Data protection method and device, equipment and storage medium
By using the first key in memory on the application backend to encrypt and decrypt the database data, and using multi-layer encryption methods during data transmission, the problem of easy cracking of traditional encryption methods is solved, significantly improving data security sex.
Patent Information
- Application Number
- CN202311054632.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-08-21
- Publication Date
- 2025-02-21
AI Technical Summary
Traditional encryption methods in the prior art may be brute-forced by criminals, which is not conducive to improving data security.
The application backend uses the first key in memory to encrypt and decrypt the database data, and encrypts it through the second key during data transmission, and the third key encrypts the second key to improve the security of the data to improve the data .
It effectively reduces the chance of keys being stolen, improves the security of data in the database, and reduces the chance of data being cracked during transmission.
Smart Images
Figure CN119494123A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data security, and in particular to a data protection method, device, equipment and storage medium. Background Art
[0002] With the development of the Internet, a large amount of personal sensitive information, including personal mobile phone numbers, registered addresses, business addresses, etc., has been collected and stored in different network systems. How to protect the security of this sensitive information has become an important challenge.
[0003] Currently, data protection systems on the market often use traditional encryption technology for data protection. However, traditional encryption methods may be stolen or abused by hackers or other criminals. For example, criminals may use brute force to crack the data, or reversely restore the original data through other methods, which is not conducive to improving data security. Summary of the invention
[0004] In view of this, the embodiments of the present application provide a data protection method, apparatus, device and storage medium to solve the problem in the prior art that traditional encryption methods may be violently cracked by criminals, which is not conducive to improving data security.
[0005] A first aspect of an embodiment of the present application provides a data protection method, which is applied to an application backend, and includes:
[0006] When the application backend reads and writes data in the database, the data in the database is read and written using a preset first key, which is stored in the memory of the application backend;
[0007] When the application backend sends data to the application frontend, the data is encrypted by a preset second key and sent to the application frontend, wherein the second key is encrypted by a preset third key and transmitted between the application frontend and the application backend.
[0008] In combination with the first aspect, in a first possible implementation manner of the first aspect, when the application backend sends data to the application frontend, the data is encrypted by a preset second key and then sent to the application frontend, including:
[0009] determining sensitive data within the data;
[0010] The data is serialized to generate an encrypted string after encryption of the sensitive data and / or a desensitized string after desensitization of the sensitive data, and the encrypted string or the desensitized string is sent to the application front end.
[0011] In combination with the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, determining the sensitive data in the data includes:
[0012] Receiving a marking instruction of a data object configured by a user;
[0013] According to the marking instruction, sensitive data in the data is determined.
[0014] In combination with the first aspect, in a third possible implementation manner of the first aspect, performing a read and write operation on data in a database by using a preset first key includes:
[0015] Intercepting operation requests sent by the application front end;
[0016] When the operation request is a query request, decrypting the sensitive data in the database according to the query request;
[0017] When the operation request is a request to modify data or a request to add data, the sensitive data written into the database is encrypted.
[0018] In combination with the third possible implementation manner of the first aspect, in a fourth possible implementation manner of the first aspect, before decrypting the sensitive data in the database according to the query request, or before encrypting the sensitive data written into the database, the method further includes:
[0019] Configuration information is received, and sensitive data in the data is determined according to the configuration information.
[0020] In a second aspect, an embodiment of the present application proposes a data protection method, which is applied to an application front end and includes:
[0021] The second key is used to encrypt and decrypt sensitive data for transmission to the application backend. The sensitive data encrypted by the second key is received by the application backend, decrypted into plain text data by the second key, and written to the database after being encrypted by the first key, wherein the first key is stored in the memory of the application backend, and the second key is encrypted by a pre-set third key and transmitted between the application frontend and the application backend.
[0022] In conjunction with the second aspect, in a first possible implementation manner of the second aspect, the method further includes:
[0023] Displaying the desensitized string sent by the application backend and a view button corresponding to the desensitized string;
[0024] When the trigger instruction of the view button is received, the desensitized string is decrypted by the second key, and the plain text corresponding to the desensitized string is displayed.
[0025] In combination with the first possible implementation manner of the second aspect, in a second possible implementation manner of the second aspect, before decrypting the desensitized string by using the second key and displaying the plaintext corresponding to the desensitized string, the method further includes:
[0026] Determining the frequency of user access to the sensitive data based on the pre-acquired sensitive data viewing records;
[0027] When the access frequency is greater than a predetermined frequency threshold, a predetermined alarm operation is triggered.
[0028] A third aspect of an embodiment of the present application provides a data protection device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any method described in the first aspect when executing the computer program.
[0029] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described in any one of the first aspects are implemented.
[0030] Compared with the prior art, the embodiments of the present application have the following beneficial effects: when the application backend reads and writes data to the database, the embodiment of the present application uses the first key in the memory to encrypt and decrypt the data, which can effectively reduce the probability of the key being stolen and improve the security of the data in the database. When the data is transmitted between the application backend and the application frontend, the transmitted data is encrypted by the second key, and when the second key is transmitted, it is encrypted by the third key. By encrypting the transmitted data and encrypting the encrypted key, it is helpful to reduce the probability of data being cracked and improve data security. BRIEF DESCRIPTION OF THE DRAWINGS
[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.
[0032] Figure 1 This is a schematic diagram of an application scenario of a data protection method provided in an embodiment of the present application;
[0033] Figure 2It is a schematic diagram of an implementation flow of a data protection method provided in an embodiment of the present application;
[0034] Figure 3 It is a schematic diagram of an implementation flow of a data processing method for an application backend provided in an embodiment of the present application;
[0035] Figure 4 It is a schematic diagram of an implementation flow of a data processing method for an application front end provided in an embodiment of the present application;
[0036] Figure 5 is a schematic diagram of a data protection device provided in an embodiment of the present application;
[0037] Figure 6 It is a schematic diagram of a data protection device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0038] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.
[0039] In order to illustrate the technical solution described in this application, a specific embodiment is provided below for illustration.
[0040] With the development of the Internet, a large amount of personal sensitive data, including personal phone numbers, personal email addresses, personal social accounts, personal addresses, personal financial accounts, etc., has been collected by various network platforms. In order to protect personal privacy, it is necessary to ensure that personal sensitive data will not be illegally stolen. Traditional protection methods include encrypting personal sensitive data using MD5 encryption algorithms. However, through the calculation of big data, encrypted data may be cracked, which is not conducive to ensuring data security.
[0041] Based on this, the present application embodiment proposes a data protection method, such as Figure 1The schematic diagram of the implementation scenario of a data protection method provided by an embodiment of the present application is shown. The implementation scenario includes an application front end, an application back end and a database. Among them, the application front end is used to display data or receive data input by the user. For example, the application front end can display the desensitized data through desensitization; or, verify the user's authority, after obtaining the data viewing authority, decrypt the encrypted data transmitted by the application back end, and display the decrypted plaintext data; or, it can also directly display the desensitized data, receive the user's viewing request through a button, and display the desensitized data as plaintext data according to the viewing request. The application back end can be used to encrypt the data through the first key stored in the memory, transmit and store the encrypted data to the database, or for the data read in the database, the read data can be decrypted by the first key. For example, the application back end obtains the first ciphertext data in the database, decrypts the first plaintext data corresponding to the first ciphertext data through the first key, and then encrypts the second ciphertext data through the second key to obtain the second ciphertext data, and transmits the second ciphertext data to the application front end, and displays the second plaintext corresponding to the second ciphertext data on the application front end according to the user's authority, or displays the desensitized data corresponding to the second ciphertext data. When the second key is transmitted, the third ciphertext is encrypted by the third ciphertext to obtain the third ciphertext data, thereby improving the security of the second key, and thus further improving the security of the data during transmission. The database is used to store the first ciphertext encrypted by the first key. Since the first key for decrypting the first ciphertext is stored in the memory, the probability of the first key being stolen can be effectively reduced, and the security of the data stored in the database can be improved.
[0042] Figure 2 A schematic diagram of the implementation process of a data protection method provided in an embodiment of the present application is described in detail as follows:
[0043] In S201, the application backend performs data read and write operations on the database using a preset first key, where the first key is stored in the memory of the application backend.
[0044] In the embodiment of the present application, the application including the application backend and the application frontend can be any application including personal privacy data. Among them, the application frontend can be used to display the page content of the application. For example, the application frontend can display the content that the application needs to output through a web page or an application interface. Alternatively, the application frontend can also receive the data content input by the user through data collection controls such as tables and buttons. The application backend is used to process the data collected by the application frontend, display the processed data on the application frontend, or store the processed data in a database.
[0045] When the application backend in the embodiment of the present application performs read and write operations on data, it includes read and write operations on the database. The application backend can encrypt the data with the first key to obtain the first ciphertext data, then transmit and store the first ciphertext to the database, and decrypt the first ciphertext with the first key to obtain the plaintext corresponding to the first ciphertext.
[0046] In order to improve the efficiency of data processing, the first key may be a symmetric key or an asymmetric key. When the first key is a symmetric key, the first key may include one of symmetric keys such as a DES key, a 3DES key or an AES key. When a symmetric key is used to encrypt and decrypt data, the key used is the same, and the operation processing speed is fast, which can effectively adapt to the requirements of encryption and decryption processing of a large number of data.
[0047] In order to improve the security of the first secret formula stored in the database, when the first ciphertext is generated in the application backend, the first key can be stored in the memory of the application backend. The data collected by the application frontend is encrypted and transmitted to the application backend by the application frontend, decrypted into the second plaintext data by the second key of the application backend, and then encrypted by the first key in the memory of the application backend. The first key is stored in the memory of the application backend and will not be transmitted on the network. Other applications cannot obtain the first key located in the memory of the application backend, which can reduce the probability of the first ciphertext being cracked.
[0048] In a possible implementation, when the sensitive data in the data collected by the front-end application is persistently stored, only the sensitive data in the data can be encrypted, which can be specifically as follows: Figure 3 As shown, including:
[0049] In S301, the application backend intercepts the operation request sent by the application frontend.
[0050] In an embodiment of the present application, sensitive data tables or sensitive data that need to be encrypted can be pre-configured. For example, sensitive data that needs to be intercepted can be determined by importing a configuration file. An SQL interceptor can be used to intercept operation requests for SQL statements, and the intercepted operation requests can be classified. For example, the operation requests for SQL statements can include query requests, modification requests, and addition requests. Among them, query requests are used to query data in a database. Modification requests require modification of data in the database, and addition requests require adding data to the database.
[0051] In S302, when the operation request is a query request, the application backend decrypts the sensitive data in the database according to the query request.
[0052] When the operation request includes a query request, it means that the data in the database needs to be queried. Therefore, it is necessary to extract the encrypted data (first ciphertext data) in the database, and decrypt the first ciphertext data using the first key to obtain the first plaintext data corresponding to the first ciphertext data.
[0053] In order to improve the efficiency of encryption or decryption, sensitive data or sensitive data tables that need to be encrypted or decrypted can be pre-configured. The sensitive data included in the query request is searched according to the configuration information, and the sensitive data included in the query request is decrypted, thereby reducing the computational complexity of the data decryption operation and improving the data processing efficiency.
[0054] In S303, when the operation request is a modification request or an addition request, the application backend encrypts the sensitive data in the database.
[0055] When the operation request is to modify data in the database, or to add data in the database, since the operation request itself may include added sensitive data, or sensitive data that needs to be modified. The SQL interceptor can be used to intercept and filter, and after determining the sensitive data included therein, the sensitive data therein can be encrypted using a preset first key. The fifth ciphertext data obtained by the encryption process is transmitted and stored in the database. The database can decrypt the fifth ciphertext data to obtain the fifth plaintext data.
[0056] In S202, when the data is transmitted between the application front end and the application back end, the application back end encrypts the data using a preset second key.
[0057] Wherein, the second key is encrypted by a preset third key and transmitted between the application front end and the application back end. The second key can be generated by the application front end, encrypted into third ciphertext data by a third key, and transmitted to the application back end. The second key can also be generated by the application back end, encrypted into third ciphertext data by a third key, and transmitted to the application front end. Transmitting after encryption with the third key can effectively improve the security of the second key during transmission. The second key can be an asymmetric key or a symmetric key. The third key can be pre-set at the application front end and the application back end, and the third key can be a symmetric key or an asymmetric key.
[0058] In the process of interaction between the application front-end and the application back-end, the data returned by the application front-end can be determined through the defined key-value objects. By defining the Form table, the parameters passed in when the application interface is called can be determined.
[0059] In order to enable unified processing, when encrypting and decrypting the data of the application front-end and the application back-end, it can be completed in the serialization and deserialization process of the encrypted or decrypted data object. For example, after decrypting the first ciphertext data to obtain the first plaintext data, it can be encrypted into the second ciphertext data by the second key during the serialization process. During the deserialization process, the application front-end decrypts the second ciphertext data into the second plaintext data by the second key. The data collected by the application front-end can be encrypted into the fourth ciphertext data by the preset fourth key (the fourth key and the second key are a key pair) during the serialization process. During the deserialization process, the application back-end decrypts the fourth ciphertext data into the fourth plaintext data by the second key.
[0060] The second key may be a symmetric key or an asymmetric key. In order to improve the security of data, the data transmitted between the application backend and the application frontend may be encrypted and decrypted by an asymmetric encryption algorithm. This allows the security of the transmitted second ciphertext to be effectively improved when the fourth key of the application frontend is stolen.
[0061] The second key may be generated by the application backend or the application frontend. When the second key is generated by the application backend, the second key may be encrypted by the third key to generate third ciphertext data. The third key may be pre-set for the application frontend and the application backend. The third key may be a key of a symmetric encryption algorithm, i.e., a symmetric key. Through multi-layer encryption, the security of data transmitted between the application frontend and the application backend is improved.
[0062] When the application front end interacts with the application back end, you can Figure 4 As shown, including:
[0063] In S401, the application backend determines sensitive data in the data.
[0064] Among them, sensitive data in the data can be dynamically configured. For example, a user's marking instruction can be received, and sensitive data in the data can be determined based on the annotation information included in the marking instruction. For example, the key name or the data field collected by the table can be marked as sensitive data through annotation information. For example, the key name of the phone number, name, mobile phone number, contact address, and email address can be annotated to determine that the key value corresponding to the key name is sensitive data.
[0065] In S402, the application backend serializes the data to generate an encrypted string after encrypting the sensitive data and / or a desensitized string after desensitizing the sensitive data.
[0066] After determining the sensitive data in the data between the application front end and the application back end, the sensitive data can be encrypted using a second key, including encryption using an asymmetric key to obtain an encrypted string, i.e., the second ciphertext data, and a desensitized string after desensitization processing.
[0067] Among them, desensitizing character strings may include multiple methods, such as desensitizing processing based on statistical technology, cryptographic technology, suppression technology, pseudonymization technology, randomization technology or generalization technology.
[0068] In a possible implementation, after the encrypted string or the desensitized string is generated, S403 and S404 may be further included, and the application front end interacts with the user according to the desensitized string and the encrypted string.
[0069] In S403, the front end of the application displays the desensitized string and a view button corresponding to the desensitized string.
[0070] When the data read from the database is transmitted to the application front end for display, in order to improve the display diversity, the application front end can receive the encrypted string (second ciphertext) and the desensitized string corresponding to the plaintext. For example, after the phone number is desensitized, the desensitized string obtained can be "137****7799". Since the four digits in the middle of the phone number are replaced by "*", the plaintext corresponding to the desensitized string cannot be accurately restored through the desensitized string.
[0071] Since the desensitized string has a certain degree of security, the desensitized string can be directly displayed on the front end of the application, and a trigger instruction for viewing the plain text corresponding to the desensitized string can be received. For example, a view button can be set next to the desensitized string.
[0072] In S404, upon receiving the trigger instruction of the view button, the application front end decrypts the desensitized string by using a preset fourth key and displays the plain text corresponding to the desensitized string.
[0073] When the user triggers the button, the application front end generates a trigger instruction, and on the premise that the user has viewing permission, the second key can be called according to the trigger instruction to decrypt the encrypted string, that is, the second ciphertext data, and the decrypted plaintext, that is, the second plaintext data, is displayed on the application front end.
[0074] In the embodiment of the present application, the logged-in user may be provided with access rights. For example, it may be provided that after the user's username and password are verified, the user may obtain the right to access sensitive data in the database.
[0075] In a possible implementation, different users may be assigned different access rights to sensitive data. When a user accesses sensitive data, the access records of sensitive data of different users may be obtained based on the currently logged-in user information. The access frequency of sensitive data may be determined through the access records of sensitive data. When the access frequency is greater than a predetermined frequency threshold, the user account may be stolen due to the frequent access of the account to the data. An alarm operation may be triggered, and one or more verification methods may be used to determine whether the current user is legitimate. For example, verification may be performed through the QR code of other applications bound to the user, or verification may be performed by sending a verification SMS to the phone number bound to the user. When the access frequency is greater than the predetermined frequency threshold, an alarm message may also be sent to the system administrator, so that the system administrator can promptly check and confirm abnormal access to improve data security.
[0076] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.
[0077] Figure 5 A schematic diagram of a data protection device provided in an embodiment of the present application. Figure 5 As shown, the device is applied to the backend of an application, and the device includes:
[0078] The first interaction unit 501 is used to perform read and write operations on the data in the database by using a preset first key when the application backend reads and writes data in the database. The first key is stored in the memory of the application backend.
[0079] The second interaction unit 502, when the application backend sends data to the application frontend, the data is encrypted by a preset second key and then sent to the application frontend, wherein the second key is encrypted by a preset third key and then transmitted between the application frontend and the application backend.
[0080] The embodiment of the present application also provides a data protection device based on an application front end, including:
[0081] An encryption and decryption unit is used to encrypt and decrypt sensitive data for transmission with an application backend using a second key. The sensitive data encrypted with the second key is received by the application backend, decrypted into plain text data using the second key, and written into a database after being encrypted with a first key, wherein the first key is stored in the memory of the application backend, and the second key is encrypted with a preset third key and transmitted between the application frontend and the application backend.
[0082] The above data protection device, and Figure 2 The data protection method described corresponds.
[0083] Figure 6 Schematic diagram of a data protection device provided by an embodiment of the present application. Figure 6 As shown, the data protection device 6 of this embodiment includes: a processor 60, a memory 61, and a computer program 62 stored in the memory 61 and executable on the processor 60, such as a data protection program. When the processor 60 executes the computer program 62, the steps in the above-mentioned data protection method embodiments are implemented. Alternatively, when the processor 60 executes the computer program 62, the functions of the modules / units in the above-mentioned device embodiments are implemented.
[0084] Exemplarily, the computer program 62 may be divided into one or more modules / units, which are stored in the memory 61 and executed by the processor 60 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program 62 in the data protection device 6.
[0085] The data protection device 6 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The data protection device may include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art will appreciate that Figure 6 It is only an example of the data protection device 6 and does not constitute a limitation of the data protection device 6. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the data protection device may also include input and output devices, network access devices, buses, etc.
[0086] The processor 60 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.
[0087] The memory 61 may be an internal storage unit of the data protection device 6, such as a hard disk or memory of the data protection device 6. The memory 61 may also be an external storage device of the data protection device 6, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the data protection device 6. Further, the memory 61 may also include both an internal storage unit and an external storage device of the data protection device 6. The memory 61 is used to store the computer program and other programs and data required by the data protection device. The memory 61 may also be used to temporarily store data that has been output or is to be output.
[0088] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.
[0089] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.
[0090] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.
[0091] In the embodiments provided in the present application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
[0092] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0093] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
[0094] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the process in the above-mentioned embodiment method, and can also be completed by hardware related to computer program instructions. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.
[0095] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.
Claims
1. A data protection method, characterized in that: The method is applied to an application backend, and comprises: When the application backend reads and writes data in the database, the data in the database is read and written using a preset first key, which is stored in the memory of the application backend; When the application backend sends data to the application frontend, the data is encrypted by a preset second key and sent to the application frontend, wherein the second key is encrypted by a preset third key and transmitted between the application frontend and the application backend.
2. The method according to claim 1, characterized in that When the application backend sends data to the application frontend, the data is encrypted by a preset second key and then sent to the application frontend, including: determining sensitive data within the data; The data is serialized to generate an encrypted string after encryption of the sensitive data and / or a desensitized string after desensitization of the sensitive data, and the encrypted string or the desensitized string is sent to the application front end.
3. The method according to claim 2, characterized in that Identify sensitive data in the data, including: Receiving a marking instruction of a data object configured by a user; According to the marking instruction, sensitive data in the data is determined.
4. The method according to claim 1, characterized in that The data in the database is read and written using a preset first key, including: Intercepting operation requests sent by the application front end; When the operation request is a query request, decrypting the sensitive data in the database according to the query request; When the operation request is a request to modify data or a request to add data, the sensitive data written into the database is encrypted.
5. The method according to claim 4, characterized in that Before decrypting the sensitive data in the database according to the query request, or before encrypting the sensitive data written into the database, the method further includes: Configuration information is received, and sensitive data in the data is determined according to the configuration information.
6. A data protection method, characterized in that: The method is applied to the front end of an application program, and the method comprises: The second key is used to encrypt and decrypt sensitive data for transmission to the application backend. The sensitive data encrypted by the second key is received by the application backend, decrypted into plain text data by the second key, and written to the database after being encrypted by the first key, wherein the first key is stored in the memory of the application backend, and the second key is encrypted by a pre-set third key and transmitted between the application frontend and the application backend.
7. The method according to claim 6, characterized in that The method further comprises: Displaying the desensitized string sent by the application backend and a view button corresponding to the desensitized string; When the trigger instruction of the view button is received, the desensitized string is decrypted by the second key, and the plain text corresponding to the desensitized string is displayed.
8. The method according to claim 7, characterized in that Before decrypting the desensitized string by using the second key and displaying the plain text corresponding to the desensitized string, the method further includes: Determining the frequency of user access to the sensitive data based on the pre-acquired sensitive data viewing records; When the access frequency is greater than a predetermined frequency threshold, a predetermined alarm operation is triggered.
9. A data protection device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.
10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.