Front-end data storage security encryption and decryption method, system and equipment

Abstract

The invention provides a front-end data storage security encryption and decryption method, system and device, and belongs to the field of computer data storage. The method comprises the following steps of: before storing source data into a front-end storage mechanism, performing symmetric encryption on the source data by using a symmetric encryption algorithm, and performing asymmetric encryption on a secret key of the symmetric encryption algorithm by using a public key of an asymmetric encryption algorithm of a receiver; signing the encrypted data by using a private key of an asymmetric encryption algorithm of a receiver to generate signature information; attaching the signature information to the source data to form a signature data packet; and sending the encrypted key of the symmetric encryption algorithm and the signature data packet to a front-end storage mechanism for storage. According to the front-end data storage security encryption method provided by the invention, symmetric encryption and asymmetric encryption are combined, so that the security of front-end data storage is effectively improved, the confidentiality of stored data can be protected, and the risk of data leakage and tampering is reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer data storage, and in particular relates to a method, system and device for front-end data storage security encryption and decryption. Background Art

[0002] With the rapid development of the Internet and mobile applications, front-end data storage has become increasingly important in modern Web applications and mobile applications. The demand for front-end data processing is increasing, and the security of its storage needs more attention. Front-end data storage includes localStorage, sessionStorage, IndexedDB in browsers, and SQLite and file systems in mobile applications. However, these storage mechanisms often lack sufficient security protection, making the data stored in the front-end vulnerable to attacks and theft. Therefore, it is necessary to protect the front-end data during data transmission through encryption. The secure encryption system of front-end data storage is used to efficiently manage and store data in the browser environment.

[0003] At present, front-end data storage mainly relies on mechanisms such as Cookie or LocalStorage provided by the browser. The front-end data security protection methods proposed for the above mechanisms mainly include single encryption, hardware security module (HSM) encryption and key distribution protocol encryption. Single encryption usually uses symmetric encryption algorithms or simple asymmetric encryption algorithms to protect the storage of symmetric encryption keys. Hardware security module (HSM) uses HSM to store and manage keys, providing physical and logical security. Key distribution protocols use special protocols to distribute and manage keys, such as the Diffie-Hellman key exchange protocol.

[0004] Although the above methods can solve the problem of data stored in the front end being attacked and stolen to a certain extent, the existing methods only focus on a single encryption technology or key management method, which is easy to be cracked and attacked, and the security of key management is difficult to guarantee. Summary of the invention

[0005] In order to solve the problems of capacity limitation and poor security in existing front-end data storage, the present invention provides a front-end data storage security encryption method, which ensures the confidentiality, integrity and non-repudiation of data during storage and transmission through the comprehensive application of symmetric encryption, asymmetric encryption and hash algorithms, aiming to improve the security of front-end data.

[0006] In order to achieve the above object, the present invention provides the following technical solutions: A front-end data storage security encryption method, applied to a sender device, comprises the following steps: Get source data; Before storing the source data in the front-end storage mechanism, the source data is symmetrically encrypted using a symmetric encryption algorithm, and the public key of the asymmetric encryption algorithm of the receiver is used to asymmetrically encrypt the key of the symmetric encryption algorithm; Use the private key of the receiver's asymmetric encryption algorithm to sign the encrypted data to generate signature information; attach the signature information to the source data to form a signature data packet; The encrypted key of the symmetric encryption algorithm and the signature data packet are sent together to the front-end storage mechanism for storage.

[0007] Preferably, the symmetric encryption algorithm is an AES symmetric encryption algorithm, and the symmetric encryption algorithm is used to symmetrically encrypt the source data, specifically including: Create an encryptor using the AES key and initialization vector IV; Use the encryptor to symmetrically encrypt the source data and generate ciphertext.

[0008] Preferably, the asymmetric encryption algorithm is an RSA asymmetric encryption algorithm, and the encrypted data is signed using the private key of the asymmetric encryption algorithm of the receiver to generate signature information; the signature information is attached to the source data to form a signature data packet, specifically including: Perform hash operation on the encrypted data to generate a data summary; Use the private key of the asymmetric encryption algorithm to sign the data summary and generate signature information; The signature information is appended to the source data to form a signature data packet.

[0009] The present invention also provides a front-end data storage security encryption system, comprising: A data acquisition module, used for acquiring source data; The encryption module is used to symmetrically encrypt the source data using a symmetric encryption algorithm before storing the source data in the front-end storage mechanism, and asymmetrically encrypt the key of the symmetric encryption algorithm using the public key of the asymmetric encryption algorithm of the receiver; The signature module is used to sign the encrypted data and generate signature information; the signature information is attached to the source data to form a signature data packet; The storage module is used to send the encrypted key of the symmetric encryption algorithm and the signature data packet to the front-end storage mechanism for storage.

[0010] The present invention also provides a front-end data storage security decryption method, which is applied to a receiving device and includes the following steps: When reading data from the front-end storage mechanism, the private key of the asymmetric encryption algorithm is used to decrypt the key of the sender's symmetric encryption algorithm; the decrypted symmetric encryption algorithm is used to decrypt the signature data packet; Use the private key of the asymmetric encryption algorithm to verify the decrypted data and determine whether the data has been tampered with based on the verification results.

[0011] Preferably, the symmetric encryption algorithm is an AES symmetric encryption algorithm, and the decrypted symmetric encryption algorithm is used to decrypt the signature data packet, specifically including: Create a decryptor using the decrypted AES key and initialization vector IV; Use the decryptor to decrypt the signed data packet and restore the source data.

[0012] Preferably, the asymmetric encryption algorithm is an RSA asymmetric encryption algorithm, and the decrypted data is verified using the private key of the asymmetric encryption algorithm, and whether the data has been tampered with is determined according to the verification result, specifically including: Separate the source data and signature information from the decrypted data; Perform hash operation on the separated source data to generate a decrypted data summary; Use the sender's public key to decrypt the signature information and obtain the data summary at the time of signing; Compare the decrypted data digest with the signed data digest. If they are consistent, the verification is successful and the data has not been tampered with.

[0013] The present invention also provides a front-end data storage security decryption system, comprising: The decryption module is used to decrypt the key of the symmetric encryption algorithm of the sender using the private key of the asymmetric encryption algorithm when reading data from the front-end storage mechanism; and decrypt the signature data packet using the decrypted symmetric encryption algorithm; The verification module is used to verify the decrypted data using the private key of the asymmetric encryption algorithm and determine whether the data has been tampered with based on the verification result.

[0014] The present invention also provides a computer device, including a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement any of the steps in the front-end data storage security encryption and decryption method.

[0015] The present invention also provides a computer-readable storage medium, on which a computer program is stored, characterized in that when the computer program is loaded by a processor, it can execute any step of the front-end data storage security encryption and decryption method.

[0016] The front-end data storage security encryption method provided by the present invention has the following beneficial effects: The present invention adopts a hybrid encryption scheme, first symmetric encryption of data, and then asymmetric encryption of the symmetric encryption key, providing a double-layer protection mechanism. Even if an attacker obtains the encrypted data and the stored key, it is difficult to decrypt the data. By combining symmetric encryption with asymmetric encryption, the efficiency of data encryption is guaranteed and the security of key management is improved. At the same time, the asymmetric encryption algorithm is used to implement data signing and verification functions to ensure the integrity and non-repudiation of data during transmission and storage. The decryption process is the opposite, and it can effectively determine whether the data has been tampered with. Therefore, the present invention effectively improves the security of front-end data storage by combining symmetric encryption and asymmetric encryption, and can protect the confidentiality of stored data, thereby reducing the risk of data leakage and tampering. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiment of the present invention and its design scheme, the following briefly introduces the drawings required for this embodiment. The drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 This is a flow chart of a front-end data storage security encryption method according to Embodiment 1 of the present invention; Figure 2 A block diagram of a front-end data storage security encryption system according to Embodiment 1 of the present invention; Figure 3 This is a flow chart of a front-end data storage security decryption method according to Embodiment 2 of the present invention; Figure 4 This is a block diagram of a front-end data storage security decryption system according to Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to better understand the technical solution of the present invention and implement it, the present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the scope of protection of the present invention.

[0020] Example 1 Specific as Figure 1 As shown, the front-end data storage security encryption method provided by the present invention is applied to the sender device, comprising the following steps: Step 1: Key management: Use the Web Cryptography API to generate and manage key pairs. This embodiment involves the use of symmetric encryption algorithms (such as AES) and asymmetric encryption algorithms (such as RSA), including RSA public-private key pairs and AES symmetric keys.

[0021] Specifically, the present invention uses a hardware security module HSM to store and manage keys, providing physical and logical security, and uses a special key distribution protocol to distribute and manage keys, such as the Diffie-Hellman key exchange protocol.

[0022] Step 2: Get the source data and encrypt it: Before storing the source data in the front-end storage mechanism (such as localStorage), use the AES symmetric key to encrypt the data. Encrypt sensitive data before storage; and use the receiver's RSA asymmetric encryption algorithm public key to asymmetrically encrypt the AES symmetric encryption algorithm key. Use RSA public key encryption to store AES symmetric keys to ensure the security of the keys during storage and transmission.

[0023] Use the AES symmetric encryption algorithm to perform symmetric encryption on the source data, including: Step 2.1. Import the required libraries: Use the Cipher module in the cryptography library for AES encryption.

[0024] Step 2.2, create an encryptor object: Create an encryptor using the AES key and initialization vector IV.

[0025] Step 2.3, Encrypt data: Use the encryptor to encrypt the source data and generate ciphertext.

[0026] Step 2.4, Generate Authentication Tag (only applicable to GCM mode): In GCM mode, the generated authentication tag is used to ensure the integrity and authenticity of the data.

[0027] Step 3: Data signature: Use the recipient's RSA asymmetric encryption algorithm private key to sign the encrypted data to generate signature information; attach the signature information to the source data to form a signature data packet to ensure the integrity and non-repudiation of the data.

[0028] The data signature is as follows: Step 3.1, Generate data summary: Perform hash operation on the encrypted data to generate a data summary.

[0029] Step 3.2, Signature summary: Use the sender's private key to sign the data summary to generate signature information.

[0030] Step 3.3: Attach signature: Attach the signature information to the source data to form a signature data packet.

[0031] Existing signature methods mainly focus on data integrity and source reliability, while the method of the present invention not only realizes data signing and verification, but also combines data encryption, and protects the symmetric encryption key (i.e., AES key) through the RSA asymmetric encryption algorithm, thereby further enhancing data security.

[0032] The method of the present invention uses an asymmetric encryption algorithm to asymmetrically encrypt and protect the symmetric key while signing the data, ensuring the safe storage and management of the key. This combination of encryption and signing provides double protection, prevents data from being tampered with, ensures key security, and strengthens key management.

[0033] Step 4: Send the encrypted symmetric encryption algorithm key and signature data packet to the front-end storage mechanism for storage.

[0034] Based on the same inventive concept, this embodiment also provides a front-end data storage security encryption system, such as Figure 2 As shown, it includes a data acquisition module 101, an encryption module 102, a signature module 103 and a storage module 104.

[0035] Specifically, the data acquisition module 101 is used to acquire source data. The encryption module 102 is used to use a symmetric encryption algorithm to symmetrically encrypt the source data before storing the source data in the front-end storage mechanism, and use the public key of the asymmetric encryption algorithm of the receiver to asymmetrically encrypt the key of the symmetric encryption algorithm. The signature module 103 is used to sign the encrypted data and generate signature information; the signature information is attached to the source data to form a signature data packet. The storage module is used to send the encrypted key of the symmetric encryption algorithm and the signature data packet to the front-end storage mechanism for storage.

[0036] Each module in the above-mentioned front-end data storage security encryption system can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0037] Example 2 Based on the encryption method provided in the embodiment, this embodiment also provides a front-end data storage security decryption method, which is applied to the receiving device, such as Figure 3 As shown, the following steps are included: Step 1, data decryption: When reading data from the front-end storage mechanism, the private key of the RSA asymmetric encryption algorithm is used to decrypt the key of the sender's AES symmetric encryption algorithm; the decrypted AES symmetric encryption algorithm is used to decrypt the signature data packet. When the present invention reads data from the storage, it first performs decryption processing to ensure that the data can be used normally. The present invention implements the encryption and decryption functions of the front-end data by using a symmetric encryption algorithm (i.e., AES), ensuring that the data is encrypted during the storage process, thereby preventing unauthorized access. The present invention can use the RSA private key to decrypt the AES symmetric key when necessary to restore the data decryption capability, ensuring that only the party that legally owns the private key can decrypt and use the symmetric key.

[0038] The decrypted symmetric encryption algorithm is used to decrypt the signature data packet, including: Step 1.1. Import the required libraries: Use the Cipher module in the cryptography library for AES decryption.

[0039] Step 1.2. Create a decryptor object: Create a decryptor using the AES key, initialization vector IV, and authentication tag (if GCM mode is used).

[0040] Step 1.3, decrypt data: Use the decryptor to decrypt the signature data packet and restore the source data.

[0041] Step 2: Use the private key of the RSA asymmetric encryption algorithm to verify the decrypted data and determine whether the data has been tampered with based on the verification result.

[0042] The signature verification is as follows: Step 2.1, Separate data and signature: After receiving the signed data packet, the receiver separates the source data and signature information from the decrypted data.

[0043] Step 2.2, generate data summary: perform hash operation on the separated source data to generate a decrypted data summary.

[0044] Step 2.3, verify the signature: use the sender's public key to decrypt the signature information and obtain the data summary at the time of signing.

[0045] Step 2.4, compare digests: Compare the decrypted data digest with the data digest when signing. If they are consistent, the verification is successful and the data has not been tampered with.

[0046] Based on the same inventive concept, this embodiment also provides a front-end data storage security decryption system, such as Figure 4 As shown, it includes a decryption module 201 and a verification module 202.

[0047] Specifically, the decryption module 201 is used to use the private key of the asymmetric encryption algorithm to decrypt the key of the symmetric encryption algorithm of the sender when reading data from the front-end storage mechanism; and use the decrypted symmetric encryption algorithm to decrypt the signature data packet. The verification module 202 is used to use the private key of the asymmetric encryption algorithm to verify the decrypted data, and determine whether the data has been tampered with according to the verification result.

[0048] Each module in the above-mentioned front-end data storage security decryption system can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0049] The data signature and verification method of the present invention provides a more secure and efficient data protection solution by combining data encryption and signature, strengthening key management, etc. Compared with the existing methods, the present invention not only ensures data integrity and source reliability, but also enhances the security of the key to prevent security risks caused by key leakage. The present invention uses an asymmetric encryption algorithm to implement data signature and verification functions to ensure the integrity and non-repudiation of data during transmission and storage. Through signature and verification, data can be prevented from being tampered with and the source of the data can be verified.

[0050] In the specific implementation process of the present invention, the signature method can be optimized in combination with specific application scenarios. For example, the efficiency of signature and verification can be improved and the performance overhead can be reduced by means of parallel computing, hardware acceleration, etc.

[0051] AES encryption optimization can be achieved through a variety of methods to improve encryption speed, reduce resource consumption or enhance security. The AES encryption optimization method provided in this embodiment includes the following steps: Store and process data in rows rather than columns to accommodate the memory access patterns of modern CPUs, reduce cycle times, and improve cache utilization.

[0052] Optimize algorithm implementation: for example, use more efficient search or calculation methods in S-box replacement (SubBytes).

[0053] Optimize key management: Optimize the key generation, storage and distribution process to reduce the overhead of key management.

[0054] For scenarios that require extremely high security, use HSM to handle encryption and decryption operations to provide stronger security.

[0055] The hash algorithm is used in both RSA encryption and AES encryption provided by the present invention. The hash algorithm is mainly used in OAEP padding mode to ensure the security of the encryption process and prevent certain attacks. In AES-GCM encryption, a similar hashing process is indirectly used in the process of generating authentication tags in GCM mode for data integrity verification.

[0056] The front-end data storage security encryption method proposed in the present invention effectively improves the security of front-end data storage by combining symmetric encryption, asymmetric encryption and hash algorithm. The front-end data storage security encryption and decryption method provided by the present invention can achieve the following functions: 1. Combined encryption method The present invention not only uses a single encryption technology, but also applies symmetric encryption (AES), asymmetric encryption (RSA) and data signature (RSA-PSS) to front-end data storage. Through this combination, the confidentiality, integrity and non-repudiation of data can be guaranteed at the same time.

[0057] 2. Key protection and management The present invention proposes an effective key protection and management scheme, that is, AES symmetric keys are stored by RSA public key encryption, and AES keys are restored by RSA private key decryption when needed, which simplifies the key management and distribution process and reduces the risk of key leakage. This method ensures the security of AES keys during storage. Even if the storage medium is compromised, it is difficult to obtain the actual AES keys, thereby improving the security of the overall system.

[0058] 3. Data signing and verification The present invention adds data signing and verification steps on the basis of data encryption and decryption. Using the RSA asymmetric encryption algorithm to sign the data can ensure the integrity of the data during transmission and storage, and prevent the data from being tampered with. This multi-level protection mechanism significantly improves the security and credibility of the data.

[0059] 4. The present invention applies encryption technology efficiently to front-end data storage security encryption, especially in localStorage, sessionStorage and IndexedDB in the browser environment, which is still a challenge. The encryption method proposed in the present invention is particularly suitable for the front-end data storage security encryption environment, which effectively solves the problem of front-end data security protection.

[0060] The secure encryption and decryption method proposed in this invention has a wide range of application scenarios, including but not limited to browser storage (such as localStorage, sessionStorage, IndexedDB) and client application storage (such as SQLite in mobile applications). Storage security is reflected in ensuring the encryption status of data in local storage. Transmission security is reflected in ensuring the security of data during network transmission through signing and encryption. It mainly includes the following aspects: (1) Application in Web Applications In modern web applications, it is often necessary to store user data on the front end to improve user experience and performance. However, the security of front-end storage has always been an important consideration. AES (Advanced Encryption Standard) encryption is widely used in web applications, mainly to ensure the security of data transmission and storage. The following are common application scenarios of AES in web applications and their detailed descriptions: 1. HTTPS encryption Scenario: Data transfer between a web browser and a server.

[0061] Description: HTTPS (Hypertext Transfer Protocol Secure) is a secure version of HTTP, which usually uses the TLS / SSL protocol to encrypt communications. The TLS protocol uses AES in the symmetric encryption part of its encryption process. The browser and the server negotiate and generate a symmetric key (such as an AES key) during the TLS handshake process, and then use the key to encrypt subsequent data.

[0062] process: The client (browser) and the server shake hands through an asymmetric encryption algorithm (such as RSA) to negotiate and generate a symmetric key.

[0063] This symmetric key is used to encrypt all communications between the client and the server.

[0064] AES ensures that transmitted data cannot be intercepted or tampered with en route.

[0065] 2. Data storage encryption Scenario: Data storage in a database or file system in a web application.

[0066] Note: In order to protect sensitive information in the database (such as user passwords, personal information, etc.), Web applications usually use AES to encrypt data before storing it in the database or file system. In this way, even if the database is leaked, the data is encrypted and difficult for attackers to read directly.

[0067] process: When a user submits sensitive information (such as a registration password), the application generates an AES key.

[0068] The data is encrypted using an AES key and then stored in the database.

[0069] When the data needs to be read, the application decrypts the data using the same AES key.

[0070] Note: AES keys should be stored securely (e.g. using an HSM or KMS) and key management should be strictly controlled to prevent leakage.

[0071] 3. API Data Encryption Scenario: API communication between client and server.

[0072] Note: In some cases, especially in API calls for sensitive data transmission, in addition to relying on HTTPS encrypted transmission, developers may also use AES to encrypt API data at the application layer. In this way, even if the HTTPS encryption layer is breached, the data is still safe.

[0073] process: Before sending an API request, the client uses an AES key to encrypt the request data.

[0074] After receiving the encrypted request data, the server uses the same AES key to decrypt the data and process the request.

[0075] The server encrypts the data using the AES key in the response, and the client decrypts and processes the response after receiving it.

[0076] The above operations can ensure data security in the following scenarios, as follows: User authentication information: When storing JWT or other authentication tokens, use encryption technology to ensure that they are not leaked.

[0077] User preferences: Store user personalized settings, such as themes, languages, etc., to ensure that this data cannot be tampered with or stolen.

[0078] Form data: Temporarily store form data entered by users (such as complex forms that take a long time to fill out) to ensure the security and integrity of the data.

[0079] (2) Mobile applications In mobile applications, the security of front-end data storage and encryption is equally important, especially in applications that require offline functionality, as follows: Offline Cache: Use encryption technology to protect offline data, ensuring that data remains safe even if the device is lost or stolen.

[0080] Local database: Store sensitive information such as user records, transaction history, etc. in a local database (such as SQLite), and use encryption technology to ensure data security.

[0081] Sensitive file storage: For some sensitive files that need to be stored locally (such as photos, documents, etc.), the file content is protected by encryption.

[0082] (3) E-commerce platform In e-commerce platforms, the front-end data storage and secure encryption may include shopping cart information, user preferences, browsing history, etc. If these data are leaked, it may have a serious impact on user privacy and platform security, as follows: Shopping cart information: Encrypt and store the user's shopping cart data to prevent malicious tampering.

[0083] Payment information: Although it is not recommended to store secure encrypted payment information in front-end data, if you need to temporarily save certain payment-related data, you can protect it through encryption.

[0084] User behavior data: Ensure the privacy and security of data when storing and analyzing user behavior data.

[0085] (4) Social media platforms Social media platforms usually store a large amount of user data, including message records, user preferences, friend lists, etc. If this data is leaked, it may have a significant impact on user privacy, as follows: Message history: Temporarily stores the user's message history and encrypts it to prevent the information from being stolen.

[0086] User settings: Store user privacy settings, notification settings, etc. to ensure the security of setting data.

[0087] Multimedia content: Encrypt and store multimedia content such as photos and videos uploaded by users to protect user privacy.

[0088] (5) Financial services applications Financial service applications involve users' sensitive financial data, such as transaction records, account information, etc. The security of this data is of vital importance, as follows: Transaction records: When storing user transaction records in front-end data for security encryption, encryption technology is used to protect data and prevent leakage.

[0089] Account information: Encrypt and store user account information, balance, etc. to ensure the security of this data.

[0090] Temporary cache: When it is necessary to cache the user's financial operation data, ensure the security of the data through encryption.

[0091] (6) Medical and health applications Medical and health applications involve users' health data, medical records, etc. The privacy protection of these data is particularly important, as follows: Health records: Encrypted storage of users’ health records, medical records, etc. to ensure that data will not be leaked or tampered with.

[0092] Drug information: Stores users’ drug usage information to ensure data security and privacy.

[0093] Appointment information: Encrypt and store the user's medical appointment information to prevent data leakage or tampering.

[0094] (7) Educational Platform In an education platform, it may be necessary to store students’ learning records, test scores, etc. The security and privacy protection of this data are also important, as follows: Learning records: Encrypted storage of students’ learning progress, course records, etc. to ensure data security.

[0095] Grade information: Store students’ test scores, comments, etc. to protect data privacy.

[0096] Personalized recommendations: Store and analyze students’ learning behavior data to provide personalized learning recommendations while ensuring data security.

[0097] In summary, the present invention provides multi-level security protection for front-end data storage by comprehensively applying multiple encryption technologies, and is suitable for various application scenarios that require the secure encryption of sensitive data in front-end data storage. Whether it is web applications, mobile applications, or e-commerce, social media, financial services, medical health and education platforms, this technology can effectively improve the security of data storage, protect user privacy, and prevent data leakage and tampering.

[0098] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps in the embodiments of the front-end data storage security encryption method and the decryption method. The specific implementation method can be found in the method embodiment, which will not be repeated here.

[0099] Furthermore, the present invention also provides a non-temporary computer-readable storage medium containing instructions, and a computer program is stored on the storage medium. For example, a memory containing instructions, the above instructions can be executed by a processor of a computer device to complete the above method. For example, a non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device. When the computer program is executed by the processor, the steps in the embodiments of the front-end data storage security encryption method and the decryption method can be implemented. The specific implementation method can be found in the method embodiment, which will not be repeated here.

[0100] It should be understood by those skilled in the art that embodiments of the present invention may provide methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0101] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0102] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0103] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0104] It should be pointed out that the specific implementation methods described above can enable those skilled in the art to understand the invention more comprehensively, but do not limit the invention in any way. Therefore, although the invention has been described in detail in this specification and embodiments, those skilled in the art should understand that the invention can still be modified or replaced by equivalents; and all technical solutions and improvements that do not deviate from the spirit and scope of the invention are included in the protection scope of the invention. Any figure mark in the claims should not be regarded as limiting the claims involved. Any simple change or equivalent replacement of the technical solution that can be obviously obtained by any technician familiar with the field within the technical scope disclosed in the present invention belongs to the protection scope of the present invention.

Claims

1. A front-end data storage security encryption method, characterized in that: Applied to the sending device, including the following steps: Get source data; Before storing the source data in the front-end storage mechanism, the source data is symmetrically encrypted using a symmetric encryption algorithm, and the public key of the asymmetric encryption algorithm of the receiver is used to asymmetrically encrypt the key of the symmetric encryption algorithm; Use the private key of the receiver's asymmetric encryption algorithm to sign the encrypted data to generate signature information; attach the signature information to the source data to form a signature data packet; The encrypted key of the symmetric encryption algorithm and the signature data packet are sent together to the front-end storage mechanism for storage.

2. The front-end data storage security encryption method according to claim 1 is characterized in that: The symmetric encryption algorithm is the AES symmetric encryption algorithm, and the symmetric encryption algorithm is used to symmetrically encrypt the source data, specifically including: Create an encryptor using the AES key and initialization vector IV; Use the encryptor to symmetrically encrypt the source data and generate ciphertext.

3. The front-end data storage security encryption method according to claim 1 is characterized in that: The asymmetric encryption algorithm is an RSA asymmetric encryption algorithm, and the encrypted data is signed using the private key of the asymmetric encryption algorithm of the recipient to generate signature information; The signature information is attached to the source data to form a signature data packet, which includes: Perform hash operation on the encrypted data to generate a data summary; Use the private key of the asymmetric encryption algorithm to sign the data summary and generate signature information; The signature information is appended to the source data to form a signature data packet.

4. A front-end data storage security encryption system, characterized in that: include: A data acquisition module, used for acquiring source data; The encryption module is used to symmetrically encrypt the source data using a symmetric encryption algorithm before storing the source data in the front-end storage mechanism, and asymmetrically encrypt the key of the symmetric encryption algorithm using the public key of the asymmetric encryption algorithm of the receiver; Signature module, used to sign the encrypted data and generate signature information; The signature information is attached to the source data to form a signature data packet; The storage module is used to send the encrypted key of the symmetric encryption algorithm and the signature data packet to the front-end storage mechanism for storage.

5. A front-end data storage security decryption method, characterized in that: Applied to the receiving device, including the following steps: When reading data from the front-end storage mechanism, the private key of the asymmetric encryption algorithm is used to decrypt the key of the sender's symmetric encryption algorithm; the decrypted symmetric encryption algorithm is used to decrypt the signature data packet; Use the private key of the asymmetric encryption algorithm to verify the decrypted data and determine whether the data has been tampered with based on the verification results.

6. The front-end data storage security decryption method according to claim 5 is characterized in that: The symmetric encryption algorithm is the AES symmetric encryption algorithm, and the decrypted symmetric encryption algorithm is used to decrypt the signature data packet, specifically including: Create a decryptor using the decrypted AES key and initialization vector IV; Use the decryptor to decrypt the signed data packet and restore the source data.

7. The front-end data storage security decryption method according to claim 5 is characterized in that: The asymmetric encryption algorithm is an RSA asymmetric encryption algorithm. The decrypted data is verified using the private key of the asymmetric encryption algorithm. Whether the data has been tampered with is determined based on the verification result, specifically including: Separate the source data and signature information from the decrypted data; Perform hash operation on the separated source data to generate a decrypted data summary; Use the sender's public key to decrypt the signature information and obtain the data summary at the time of signing; Compare the decrypted data digest with the signed data digest. If they are consistent, the verification is successful and the data has not been tampered with.

8. A front-end data storage security decryption system, characterized in that: include: The decryption module is used to decrypt the sender's symmetric encryption algorithm key using the private key of the asymmetric encryption algorithm when reading data from the front-end storage mechanism; Decrypt the signature data packet using the decrypted symmetric encryption algorithm; The verification module is used to verify the decrypted data using the private key of the asymmetric encryption algorithm and determine whether the data has been tampered with based on the verification result.

9. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the front-end data storage security encryption method according to any one of claims 1 to 3 or the steps of the front-end data storage security decryption method according to any one of claims 5 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is loaded by a processor, it is capable of executing the steps of the front-end data storage security encryption method described in any one of claims 1 to 3 or the steps of the front-end data storage security decryption method described in any one of claims 5 to 7.

Images