, a target message authentication code can be generated based on the target user identifier, so as to further query the target key pair identifier corresponding to the first cancelled account associated with the target message authentication code in the database, and then obtain the target key pair corresponding to the target key pair identifier, and use the private key in the target key pair to decrypt the user personal information of the first cancelled account.

[0099] In the case where the identity authentication of the requester of the first information query request fails, prompt information such as verification failure and query failure may be returned to the requester of the first information query request.

[0100] After receiving the first information query request carrying the target user identifier, the identity of the requester of the first information query request is first authenticated. Only after the identity authentication is passed, the subsequent steps are performed to prevent the personal information of the user whose account has been cancelled from being illegally queried.

[0101] In some embodiments of the present application, the first information query request also carries target identity information, and identity verification of the requester of the first information query request may include the following steps:

[0102] matching the target identity information with the pre-authorized identity information;

[0103] Based on the matching result, it is determined whether the identity authentication of the requester of the first information query request is passed.

[0104] In the embodiment of the present application, authorized identity information can be provided in advance for persons with legitimate query identities, for example, a supervisory account number can be provided for the supervisor.

[0105] The first information query request carries the target user identifier and the target identity information. After receiving the first information query request, the target identity information can be matched with the pre-authorized identity information, and according to the matching result, it can be determined whether the identity authentication of the requester of the first information query request is passed.

[0106] Optionally, if the target identity information matches the pre-authorized identity information, it is determined that the identity authentication of the requester of the first information query request is passed.

[0107] Optionally, if the target identity information does not match the pre-authorized identity information, it is determined that the identity authentication of the requester of the first information query request has failed.

[0108] According to the matching result between the target identity information carried in the first information query request and the pre-authorized identity information, identity authentication can be accurately performed.

[0109] In some embodiments of the present application, the first information query request also carries a target query key, and step S120 generates a target message authentication code based on the target user identifier, which may include the following steps:

[0110] Generate a hash value of the target user ID;

[0111] Based on the target query key, generate a first key and a second key;

[0112] A target message authentication code is generated according to the hash value, the first key and the second key.

[0113] In the embodiment of the present application, a target query key may be provided in advance to a person with a legitimate query identity, for example, a target query key may be provided to a supervisor.

[0114] The first information query request may carry a target user identifier and may also carry a target query key. After receiving the first information query request, a hash value of the target user identifier may be generated. Optionally, the target user identifier may be operated using a message digest algorithm 5 (Message-Digest Algorithm 5, MD5) to obtain a 128-bit hash value, which may be understood as the MD5 value of the target user identifier.

[0115] Based on the target query key, a first key and a second key may be generated. The first key and the second key are derived from the target query key. Optionally, the target query key may be XORed with 0x36 to obtain the first key, and the target query key may be XORed with 0x5c to obtain the second key. The XOR operation is a bitwise operation in which each bit is flipped (1 becomes 0, and 0 becomes 1).

[0116] After generating a hash value of the target user identifier and generating a first key and a second key based on the target query key, a target message authentication code may be further generated based on the hash value, the first key and the second key.

[0117] Optionally, a hash operation may be performed on the hash value and the first key to generate a hash value, and then a hash operation may be performed on the hash value and the second key to generate a target message authentication code.

[0118] Optionally, a keyed-Hash Message Authentication Code (HMAC)-Secure Hash Algorithm (SHA) 256 algorithm may be used to generate a target message authentication code. For example, hmac=SHA256(opad||SHA256(ipad||message)), where ipad represents the first key, ipad=key XOR 0x36, opad represents the second key, opad=key XOR 0x5c, message=md5(target user identifier), and key represents the target query key.

[0119] The target message authentication code is generated through the target user identification and the target query key, which can enhance the security of the target message authentication code. Only with the correct target query key can a valid target message authentication code be generated. The message authentication code technology can realize the information restoration query in the supervision and traceability scenario, achieve the purpose of identity verification of the requesting party, and effectively reduce the risk of incomplete anonymization of the user identification.

[0120] In some embodiments of the present application, step S130 queries the database for a target key pair identifier corresponding to the first cancelled account associated with the target message authentication code, which may include the following steps:

[0121] Querying the database for a first cancelled account associated with the target message authentication code;

[0122] If the first cancelled account is within the corresponding storage period, the target key pair identifier corresponding to the first cancelled account is obtained.

[0123] In an embodiment of the present application, the database stores user personal information and associated information of multiple cancelled accounts, and each cancelled account corresponds to its own storage cycle time limit. For example, if the storage cycle of a cancelled account is three years, then for any cancelled account, the storage cycle time limit corresponding to the cancelled account is within three years starting from the time when the cancelled account is cancelled. Different cancelled accounts have different cancellation times, so different cancelled accounts have different storage cycle time limits. The user personal information of the cancelled account within the storage cycle time limit is retained, and the user personal information of the cancelled account that has exceeded the storage cycle time limit is deleted.

[0124] After receiving the first information query request, based on the target user identifier carried in the first information query request, after generating the target message authentication code, the first cancelled account associated with the target message authentication code is queried in the database to determine whether the first cancelled account is within the corresponding storage period time limit. If it is within the corresponding storage period time limit, it is considered that the user personal information of the first cancelled account has not been deleted, and the target key pair identifier corresponding to the first cancelled account can be obtained to use the private key in the target key pair corresponding to the target key pair identifier to decrypt the user personal information of the first cancelled account. If the first cancelled account is not within the corresponding storage period time limit, it is considered that the user personal information of the first cancelled account has been deleted, and the subsequent decryption steps can be no longer performed, and prompt information such as query failure or failure to query or query period has expired can be returned to the requester of the first information query request.

[0125] Only if the first cancelled account is within the storage period, further decryption and other operations will be performed, which can avoid invalid operations and improve query efficiency.

[0126] In some embodiments of the present application, the method may further include the following steps:

[0127] Receiving a logout request for a target user account;

[0128] Based on the logout request, generate and store a key pair for the target user account through the key management service;

[0129] Based on the user identifier of the target user account, generate a message authentication code for the target user account;

[0130] Encrypt the user personal information of the target user account using the public key in the key pair for the target user account;

[0131] Storing the target user account's associated information and the encrypted user's personal information in a database;

[0132] A logout success message of the target user account is sent to the requester of the logout request, and the logout success message carries the account identifier corresponding to the target user account.

[0133] For the convenience of description, the above steps are combined for explanation.

[0134] In an embodiment of the present application, a user may request to cancel his or her user account according to actual needs.

[0135] When a deregistration request is received for a target user account, a key pair for the target user account can be generated and stored by the key management service (KMS) according to the deregistration request. The key management service can generate, store and manage key pairs. The target user account can be any account to be deregistered. After the deregistration process is completed, the target user account is a deregistered user account.

[0136] Based on the user identifier of the target user account, a message authentication code for the target user account may be generated.

[0137] Optionally, a hash value of the user identifier of the target user account can be generated first, and a first key and a second key can be generated based on the target query key. Then, a message authentication code for the target user account can be generated according to the hash value of the user identifier of the target user account, the first key and the second key.

[0138] Optionally, a hash operation can be performed on the hash value of the user identifier of the target user account and the first key to generate a hash value corresponding to the target user account, and a hash operation can be performed on the hash value corresponding to the target user account and the second key to generate a message authentication code for the target user account.

[0139] Optionally, after receiving a logout request for a target user account, it is possible to first determine whether the target user account meets the logout conditions. If the logout conditions are met, further operations may be performed, such as generating a key pair and a message authentication code for the target user account based on the logout request. If the logout conditions are not met, a prompt message such as logout failure or logout incomplete may be sent to the requester of the logout request.

[0140] The cancellation conditions can be set and adjusted according to actual conditions. For example, when there are no unfinished transactions in the target user account, or the target user account is not marked as an account that cannot be cancelled, the target user account is considered to meet the cancellation conditions. Otherwise, the target user account is considered to not meet the cancellation conditions.

[0141] After generating the key pair and message authentication code for the target user account, the public key in the key pair for the target user account can be used to encrypt the user personal information of the target user account to meet the anonymization requirements.

[0142] The target user account's associated information and the encrypted user personal information are stored in the database. The target user account's associated information may include an account identifier, a key pair identifier, and a message authentication code corresponding to the target user account. Other information of the target user account, such as operation record information, may also be stored in the database.

[0143] A successful deregistration message of the target user account is sent to the requester of the deregistration request, and the successful deregistration message may carry the account identifier corresponding to the target user account. The account identifier corresponding to the target user account may be randomly generated, or generated based on the username information of the target user account, or generated based on the user identifier corresponding to the target user account, such as the account identifier of the target user account is the MD5 value of the mobile phone number corresponding to the target user account. The account identifiers corresponding to different deregistered accounts are different, and the account identifier and user identifier corresponding to the same deregistered account may be the same or different.

[0144] Optionally, the account identifier of the target user account may be a long string, such as a 32-bit string, to reduce the probability of being guessed by malicious traversal.

[0145] The target user account is cancelled according to the above operation. While meeting the anonymization requirements, the personal information of users whose accounts have been cancelled can be restored and traced in specific business scenarios.

[0146] In some embodiments of the present application, the method may further include the following steps:

[0147] receiving a second information query request, the second information query request carrying a target account identifier;

[0148] Querying the database for a second cancelled account associated with the target account identifier;

[0149] Output second target information of the second cancelled account in response to the second information query request, the second target information at least including the encrypted user personal information of the second cancelled account.

[0150] In the embodiment of the present application, after canceling his / her user account, the user can query the relevant information of the cancelled user account according to actual needs. For example, when the user needs to confirm whether the user personal information of the cancelled user account has been anonymized, the user can make a corresponding query. Or, when the user needs to query the operation record and other information of the cancelled user account, the user can make a corresponding query.

[0151] A second information query request is received, and the second information query request may carry a target account identifier. After receiving the second information query request, a second cancelled account associated with the target account identifier may be queried in a database.

[0152] Optionally, the target account identifier may be matched with the account identifier corresponding to each cancelled account stored in the database. If a match is found, the cancelled account corresponding to the matched account identifier is determined as the second cancelled account. If a match is not found, it may be considered that the target account identifier carried in the second information query request is incorrect, or the target account identifier has expired, and prompt information such as query failure or failure to find the information may be sent to the requester of the second information query request.

[0153] After the second cancelled account is found, the second target information of the second cancelled account can be output to respond to the second information query request. The second target information includes at least the encrypted user personal information of the second cancelled account, and can also include information such as operation records of the second cancelled account.

[0154] By querying information based on the target account ID, relevant information can be quickly and accurately retrieved and output to the requesting party, which can improve the efficiency and accuracy of information query.

[0155] In some embodiments of the present application, outputting the second target information of the second cancelled account may include the following steps:

[0156] Determining whether the second cancelled account is within the corresponding storage period time limit;

[0157] If it is within the corresponding storage period time limit, the second target information of the second cancelled account is output.

[0158] In an embodiment of the present application, after receiving the second information query request and searching the database for the second cancelled account associated with the target account identifier, it is first determined whether the second cancelled account is within the corresponding storage period time limit. If it is within the corresponding storage period time limit, it can be considered that the user personal information of the second cancelled account has not been deleted, and the second target information of the second cancelled account can be output. If it is not within the corresponding storage period time limit, it can be considered that the user personal information of the second cancelled account has been deleted, and prompt information such as query failure, failure to query, user personal information has been deleted, and storage period time limit has expired can be output to the requester of the second information query request.

[0159] The technical solutions provided in the embodiments of the present application are described above. For ease of understanding, the technical solutions provided in the embodiments of the present application are exemplarily described below from a system perspective.

[0160] The system used by the technical solution provided in the embodiment of the present application may include a user account cancellation unit, a user personal information encryption unit, a secure storage unit, a message push unit, a key management unit, an information query unit, and the like.

[0161] Among them, the user account cancellation unit is used to implement the action of user account cancellation. When the user confirms to cancel the user account X and passes various condition verifications, the key management unit can call KMS to generate a corresponding key pair for the user account X to be cancelled. The key pair includes a public key and a private key;

[0162] The user personal information encryption unit is used to obtain the public key in the key pair corresponding to the user account X from the key management unit after the user account X is successfully deregistered, and use the public key to re-encrypt the user personal information of the user account X, such as name, mobile phone number, ID card number, etc.;

[0163] The secure storage unit is used to store user personal information, which can be stored in a database. After user account X is cancelled, the user personal information encrypted with the public key corresponding to user account X is securely stored in the database. At the same time, a record is stored to mark that user account X has been cancelled;

[0164] A message push unit is used to push a message to the user that the user account has been successfully deregistered, informing the user that the relevant user's personal information has been anonymized, and at the same time informing the user's account identifier in the system, such as userid, so that the user can query the anonymized data related to the userid within the corresponding storage period;

[0165] The key management unit is used to interact with KMS to manage the key pair corresponding to the cancelled user account; it is also used to establish the mapping relationship between the account identifier, key pair identifier and message authentication code corresponding to the cancelled user account; it is also used to determine the corresponding userid and key pair identifier by comparing the message authentication code after receiving the supervision side information query request sent by the information query unit, and authenticate the supervision account, such as KMS_A, through KMS to obtain the private key required for query;

[0166] KMS is used to generate and store key pairs. It has a separate supervision account, such as KMS_A, which manages the key pairs corresponding to all deregistered accounts. Accounts other than the supervision account do not have key query permissions.

[0167] Information query unit, used to provide personal query and regulatory query capabilities within the legal storage period of user personal information;

[0168] Personal inquiries are made through the account ID pushed to the user when the user's account is logged out, and the anonymized data is quickly queried and fed back;

[0169] Regulatory inquiries need to pass the identity authentication of the regulatory account, such as KMS_A. At the same time, for the mobile phone number of the deregistered user to be queried, the regulatory side needs to enter the target query key and use the corresponding HMAC-SHA256 algorithm to calculate the corresponding message authentication code, and pass it to the key management unit. The key management unit interacts with KMS and returns the userid and private key information of the queried user. After obtaining the userid and private key, query the secure storage unit and decrypt the corresponding plaintext data of the user's personal information.

[0170] Specifically, the anonymization process when canceling a user account is as follows:

[0171] ① The system receives a logout request for the target user account. The logout request may be initiated by the user and received after the logout condition verification is successfully passed;

[0172] ②The system notifies the key management unit to generate a key pair corresponding to the target user account;

[0173] ③After receiving the notification, the key management unit interacts with KMS, and KMS uses an asymmetric encryption algorithm, such as RSA2048 algorithm, to generate a separate key pair corresponding to the target user account, including a public key and a private key;

[0174] ④The key management unit uses the HMAC_SHA256 algorithm, combined with the preset independent supervisory query key and the MD5 value of the deregistered user's mobile phone number, to generate a message authentication code for the target user account;

[0175] ⑤The key management unit stores the relationship mapping table of userid, key pair id, and message authentication code.

[0176] ⑥ The user personal information encryption unit interacts with the key management unit, requests the public key P corresponding to the target user account, and returns it through userid matching;

[0177] ⑦ Use the public key P to re-encrypt the user personal information of the target user account, that is, perform anonymization processing, and store it in a secure storage unit, while storing a record to mark that the target user account has been cancelled;

[0178] ⑧ The message push unit pushes a successful account cancellation message to the deregistering user, informing the relevant user that his / her personal information has been anonymized, and at the same time informing him / her of his / her account identifier in the system, i.e., userid, so that he / she can query the anonymized data related to userid within the data storage period.

[0179] The process for the supervisor to trace the source and obtain evidence to cancel the user's plain text information in accordance with the law is as follows:

[0180] ① The supervisor needs to authenticate himself through the preset supervisor account KMS_A to access the information query unit to prove that he is a legitimate supervisor and can legally manage the key pairs corresponding to all cancelled user accounts of KMS;

[0181] ② The supervisor enters the user's mobile phone number and the target query key agreed offline. The system uses the corresponding HMAC_SHA256 algorithm to calculate the corresponding message authentication code and pass it to the key management unit;

[0182] ③ After receiving the information query request from the supervisory side, the key management unit can determine the corresponding userid and key pair id by comparing the message authentication code. At the same time, after performing key authentication on the supervisory account KMS_A, the private key S required for query can be obtained.

[0183] ④ After the information query unit obtains the userid and private key S, it accesses the secure storage unit. Through userid matching, it can successfully query and use the private key S to decrypt the corresponding plaintext data of the user's personal information.

[0184] The process for individual users to query anonymized data through userid is as follows:

[0185] ① The deregistered user uses the userid information pushed to him / her when he / she logs out to initiate a personal data query through the information query unit. Here, the userid can be a 32-bit random string, and the probability of being maliciously traversed and guessed is low;

[0186] ② In the personal query scenario, the userid data submitted by the user is used to determine whether the user account exists and has been cancelled, and whether the data has exceeded the storage period. If the verification is passed, the user's related anonymized data is returned to the user. If the verification fails, the query fails.

[0187] Through the above-mentioned data processing interaction solution, the asymmetric encryption and decryption algorithm is optimized to separately process user personal information to meet the compliance requirements of anonymization processing. At the same time, the message authentication code technology is combined to provide regulatory query capabilities, which can better solve the problem of plain text traceability of supervision after anonymization processing.

[0188] That is, while meeting the compliance requirements for anonymization processing, the embodiments of the present application process each user account individually, reducing the risk of restoring batch user personal information, and providing feasibility for regulatory information traceability based on asymmetric encryption and message authentication code technology solutions.

[0189] Corresponding to the above method embodiment, the embodiment of the present application further provides a data processing device. The data processing device described below and the data processing method described above can refer to each other.

[0190] See also Figure 2As shown, the data processing device 200 includes the following modules:

[0191] The receiving module 210 is used to receive a first information query request, where the first information query request carries a target user identifier;

[0192] A generating module 220, configured to generate a target message authentication code based on a target user identifier;

[0193] A query module 230, configured to query a database for a target key pair identifier corresponding to a first cancelled account associated with a target message authentication code, and obtain a private key in a target key pair corresponding to the target key pair identifier through a key management service;

[0194] Processing module 240, configured to use the private key in the target key pair to decrypt the user personal information of the first cancelled account;

[0195] The output module 250 is used to output first target information of the first cancelled account in response to the first information query request, wherein the first target information at least includes the decrypted user personal information of the first cancelled account;

[0196] Among them, the database stores user personal information and associated information of multiple cancelled accounts;

[0197] For each cancelled account, the associated information of the currently cancelled account includes at least the account ID, key pair ID, and message authentication code corresponding to the currently cancelled account; the user personal information of the currently cancelled account is the information encrypted using the public key in the key pair corresponding to the currently cancelled account.

[0198] By using the device provided in the embodiment of the present application, each cancelled account corresponds to an account identifier, a key pair identifier, and a message authentication code. The user personal information of each cancelled account is the information encrypted using the public key in the corresponding key pair, which can meet the compliance requirements for anonymization processing. When a first information query request is received, a target message authentication code is generated based on the target user identifier carried in the first information query request, and the target key pair identifier corresponding to the first cancelled account associated with the target message authentication code is queried in the database, and the private key in the target key pair corresponding to the target key pair identifier is obtained. The user personal information of the first cancelled account is decrypted using the private key in the target key pair, and the first target information including at least the decrypted user personal information is output in response to the first information query request. In this way, the user personal information of the cancelled account can be restored and traced in specific business scenarios.

[0199] In some embodiments of the present application, the generating module 220 is specifically used to:

[0200] authenticating the requester of the first information query request;

[0201] When the identity authentication is successful, a target message authentication code is generated based on the target user identifier.

[0202] In some embodiments of the present application, the first information query request also carries target identity information, and the generating module 220 is specifically used to:

[0203] matching the target identity information with the pre-authorized identity information;

[0204] Based on the matching result, it is determined whether the identity authentication of the requester of the first information query request is passed.

[0205] In some embodiments of the present application, the first information query request also carries a target query key, and the generating module 220 is specifically used to:

[0206] Generate a hash value of the target user ID;

[0207] Based on the target query key, generate a first key and a second key;

[0208] A target message authentication code is generated according to the hash value, the first key and the second key.

[0209] In some embodiments of the present application, the generating module 220 is specifically used to:

[0210] Performing a hash operation on the hash value and the first key to generate a hash value;

[0211] A hash operation is performed on the hash value and the second key to generate a target message authentication code.

[0212] In some embodiments of the present application, the query module 230 is specifically used to:

[0213] Querying the database for a first cancelled account associated with the target message authentication code;

[0214] If the first cancelled account is within the corresponding storage period, the target key pair identifier corresponding to the first cancelled account is obtained.

[0215] In some embodiments of the present application, the data processing device 200 further includes a storage module;

[0216] The receiving module 210 is further configured to receive a logout request for a target user account;

[0217] The generating module 220 is further used to generate and store a key pair identifier for the target user account through the key management service according to the deregistration request; and generate a message authentication code for the target user account based on the user identifier of the target user account;

[0218] The processing module 240 is further configured to encrypt the user personal information of the target user account using the public key in the key pair for the target user account;

[0219] A storage module, used to store the associated information of the target user account and the encrypted user personal information in a database;

[0220] The output module 250 is used to send a logout success message of the target user account to the requester of the logout request, where the logout success message carries the account identifier corresponding to the target user account.

[0221] In some embodiments of the present application, the receiving module 210 is further configured to receive a second information query request, where the second information query request carries a target account identifier;

[0222] The query module 230 is further used to query the database for a second cancelled account associated with the target account identifier;

[0223] The output module 250 is further used to output second target information of the second cancelled account in response to the second information query request, where the second target information at least includes the encrypted user personal information of the second cancelled account.

[0224] In some embodiments of the present application, the output module 250 is specifically used to:

[0225] Determining whether the second cancelled account is within the corresponding storage period time limit;

[0226] If it is within the corresponding storage period time limit, the second target information of the second cancelled account is output.

[0227] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0228] Corresponding to the above method embodiment, the present application embodiment further provides an electronic device, including:

[0229] Memory for storing computer programs;

[0230] A processor is used to implement the steps of the above data processing method when executing a computer program.

[0231] like Figure 3 , which is a schematic diagram of the composition structure of an electronic device, the electronic device may include: a processor 10, a memory 11, a communication interface 12 and a communication bus 13. The processor 10, the memory 11 and the communication interface 12 all communicate with each other through the communication bus 13.

[0232] In the embodiment of the present application, the processor 10 may be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic devices, etc.

[0233] The processor 10 may call a program stored in the memory 11. Specifically, the processor 10 may execute operations in the embodiment of the data processing method.

[0234] The memory 11 is used to store one or more programs, which may include program codes, and the program codes include computer operation instructions. In the embodiment of the present application, the memory 11 at least stores programs for implementing the following functions:

[0235] receiving a first information query request, the first information query request carrying a target user identifier;

[0236] Based on the target user identifier, generate a target message authentication code;

[0237] Querying the database for a target key pair identifier corresponding to the first cancelled account associated with the target message authentication code, and obtaining a private key in the target key pair corresponding to the target key pair identifier through a key management service;

[0238] Decrypting the user personal information of the first cancelled account using the private key in the target key pair;

[0239] Outputting first target information of the first cancelled account in response to the first information query request, the first target information at least including the decrypted user personal information of the first cancelled account;

[0240] Among them, the database stores user personal information and associated information of multiple cancelled accounts;

[0241] For each cancelled account, the associated information of the currently cancelled account includes at least the account ID, key pair ID, and message authentication code corresponding to the currently cancelled account; the user personal information of the currently cancelled account is the information encrypted using the public key in the key pair corresponding to the currently cancelled account.

[0242] In a possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function, etc.; the data storage area may store data created during use.

[0243] In addition, the memory 11 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0244] The communication interface 12 may be an interface of a communication module, and is used to connect to other devices or systems.

[0245] Of course, it should be noted that Figure 3 The structure shown does not constitute a limitation on the electronic device in the embodiment of the present application. In actual applications, the electronic device may include Figure 3 More or fewer components than shown, or combinations of certain components.

[0246] Corresponding to the above method embodiment, the embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above data processing method are implemented.

[0247] In addition, it should be noted that: the embodiment of the present application also provides a computer program product or a computer program, which may include computer instructions, which may be stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor may execute the computer instructions so that the computer device executes the description of the data processing method in the corresponding embodiment above, so it will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer program product or computer program embodiment involved in this application, please refer to the description of the method embodiment of this application.

[0248] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0249] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises one..." does not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0250] Through the description of the above implementation methods, those skilled in the art can also clearly understand that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0251] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein can be directly implemented using hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a register, a hard disk, a removable disk, a compact disc read-only memory (CD-ROM), or any other form of storage medium known in the art, including several instructions to execute the methods described in the various embodiments of the present application.

[0252] The embodiments of the present application are described above in conjunction with the accompanying drawings, and the description of the above embodiments is only used to help understand the technical solution and its core idea of ​​the present application. It should be pointed out that the present application is not limited to the above-mentioned specific implementation methods, which are merely illustrative and not restrictive. For ordinary technicians in this field, many forms of implementation methods can be made without departing from the scope of protection of the purpose of the present application and the claims, and the present application can also be improved and modified in a number of ways, and these implementation methods, improvements and modifications are all within the scope of protection of the present application.

Claims

1. A data processing method, characterized in that: include: receiving a first information query request, wherein the first information query request carries a target user identifier; Based on the target user identifier, generating a target message authentication code; Querying the database for a target key pair identifier corresponding to the first cancelled account associated with the target message authentication code, and obtaining a private key in the target key pair corresponding to the target key pair identifier through a key management service; Decrypting the user personal information of the first cancelled account using the private key in the target key pair; Outputting first target information of the first cancelled account in response to the first information query request, the first target information at least including decrypted user personal information of the first cancelled account; The database stores user personal information and associated information of multiple cancelled accounts; For each cancelled account, the associated information of the currently cancelled account includes at least the account identifier, key pair identifier, and message authentication code corresponding to the currently cancelled account; the user personal information of the currently cancelled account is the information encrypted using the public key in the key pair corresponding to the currently cancelled account.

2. The method according to claim 1, characterized in that The generating a target message authentication code based on the target user identifier includes: authenticating the requester of the first information query request; When the identity authentication is passed, a target message authentication code is generated based on the target user identifier.

3. The method according to claim 2, characterized in that The first information query request also carries target identity information, and the identity authentication of the requester of the first information query request includes: matching the target identity information with pre-authorized identity information; Based on the matching result, it is determined whether the identity authentication of the requester of the first information query request is passed.

4. The method according to claim 1, characterized in that: The first information query request also carries a target query key, and the generating of a target message authentication code based on the target user identifier includes: Generate a hash value of the target user identifier; Based on the target query key, generating a first key and a second key; A target message authentication code is generated according to the hash value, the first key and the second key.

5. The method according to claim 4, characterized in that The generating a target message authentication code according to the hash value, the first key and the second key comprises: Performing a hash operation on the hash value and the first key to generate a hash value; A hash operation is performed on the hash value and the second key to generate a target message authentication code.

6. The method according to claim 1, characterized in that The step of querying the database for a target key pair identifier corresponding to the first cancelled account associated with the target message authentication code includes: Querying a database for a first cancelled account associated with the target message authentication code; If the first cancelled account is within the corresponding storage period, the target key pair identifier corresponding to the first cancelled account is obtained.

7. The method according to claim 1, characterized in that The method further comprises: Receiving a logout request for a target user account; According to the deregistration request, generating and storing a key pair for the target user account through the key management service; Based on the user identifier of the target user account, generating a message authentication code for the target user account; Encrypting the user personal information of the target user account using the public key in the key pair for the target user account; Storing the associated information of the target user account and the encrypted user personal information in the database; A logout success message of the target user account is sent to the requester of the logout request, wherein the logout success message carries an account identifier corresponding to the target user account.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: receiving a second information query request, wherein the second information query request carries a target account identifier; Querying the database for a second cancelled account associated with the target account identifier; Output second target information of the second cancelled account in response to the second information query request, wherein the second target information at least includes encrypted user personal information of the second cancelled account.

9. The method according to claim 8, characterized in that The outputting the second target information of the second cancelled account includes: Determining whether the second cancelled account is within the corresponding storage period time limit; If it is within the corresponding storage period time limit, the second target information of the second cancelled account is output.

10. A data processing device, characterized in that: include: A receiving module, configured to receive a first information query request, wherein the first information query request carries a target user identifier; A generating module, used for generating a target message authentication code based on the target user identifier; A query module, configured to query a database for a target key pair identifier corresponding to a first cancelled account associated with the target message authentication code, and obtain a private key in a target key pair corresponding to the target key pair identifier through a key management service; A processing module, configured to use a private key in the target key pair to decrypt the user personal information of the first cancelled account; an output module, configured to output first target information of the first cancelled account in response to the first information query request, wherein the first target information at least includes decrypted user personal information of the first cancelled account; The database stores user personal information and associated information of multiple cancelled accounts; For each cancelled account, the associated information of the currently cancelled account includes at least the account identifier, key pair identifier, and message authentication code corresponding to the currently cancelled account; the user personal information of the currently cancelled account is the information encrypted using the public key in the key pair corresponding to the currently cancelled account.

11. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the data processing method according to any one of claims 1 to 9 when executing the computer program.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data processing method according to any one of claims 1 to 9 are implemented.

Images