Target data processing method, electronic equipment and computer readable storage medium

Abstract

The invention discloses a target data processing method, electronic equipment and a computer readable storage medium, the method is applied to a data protection system, the data protection system comprises a client side, a server side and a management server, and the method comprises the following steps: encrypting target data by using the client side, obtaining a storage ciphertext and a storage key corresponding to the target data; wherein the storage key is split into a first sub-storage key and a second sub-storage key; sending the storage ciphertext and the first sub-storage key to a management server by using the client, and sending the second sub-storage key to a server; sending the received second sub-storage key to the management server by using the server; and decrypting the storage ciphertext based on the first sub-storage key and the second sub-storage key by using the management server to obtain the target data, and storing the target data. According to the scheme, the security of target data transmission can be improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a target data processing method, an electronic device, and a computer-readable storage medium. Background Art

[0002] In current Internet services, the client will directly store the target data that needs to be protected on the server, and transmit it to the server in encrypted or plain text form, so that the server can manage it. After encrypting the data, the corresponding key will also be transmitted to the server, so that the server developers have the opportunity to access the target data that needs to be protected, increasing the risk of target data leakage. In view of this, how to improve the security of target data transmission has become an urgent problem to be solved. Summary of the invention

[0003] The main technical problem solved by the present application is to provide a target data processing method, an electronic device and a computer-readable storage medium, which can improve the security of target data transmission.

[0004] To solve the above technical problems, the first aspect of the present application provides a data processing method, which is applied to a data protection system, wherein the data protection system includes a client, a server and a management server, and the method includes: using the client to encrypt the target data to obtain a storage ciphertext and a storage key corresponding to the target data; wherein the storage key is split into a first sub-storage key and a second sub-storage key; using the client to send the storage ciphertext and the first sub-storage key to the management server, and sending the second sub-storage key to the server; using the server to send the received second sub-storage key to the management server; using the management server to decrypt the storage ciphertext based on the first sub-storage key and the second sub-storage key to obtain the target data and store it.

[0005] To solve the above technical problem, the second aspect of the present application provides an electronic device, comprising a memory and a processor coupled to each other, wherein the memory stores program instructions, and the processor is used to execute the program instructions to implement the method described in the first aspect.

[0006] In order to solve the above technical problem, the third aspect of the present application provides a computer-readable storage medium, which stores program instructions that can be executed by a processor, and the program instructions are used to implement the method described in the first aspect above.

[0007] The above scheme uses the client to encrypt the target data to obtain the storage ciphertext and storage key corresponding to the target data, and the storage key will be split into a first sub-storage key and a second sub-storage key. The client sends the storage ciphertext and the first sub-storage key to the management server, and the client sends the second sub-storage key to the server. The server sends the second sub-storage key sent by the client to the management server, and the management server decrypts the storage ciphertext based on the first sub-storage key and the second sub-storage key to obtain the corresponding target data and store the target data. By splitting the storage key for transmission, the complete storage key will not appear in the network communication link at the same time, which effectively reduces the impact of key leakage during the transmission process. In addition, a management server is introduced to store the target data, so that the server can never obtain the target data and can only access part of the storage key, thereby improving the security of target data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0009] Figure 1 It is a flowchart of an implementation method of the target data processing method of the present application;

[0010] Figure 2 It is a transmission schematic diagram of an implementation method of the target data processing method of the present application;

[0011] Figure 3 It is a flowchart of another implementation method of the target data processing method of the present application;

[0012] Figure 4 It is a transmission schematic diagram of another implementation method of the target data processing method of the present application;

[0013] Figure 5 It is a flowchart of another implementation method of the target data processing method of the present application;

[0014] Figure 6 It is a transmission schematic diagram of another implementation method of the target data processing method of the present application;

[0015] Figure 7 It is a structural schematic diagram of an embodiment of the electronic device of the present application;

[0016] Figure 8 It is a structural schematic diagram of an implementation method of a computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments, and different implementation methods can be adaptively combined. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0018] The terms "system" and "network" are often used interchangeably in this article. The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship. In addition, "many" in this article means two or more than two.

[0019] The target data processing method provided in the present application is applied to the data protection system 10 , and its corresponding execution subject is the processing unit of the data protection system 10 or the processing terminal capable of calling the data protection system 10 .

[0020] Please also read Figure 1 and Figure 2 , Figure 1 is a flowchart of an implementation method of the target data processing method of the present application, Figure 2 1 is a transmission diagram of an embodiment of a target data processing method of the present application. The data protection system 10 includes a client 100, a server 101 and a management server 102. The target data is data that needs to be encrypted and protected. The target data processing method includes:

[0021] S101: Encrypt target data using a client to obtain storage ciphertext and storage key corresponding to the target data; wherein the storage key is split into a first sub-storage key and a second sub-storage key.

[0022] Specifically, the target data is encrypted using the client 100 to obtain a storage ciphertext and a storage key corresponding to the target data, and the storage key is split into a first sub-storage key and a second sub-storage key.

[0023] Optionally, the first sub-storage key is a part of the storage key, and the second sub-storage key is the remaining part of the storage key. For example, when the first sub-storage key is the first half of the storage key, the second sub-storage key is the second half of the storage key. When the first sub-storage key is the first 1 / 4 of the storage key, the second sub-storage key is the last 3 / 4 of the storage key. In other words, this application does not impose specific restrictions on how to split the storage key.

[0024] In one application, the client 100 is used to symmetrically encrypt the target data to generate a corresponding storage key, and the storage key is used to encrypt the target data to obtain a corresponding storage ciphertext, and the storage key is split into a first sub-storage key and a second sub-storage key.

[0025] In one application scenario, the client 100 uses a symmetric encryption algorithm to symmetrically encrypt the target data, generate a shared storage key, and use the shared storage key to encrypt the target data to obtain the corresponding storage ciphertext, and the shared storage key will be split by the client 100 into a first sub-storage key and a second sub-storage key.

[0026] In a specific application scenario, the client 100 uses the CBC (Cipher Block Chaining) mode or the CTR (Counter) mode of the AES (Advanced Encryption Standard) encryption algorithm to encrypt the target data that needs to be encrypted and protected, generates a shared storage key, and uses this shared storage key to encrypt the target data to obtain the corresponding storage ciphertext, and the shared storage key will be split by the client 100 into a first half storage key and a second half storage key.

[0027] In another application method, the client 100 is used to symmetrically encrypt the target data to generate a corresponding storage key, and before using the storage key to encrypt the target data, a message authentication code is added. The target data is encrypted based on the storage key and the message authentication code to obtain the corresponding storage ciphertext, and the storage key will be split into a first sub-storage key and a second sub-storage key, thereby further improving the security of target data transmission.

[0028] S102: Using the client, the storage ciphertext and the first sub-storage key are sent to the management server, and the second sub-storage key is sent to the service end.

[0029] Specifically, the client 100 is used to send the storage ciphertext and the first sub-storage key to the management server 102 , and the client 100 is used to send the second sub-storage key to the service end 101 .

[0030] In one application mode, the client 100 is used to directly send the storage ciphertext and the first sub-storage key to the management server 102 , and the client 100 is used to directly send the second sub-storage key to the service end 101 .

[0031] In another application method, the client 100 is used to divide the stored ciphertext into multiple sub-files, and after associating the multiple sub-files with the first sub-storage key respectively, they are sent in segments to the management server 102, and the client 100 is used to send the second sub-storage key directly to the server 101. By dividing the stored ciphertext into multiple sub-files and sending them in segments, not only the security of data transmission can be improved, but also the target data can be effectively prevented from being intercepted and cracked during the transmission process.

[0032] S103: Using the server, the received second sub-storage key is sent to the management server 102 .

[0033] Specifically, the server 101 sends the second sub-storage key received from the client 100 to the management server 102 .

[0034] S104: Using the management server to decrypt the stored ciphertext based on the first sub-storage key and the second sub-storage key, obtain the target data and store it.

[0035] Specifically, the management server 102 is used to decrypt the storage ciphertext based on the first sub-storage key and the second sub-storage key to obtain the corresponding target data and store the target data in the database of the management server 102 .

[0036] In one application, the management server 102 is used to merge the first sub-storage key and the second sub-storage key into a complete storage key, and the storage ciphertext is decrypted using the complete storage key to obtain the corresponding target data and store the target data in the database of the management server 102.

[0037] In another application method, the management server 102 is used to merge the first sub-storage key and the second sub-storage key into a complete storage key, and obtain the message authentication code sent by the client 100, and use the complete storage key and the message authentication code to decrypt the storage ciphertext to obtain the corresponding target data and store the target data in the database of the management server 102.

[0038] In the above scheme, the target data is encrypted by the client 100 to obtain the storage ciphertext and storage key corresponding to the target data, and the storage key is split into a first sub-storage key and a second sub-storage key, the storage ciphertext and the first sub-storage key are sent to the management server 102 by the client 100, and the second sub-storage key is sent to the server 101 by the client 100, the server 101 sends the second sub-storage key received from the client 100 to the management server 102, the management server 102 decrypts the storage ciphertext based on the first sub-storage key and the second sub-storage key, obtains the corresponding target data and stores the target data, by splitting the storage key for transmission, the complete storage key will not appear in the network communication link at the same time, effectively reducing the impact of key leakage during the transmission process, and introducing a management server 102 for storing the target data, so that the server 101 can never obtain the target data and can only access part of the storage key, thereby improving the security of target data transmission.

[0039] Please also read Figure 3 and Figure 4 , Figure 3 is a flowchart of another implementation method of the target data processing method of the present application, Figure 4 It is a transmission diagram of another embodiment of the target data processing method of the present application. The client 100 corresponds to an authentication identifier, wherein the authentication identifier is unique. The method includes:

[0040] S301: Use the client to establish a connection with the server based on the authentication identifier.

[0041] Specifically, the client 100 is used to establish a trusted connection with the server 101 based on the authentication identifier corresponding to the client 100 .

[0042] S302: Using the client to establish a connection with the management server based on the authentication identifier.

[0043] Specifically, the client 100 is used to establish a trusted connection with the management server 102 based on the authentication identifier corresponding to the client 100 .

[0044] S303: Encrypt the target data using the client to obtain a storage ciphertext and a storage key corresponding to the target data; wherein the storage key is split into a first sub-storage key and a second sub-storage key.

[0045] Specifically, the target data is encrypted using the client 100 to obtain a storage ciphertext and a storage key corresponding to the target data, and the storage key is split into a first sub-storage key and a second sub-storage key.

[0046] S304: Using the client, the storage ciphertext and the first sub-storage key are sent to the management server, and the second sub-storage key is sent to the service end.

[0047] Specifically, the client 100 is used to send the storage ciphertext and the first sub-storage key to the management server 102 , and the client 100 is used to send the second sub-storage key to the service end 101 .

[0048] S305: Using the server, the received second sub-storage key is sent to the management server.

[0049] Specifically, the server 101 sends the second sub-storage key received from the client 100 to the management server 102 .

[0050] S306: Using the management server to confirm the corresponding client based on the authentication identifier, obtain the storage ciphertext, the first sub-storage key and the authentication identifier sent by the client, and obtain the second sub-storage key sent by the server.

[0051] Specifically, the management server 102 confirms the validity of the corresponding client 100 based on the authentication identifier, thereby obtaining the storage ciphertext, the first sub-storage key and the authentication identifier corresponding to the client 100 sent by the client 100, and obtaining the second sub-storage key sent by the server 101.

[0052] S307: Using the management server to decrypt the stored ciphertext based on the first sub-storage key and the second sub-storage key, obtain the target data and store it.

[0053] Specifically, the management server 102 is used to decrypt the storage ciphertext based on the first sub-storage key and the second sub-storage key to obtain the corresponding target data and store the target data in the database of the management server 102 .

[0054] In one application mode, the management server 102 is used to merge the first sub-storage key and the second sub-storage key into a storage key; the management server 102 is used to decrypt the storage ciphertext based on the storage key to obtain the target data; and the management server 102 is used to store the target data based on the authentication identifier.

[0055] Specifically, the management server 102 is used to merge the first sub-storage key and the second sub-storage key into a complete storage key, and the management server 102 is used to decrypt the storage ciphertext based on the complete storage key. After obtaining the target data, the target data is stored in the database of the management server 102 based on the authentication identifier of the client 100.

[0056] The above scheme can improve the portability of data processing by adding an authentication identifier corresponding to the client 100 to transmit and store the target data, and the corresponding client 100 can be verified through the authentication identifier, thereby further enhancing the security of the target data during transmission.

[0057] Please also read Figure 2 , Figure 4 , Figure 5 and Figure 6 , Figure 5 It is a flowchart of another implementation method of the target data processing method of the present application. Figure 6 It is a transmission diagram of another embodiment of the target data processing method of the present application. The client 100 corresponds to an authentication identifier, and the authentication identifier is unique. The target data corresponds to a target data type, and the authentication identifier and the target data type are stored in the server 101 and the management server 102. The method includes:

[0058] S501: Encrypt target data using a client to obtain storage ciphertext and storage key corresponding to the target data; wherein the storage key is split into a first sub-storage key and a second sub-storage key.

[0059] Specifically, the target data is encrypted using the client 100 to obtain a storage ciphertext and a storage key corresponding to the target data, and the storage key is split into a first sub-storage key and a second sub-storage key.

[0060] S502: Using the client, the storage ciphertext and the first sub-storage key are sent to the management server, and the second sub-storage key is sent to the service end.

[0061] Specifically, the client 100 is used to send the storage ciphertext and the first sub-storage key to the management server 102 , and the client 100 is used to send the second sub-storage key to the service end 101 .

[0062] S503: Using the server, the received second sub-storage key is sent to the management server.

[0063] Specifically, the server 101 sends the second sub-storage key received from the client 100 to the management server 102 .

[0064] S504: Decrypt the stored ciphertext using the management server based on the first sub-storage key and the second sub-storage key to obtain and store the target data.

[0065] Specifically, the management server 102 is used to decrypt the storage ciphertext based on the first sub-storage key and the second sub-storage key to obtain the corresponding target data and store the target data in the database of the management server 102 .

[0066] S505: Using the client to send a read request matching the target data type to the server.

[0067] Specifically, the client 100 sends a read request to the server 101 to request the target data type to be read.

[0068] S506: In response to the server receiving the read request, the server sends the target data type matching the read request and the authentication identifier corresponding to the client to the management server.

[0069] Specifically, after receiving the read request, the server 101 sends the target data type matching the read request and the authentication identifier corresponding to the client 100 to the management server 102 .

[0070] In one application method, before using the server 101 to send the target data type matching the read request and the authentication identifier corresponding to the client 100 to the management server 102, it also includes: using the server 101 to confirm the corresponding client 100 based on the authentication identifier, and responding to the read request to confirm the target data type matching the read request.

[0071] Specifically, after the server 101 authenticates the client 100 based on the authentication identifier, the target data type matching the read request is confirmed in its own database according to the read request.

[0072] S507: Encrypt the target data corresponding to the target data type using the management server to obtain the corresponding read ciphertext and read key; wherein the read key is split into a first sub-read key and a second sub-read key.

[0073] Specifically, the target data corresponding to the target data type is encrypted by using the management server 102 to obtain the corresponding read ciphertext and read key, and the read key is split into a first sub-read key and a second sub-read key.

[0074] Optionally, the first sub-read key is a part of the read key, and the second sub-read key is the remaining part of the read key. For example, when the first sub-read key is the first half of the read key, the second sub-read key is the second half of the read key. When the first sub-read key is the first 1 / 4 of the read key, the second sub-read key is the last 3 / 4 of the read key. In other words, this application does not impose specific restrictions on how to split the read key.

[0075] In one application, the management server 102 is used to encrypt the target data using a one-time symmetric encryption key.

[0076] Specifically, the management server 102 is used to randomly generate a one-time symmetric encryption key, and the one-time symmetric encryption key is used to encrypt the target data, so as to further improve the security of the target data transmission.

[0077] Optionally, when the client 100 sends the same read request twice, the management server 102 may generate the same read key and the same read ciphertext twice, so that it can be inferred whether the client 100 has read the same target data based on whether the read key and the read ciphertext are the same.

[0078] S508: Using the management server, the read ciphertext and the first sub-read key are sent to the client, and the second sub-read key is sent to the server.

[0079] Specifically, the management server 102 is used to send the read ciphertext and the first sub-read key to the client 100 , and the management server 102 is used to send the second sub-read key to the service end 101 .

[0080] In one application mode, the read request corresponds to a request time. After sending the second sub-read key to the server 101, it also includes: using the server 101 to store the authentication identifier, request time, target data type and second sub-read key corresponding to the client 100 into a log.

[0081] Specifically, the server 101 stores the authentication identifier corresponding to the client 100, the request time corresponding to the read request, the target data type corresponding to the target data, and the second sub-read key in the log. When the ciphertext or read key is leaked, it can be traced and quickly located based on the request time and target data type stored in the log, thereby further improving the security of target data transmission.

[0082] S509: Using the server, the received second sub-reading key is sent to the client.

[0083] Specifically, the server 101 sends the second sub-reading key received from the management server 102 to the client 100 .

[0084] S510: Using the client to decrypt the read ciphertext based on the first sub-read key and the second sub-read key, obtain the target data and store it.

[0085] Specifically, the client 100 is used to decrypt the read ciphertext based on the first sub-read key and the second sub-read key to obtain corresponding target data and store the target data in a database of the client 100 .

[0086] In one application, the client 100 is used to merge the first sub-read key and the second sub-read key into a read key, and the read ciphertext is decrypted according to the read key to obtain the corresponding target data, and the target data is stored in the database of the client 100 according to the authentication identifier of the client 100.

[0087] In the above scheme, the management server 102 randomly generates a one-time symmetrically encrypted read key each time the client 100 wants to read the target data, which effectively improves the security of the target data transmission. When the client 100 reads the target data, the server 101 uses the server 101 to store the authentication identifier corresponding to the client 100, the request time corresponding to the read request, the target data type corresponding to the target data, and the second sub-read key in the log. When the ciphertext is read or the read key is leaked, it can be traced and quickly located according to the request time and target data type stored in the log, thereby further improving the security of the target data transmission.

[0088] See also Figure 7 , Figure 7 It is a structural diagram of an embodiment of an electronic device of the present application, and the electronic device 70 includes a memory 701 and a processor 702 coupled to each other, wherein the memory 701 stores program data (not shown), and the processor 702 calls the program data to implement the method in any of the above embodiments. For the description of the relevant content, please refer to the detailed description of the above method embodiment, which will not be repeated here. Specifically, the electronic device 70 includes but is not limited to: a desktop computer, a laptop computer, a tablet computer, a server, etc., which are not limited here. In addition, the processor 702 can also be called a CPU (Center Processing Unit). The processor 702 may be an integrated circuit chip with signal processing capabilities. The processor 702 can also be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field-programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. In addition, the processor 702 can be implemented by an integrated circuit chip.

[0089] See also Figure 8 , Figure 8It is a structural diagram of an implementation method of a computer-readable storage medium of the present application. The computer-readable storage medium 80 stores program data 800. When the program data 800 is executed by a processor, the method in any of the above embodiments is implemented. For descriptions of related contents, please refer to the detailed description of the above method embodiments, which will not be repeated here.

[0090] It should be noted that the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present implementation scheme.

[0091] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

Claims

1. A target data processing method, characterized in that: Applied to a data protection system, the data protection system includes a client, a service end, and a management server, and the method includes: Encrypting the target data using the client to obtain a storage ciphertext and a storage key corresponding to the target data; wherein the storage key is split into a first sub-storage key and a second sub-storage key; Using the client, the storage ciphertext and the first sub-storage key are sent to the management server, and the second sub-storage key is sent to the service end; Using the server to send the received second sub-storage key to the management server; The management server is used to decrypt the storage ciphertext based on the first sub-storage key and the second sub-storage key to obtain and store the target data.

2. The method according to claim 1, characterized in that The client corresponds to an authentication identifier, and before the target data is encrypted by the client to obtain a storage ciphertext and a storage key corresponding to the target data, the method further includes: Using the client to establish a connection with the server based on the authentication identifier; The client is used to establish a connection with the management server based on the authentication identifier.

3. The method according to claim 2, characterized in that Before decrypting the storage ciphertext by using the management server based on the first sub-storage key and the second sub-storage key, the method further includes: The management server is used to confirm the corresponding client based on the authentication identifier, obtain the storage ciphertext, the first sub-storage key and the authentication identifier sent by the client, and obtain the second sub-storage key sent by the server.

4. The method according to claim 2, characterized in that: The decrypting the storage ciphertext by using the management server based on the first sub-storage key and the second sub-storage key to obtain and store the target data includes: merging the first sub-storage key and the second sub-storage key into the storage key using the management server; Decrypting the stored ciphertext using the management server based on the stored key to obtain the target data; The target data is stored using the management server based on the authentication identifier.

5. The method according to claim 1, characterized in that The client corresponds to an authentication identifier, the target data corresponds to a target data type, and the authentication identifier and the target data type are stored in the server and the management server; After decrypting the storage ciphertext using the management server based on the first sub-storage key and the second sub-storage key to obtain the target data and store it, the method further includes: Using the client to send a read request matching the target data type to the server; In response to the server receiving the read request, the server sends the target data type matching the read request and the authentication identifier corresponding to the client to the management server; Encrypting the target data corresponding to the target data type using the management server to obtain a corresponding read ciphertext and a read key; wherein the read key is split into a first sub-read key and a second sub-read key; Using the management server, the read ciphertext and the first sub-read key are sent to the client, and the second sub-read key is sent to the server; Using the server to send the received second sub-read key to the client; The client is used to decrypt the read ciphertext based on the first sub-read key and the second sub-read key to obtain and store the target data.

6. The method according to claim 5, characterized in that Before using the server to send the target data type matching the read request and the authentication identifier corresponding to the client to the management server, the method further includes: The server confirms the corresponding client based on the authentication identifier, and responds to the read request to confirm the target data type that matches the read request.

7. The method according to claim 5, characterized in that The read request corresponds to a request time; After sending the second sub-read key to the server, the method further includes: The server stores the authentication identifier corresponding to the client, the request time, the target data type and the second sub-read key into a log.

8. The method according to claim 5, characterized in that The using the management server to encrypt the target data corresponding to the target data type includes: The target data is encrypted using a one-time symmetric encryption key using the management server.

9. An electronic device, characterized in that: The method comprises a memory and a processor coupled to each other, wherein the memory stores program instructions, and the processor is used to execute the program instructions to implement the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: Program instructions that can be executed by a processor are stored, and the program instructions are used to implement the method according to any one of claims 1 to 8.

Images