Target data processing method, electronic device, and computer-readable storage medium

Abstract

The present application discloses a target data processing method, an electronic device, and a computer-readable storage medium. The method is applied to a data protection system, which includes a client, a server, and a management server. The method includes: using the client to encrypt the target data to obtain a storage ciphertext and a storage key corresponding to the target data; wherein the storage key is split into a first sub-storage key and a second sub-storage key; using the client to send the storage ciphertext and the first sub-storage key to the management server, and sending the second sub-storage key to the server; using the server to send the received second sub-storage key to the management server; using the management server to decrypt the storage ciphertext based on the first sub-storage key and the second sub-storage key to obtain and store the target data. The above scheme can improve the security of target data transmission.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a target data processing method, an electronic device, and a computer-readable storage medium. Background Art

[0002] In current internet services, clients store target data requiring protection directly on servers, transmitting it to the server in either encrypted or plaintext form for management. After encrypting the data, the corresponding key is also transmitted to the server, giving server developers access to the target data, increasing the risk of data leakage. Therefore, improving the security of target data transmission has become a pressing issue. Summary of the Invention

[0003] The main technical problem solved by this application is to provide a target data processing method, electronic device and computer-readable storage medium, which can improve the security of target data transmission.

[0004] To solve the above technical problems, the first aspect of the present application provides a data processing method, which is applied to a data protection system, wherein the data protection system includes a client, a server and a management server, and the method includes: using the client to encrypt the target data to obtain the storage ciphertext and storage key corresponding to the target data; wherein the storage key is split into a first sub-storage key and a second sub-storage key; using the client to send the storage ciphertext and the first sub-storage key to the management server, and sending the second sub-storage key to the server; using the server to send the received second sub-storage key to the management server; using the management server to decrypt the storage ciphertext based on the first sub-storage key and the second sub-storage key to obtain the target data and store it.

[0005] To solve the above technical problems, the second aspect of the present application provides an electronic device, comprising a memory and a processor coupled to each other, wherein the memory stores program instructions, and the processor is used to execute the program instructions to implement the method described in the first aspect above.

[0006] In order to solve the above technical problems, the third aspect of the present application provides a computer-readable storage medium storing program instructions that can be executed by a processor, wherein the program instructions are used to implement the method described in the first aspect above.

[0007] The above scheme uses the client to encrypt the target data to obtain the storage ciphertext and storage key corresponding to the target data, and the storage key will be split into a first sub-storage key and a second sub-storage key. The client is used to send the storage ciphertext and the first sub-storage key to the management server, and the client is used to send the second sub-storage key to the server. The server is used to send the second sub-storage key sent by the client to the management server, and the management server is used to decrypt the storage ciphertext based on the first sub-storage key and the second sub-storage key to obtain the corresponding target data and store the target data. By splitting the storage key for transmission, the complete storage key will not appear in the network communication link at the same time, effectively reducing the impact of key leakage during the transmission process, and introducing a management server for storing target data, so that the server can never obtain the target data and can only access part of the storage key, thereby improving the security of target data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without inventive efforts. Among them:

[0009] Figure 1 This is a flow chart of an embodiment of the target data processing method of the present application;

[0010] Figure 2 This is a transmission diagram of an embodiment of the target data processing method of the present application;

[0011] Figure 3 It is a flowchart of another embodiment of the target data processing method of the present application;

[0012] Figure 4 It is a transmission diagram of another embodiment of the target data processing method of the present application;

[0013] Figure 5 This is a flowchart of another embodiment of the target data processing method of the present application;

[0014] Figure 6 This is a transmission diagram of another embodiment of the target data processing method of the present application;

[0015] Figure 7 This is a schematic structural diagram of an embodiment of the electronic device of the present application;

[0016] Figure 8 It is a structural diagram of an embodiment of a computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them, and different implementation methods can be adaptively combined. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0018] The terms "system" and "network" are often used interchangeably in this document. The term "and / or" is simply a description of an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " generally indicates that the related objects are in an "or" relationship. Furthermore, "multiple" in this document means two or more than two.

[0019] The target data processing method provided in this application is applied to the data protection system 10, and its corresponding execution subject is the processing unit of the data protection system 10 or the processing terminal that can call the data protection system 10.

[0020] Please also refer to Figure 1 and Figure 2 , Figure 1 This is a flow chart of an embodiment of the target data processing method of this application. Figure 2 1 is a transmission diagram of an embodiment of a target data processing method of the present application. The data protection system 10 includes a client 100, a server 101, and a management server 102. The target data is data that needs to be encrypted and protected. The target data processing method includes:

[0021] S101: Utilize the client to encrypt target data to obtain a storage ciphertext and a storage key corresponding to the target data; wherein the storage key is split into a first sub-storage key and a second sub-storage key.

[0022] Specifically, the target data is encrypted using the client 100 to obtain a storage ciphertext and a storage key corresponding to the target data, and the storage key is split into a first sub-storage key and a second sub-storage key.

[0023] Optionally, the first sub-storage key is a part of the storage key, and the second sub-storage key is the remaining part of the storage key. For example, when the first sub-storage key is the first half of the storage key, the second sub-storage key is the second half of the storage key. When the first sub-storage key is the first 1 / 4 of the storage key, the second sub-storage key is the last 3 / 4 of the storage key. In other words, this application does not impose specific restrictions on how to split the storage key.

[0024] In one application, the client 100 is used to symmetrically encrypt the target data to generate a corresponding storage key, and the storage key is used to encrypt the target data to obtain a corresponding storage ciphertext, and the storage key is split into a first sub-storage key and a second sub-storage key.

[0025] In one application scenario, the client 100 uses a symmetric encryption algorithm to symmetrically encrypt the target data, generate a shared storage key, and use this shared storage key to encrypt the target data to obtain the corresponding storage ciphertext, and the shared storage key will be split by the client 100 into a first sub-storage key and a second sub-storage key.

[0026] In a specific application scenario, the client 100 uses the CBC (Cipher Block Chaining) mode or the CTR (Counter) mode of the AES (Advanced Encryption Standard) encryption algorithm to encrypt the target data that needs to be encrypted and protected, generates a shared storage key, and uses this shared storage key to encrypt the target data to obtain the corresponding storage ciphertext, and the shared storage key will be split by the client 100 into the first half storage key and the second half storage key.

[0027] In another application method, the client 100 is used to symmetrically encrypt the target data to generate a corresponding storage key, and before using the storage key to encrypt the target data, a message authentication code is added. The target data is encrypted based on the storage key and the message authentication code to obtain the corresponding storage ciphertext, and the storage key will be split into a first sub-storage key and a second sub-storage key, thereby further improving the security of target data transmission.

[0028] S102: Using the client, the storage ciphertext and the first sub-storage key are sent to the management server, and the second sub-storage key is sent to the service end.

[0029] Specifically, the client 100 is used to send the storage ciphertext and the first sub-storage key to the management server 102 , and the client 100 is used to send the second sub-storage key to the service end 101 .

[0030] In one application mode, the client 100 is used to directly send the storage ciphertext and the first sub-storage key to the management server 102 , and the client 100 is used to directly send the second sub-storage key to the server 101 .

[0031] In another application method, the client 100 is used to divide the stored ciphertext into multiple sub-files, and after associating the multiple sub-files with the first sub-storage key respectively, they are sent in segments to the management server 102, and the client 100 is used to send the second sub-storage key directly to the server 101. By dividing the stored ciphertext into multiple sub-files and sending them in segments, not only can the security of data transmission be improved, but also the target data can be effectively prevented from being intercepted and cracked during the transmission process.

[0032] S103: Using the server, the received second sub-storage key is sent to the management server 102 .

[0033] Specifically, the server 101 sends the second sub-storage key received from the client 100 to the management server 102 .

[0034] S104: Decrypt the stored ciphertext using the management server based on the first sub-storage key and the second sub-storage key to obtain and store the target data.

[0035] Specifically, the management server 102 decrypts the stored ciphertext based on the first sub-storage key and the second sub-storage key to obtain corresponding target data and stores the target data in a database of the management server 102 .

[0036] In one application, the management server 102 is used to merge the first sub-storage key and the second sub-storage key into a complete storage key, and the complete storage key is used to decrypt the storage ciphertext to obtain the corresponding target data and store the target data in the database of the management server 102.

[0037] In another application method, the management server 102 is used to merge the first sub-storage key and the second sub-storage key into a complete storage key, and obtain the message authentication code sent by the client 100, and use the complete storage key and message authentication code to decrypt the storage ciphertext to obtain the corresponding target data and store the target data in the database of the management server 102.

[0038] In the above scheme, the client 100 is used to encrypt the target data to obtain the storage ciphertext and storage key corresponding to the target data, and the storage key will be split into a first sub-storage key and a second sub-storage key. The client 100 is used to send the storage ciphertext and the first sub-storage key to the management server 102, and the client 100 is used to send the second sub-storage key to the server 101. The server 101 sends the second sub-storage key received from the client 100 to the management server 102. The management server 102 is used to decrypt the storage ciphertext based on the first sub-storage key and the second sub-storage key to obtain the corresponding target data and store the target data. By splitting the storage key for transmission, the complete storage key will not appear in the network communication link at the same time, effectively reducing the impact of key leakage during the transmission process, and introducing a management server 102 for storing target data, so that the server 101 can never obtain the target data and can only access part of the storage key, thereby improving the security of target data transmission.

[0039] Please also refer to Figure 3 and Figure 4 , Figure 3 This is a flow chart of another embodiment of the target data processing method of the present application. Figure 4 This is a transmission diagram of another embodiment of the target data processing method of the present application. The client 100 corresponds to an authentication identifier, wherein the authentication identifier is unique. The method includes:

[0040] S301: Use the client to establish a connection with the server based on the authentication identifier.

[0041] Specifically, the client 100 is used to establish a trusted connection with the server 101 based on the authentication identifier corresponding to the client 100 .

[0042] S302: Using the client to establish a connection with the management server based on the authentication identifier.

[0043] Specifically, the client 100 is used to establish a trusted connection with the management server 102 based on the authentication identifier corresponding to the client 100 .

[0044] S303: Encrypt the target data using the client to obtain a storage ciphertext and a storage key corresponding to the target data; wherein the storage key is split into a first sub-storage key and a second sub-storage key.

[0045] Specifically, the target data is encrypted using the client 100 to obtain a storage ciphertext and a storage key corresponding to the target data, and the storage key is split into a first sub-storage key and a second sub-storage key.

[0046] S304: Using the client, the storage ciphertext and the first sub-storage key are sent to the management server, and the second sub-storage key is sent to the service end.

[0047] Specifically, the client 100 is used to send the storage ciphertext and the first sub-storage key to the management server 102 , and the client 100 is used to send the second sub-storage key to the service end 101 .

[0048] S305: Using the server, the received second sub-storage key is sent to the management server.

[0049] Specifically, the server 101 sends the second sub-storage key received from the client 100 to the management server 102 .

[0050] S306: Using the management server to confirm the corresponding client based on the authentication identifier, obtain the storage ciphertext, the first sub-storage key and the authentication identifier sent by the client, and obtain the second sub-storage key sent by the server.

[0051] Specifically, the management server 102 confirms the validity of the corresponding client 100 based on the authentication identifier, thereby obtaining the storage ciphertext, the first sub-storage key and the authentication identifier corresponding to the client 100 sent by the client 100, and obtaining the second sub-storage key sent by the server 101.

[0052] S307: Decrypt the stored ciphertext using the management server based on the first sub-storage key and the second sub-storage key to obtain the target data and store it.

[0053] Specifically, the management server 102 decrypts the stored ciphertext based on the first sub-storage key and the second sub-storage key to obtain corresponding target data and stores the target data in a database of the management server 102 .

[0054] In one application mode, the management server 102 is used to merge the first sub-storage key and the second sub-storage key into a storage key; the management server 102 is used to decrypt the storage ciphertext based on the storage key to obtain the target data; and the management server 102 is used to store the target data based on the authentication identifier.

[0055] Specifically, the management server 102 is used to merge the first sub-storage key and the second sub-storage key into a complete storage key, and the management server 102 is used to decrypt the storage ciphertext based on the complete storage key. After obtaining the target data, the target data is stored in the database of the management server 102 based on the authentication identifier of the client 100.

[0056] The above solution can improve the portability of data processing by adding an authentication identifier corresponding to the client 100 to transmit and store the target data, and the corresponding client 100 can be verified through the authentication identifier, thereby further enhancing the security of the target data during transmission.

[0057] Please also refer to Figure 2 、 Figure 4 、 Figure 5 and Figure 6 , Figure 5 This is a flow chart of another embodiment of the target data processing method of this application. Figure 6 This is a transmission diagram of another embodiment of the target data processing method of the present application. The client 100 corresponds to an authentication identifier, and the authentication identifier is unique. The target data corresponds to a target data type, and the authentication identifier and the target data type are stored in the server 101 and the management server 102. The method includes:

[0058] S501: Utilize the client to encrypt target data to obtain storage ciphertext and storage key corresponding to the target data; wherein the storage key is split into a first sub-storage key and a second sub-storage key.

[0059] Specifically, the target data is encrypted using the client 100 to obtain a storage ciphertext and a storage key corresponding to the target data, and the storage key is split into a first sub-storage key and a second sub-storage key.

[0060] S502: Using the client, the storage ciphertext and the first sub-storage key are sent to the management server, and the second sub-storage key is sent to the service end.

[0061] Specifically, the client 100 is used to send the storage ciphertext and the first sub-storage key to the management server 102 , and the client 100 is used to send the second sub-storage key to the service end 101 .

[0062] S503: Using the server, the received second sub-storage key is sent to the management server.

[0063] Specifically, the server 101 sends the second sub-storage key received from the client 100 to the management server 102 .

[0064] S504: Decrypt the stored ciphertext using the management server based on the first sub-storage key and the second sub-storage key to obtain and store the target data.

[0065] Specifically, the management server 102 decrypts the stored ciphertext based on the first sub-storage key and the second sub-storage key to obtain corresponding target data and stores the target data in a database of the management server 102 .

[0066] S505: Use the client to send a read request that matches the target data type to the server.

[0067] Specifically, the client 100 sends a read request to the server 101 to request the target data type to be read.

[0068] S506: In response to the server receiving the read request, the server sends the target data type matching the read request and the authentication identifier corresponding to the client to the management server.

[0069] Specifically, after receiving the read request, the server 101 sends the target data type matching the read request and the authentication identifier corresponding to the client 100 to the management server 102 .

[0070] In one application method, before using the server 101 to send the target data type matching the read request and the authentication identifier corresponding to the client 100 to the management server 102, it also includes: using the server 101 to confirm the corresponding client 100 based on the authentication identifier, and responding to the read request to confirm the target data type matching the read request.

[0071] Specifically, after the server 101 authenticates the client 100 based on the authentication identifier, the server 101 confirms the target data type that matches the read request in its own database according to the read request.

[0072] S507: Encrypt the target data corresponding to the target data type using the management server to obtain the corresponding read ciphertext and read key; wherein the read key is split into a first sub-read key and a second sub-read key.

[0073] Specifically, the management server 102 is used to encrypt the target data corresponding to the target data type to obtain the corresponding read ciphertext and read key, and the read key is split into a first sub-read key and a second sub-read key.

[0074] Optionally, the first sub-read key is a part of the read key, and the second sub-read key is the remaining part of the read key. For example, when the first sub-read key is the first half of the read key, the second sub-read key is the second half of the read key. When the first sub-read key is the first 1 / 4 of the read key, the second sub-read key is the last 3 / 4 of the read key. In other words, this application does not impose specific restrictions on how to split the read key.

[0075] In one application, the management server 102 encrypts the target data using a one-time symmetric encryption key.

[0076] Specifically, the management server 102 is used to randomly generate a one-time symmetric encryption key, and the one-time symmetric encryption key is used to encrypt the target data, so as to further improve the security of the target data transmission.

[0077] Optionally, when the client 100 sends the same read request twice, the management server 102 may generate the same read key and the same read ciphertext twice, so that it can be inferred whether the client 100 has read the same target data based on whether the read key and the read ciphertext are the same.

[0078] S508: Using the management server, the read ciphertext and the first sub-read key are sent to the client, and the second sub-read key is sent to the server.

[0079] Specifically, the management server 102 is used to send the read ciphertext and the first sub-read key to the client 100 , and the management server 102 is used to send the second sub-read key to the server 101 .

[0080] In one application mode, the read request corresponds to a request time. After sending the second sub-read key to the server 101, it also includes: using the server 101 to store the authentication identifier, request time, target data type and second sub-read key corresponding to the client 100 in a log.

[0081] Specifically, the server 101 stores the authentication identifier corresponding to the client 100, the request time corresponding to the read request, the target data type corresponding to the target data, and the second sub-read key in the log. When the ciphertext or read key is leaked, the source can be traced and quickly located based on the request time and target data type stored in the log, thereby further improving the security of target data transmission.

[0082] S509: Using the server, the received second sub-read key is sent to the client.

[0083] Specifically, the server 101 sends the second sub-reading key received from the management server 102 to the client 100 .

[0084] S510: Decrypt the read ciphertext using the client based on the first sub-read key and the second sub-read key to obtain and store target data.

[0085] Specifically, the client 100 decrypts the read ciphertext based on the first sub-read key and the second sub-read key to obtain corresponding target data and store the target data in a database of the client 100 .

[0086] In one application, the client 100 is used to merge the first sub-read key and the second sub-read key into a read key, and the read ciphertext is decrypted according to the read key to obtain the corresponding target data, and the target data is stored in the database of the client 100 according to the authentication identifier of the client 100.

[0087] In the above scheme, the management server 102 randomly generates a one-time symmetrically encrypted reading key each time the client 100 wants to read the target data, which effectively improves the security of the target data transmission. When the client 100 reads the target data, the server 101 uses the server 101 to store the authentication identifier corresponding to the client 100, the request time corresponding to the reading request, the target data type corresponding to the target data, and the second sub-reading key in the log. When the ciphertext is read or the reading key is leaked, it can be traced and quickly located based on the request time and target data type stored in the log, thereby further improving the security of the target data transmission.

[0088] See also Figure 7 , Figure 7 This is a schematic diagram of the structure of an embodiment of an electronic device of the present application. The electronic device 70 includes a memory 701 and a processor 702 coupled to each other, wherein the memory 701 stores program data (not shown in the figure), and the processor 702 calls the program data to implement the method in any of the above embodiments. For a description of the relevant content, please refer to the detailed description of the above method embodiments, which will not be repeated here. Specifically, the electronic device 70 includes but is not limited to: a desktop computer, a laptop computer, a tablet computer, a server, etc., which are not limited here. In addition, the processor 702 can also be referred to as a CPU (Center Processing Unit). The processor 702 may be an integrated circuit chip with signal processing capabilities. The processor 702 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. In addition, the processor 702 can be implemented by an integrated circuit chip.

[0089] See also Figure 8 , Figure 8This is a structural diagram of an embodiment of a computer-readable storage medium of the present application. The computer-readable storage medium 80 stores program data 800. When the program data 800 is executed by the processor, the method in any of the above embodiments is implemented. For an explanation of the relevant content, please refer to the detailed description of the above method embodiments, which will not be repeated here.

[0090] It should be noted that the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of this embodiment.

[0091] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

Claims

1. A target data processing method, characterized in that: Applied to a data protection system, the data protection system includes a client, a service end, and a management server, and the method includes: encrypting the target data using the client to obtain a storage ciphertext and a storage key corresponding to the target data; wherein the storage key is split into a first sub-storage key and a second sub-storage key; Using the client, the storage ciphertext and the first sub-storage key are sent to the management server, and the second sub-storage key is sent to the service end; Using the server, the received second sub-storage key is sent to the management server; The management server is used to decrypt the storage ciphertext based on the first sub-storage key and the second sub-storage key to obtain and store the target data.

2. The method according to claim 1, characterized in that The client corresponds to an authentication identifier. Before encrypting the target data using the client to obtain the storage ciphertext and storage key corresponding to the target data, the method further includes: Using the client to establish a connection with the server based on the authentication identifier; The client is used to establish a connection with the management server based on the authentication identifier.

3. The method according to claim 2, characterized in that Before decrypting the stored ciphertext using the management server based on the first sub-storage key and the second sub-storage key, the method further includes: The management server is used to confirm the corresponding client based on the authentication identifier, obtain the storage ciphertext, the first sub-storage key and the authentication identifier sent by the client, and obtain the second sub-storage key sent by the server.

4. The method according to claim 2, characterized in that The decrypting the stored ciphertext using the management server based on the first sub-storage key and the second sub-storage key to obtain and store the target data includes: merging the first sub-storage key and the second sub-storage key into the storage key using the management server; Decrypting the stored ciphertext using the management server based on the storage key to obtain the target data; The target data is stored using the management server based on the authentication identifier.

5. The method according to claim 1, wherein The client corresponds to an authentication identifier, the target data corresponds to a target data type, and the authentication identifier and the target data type are stored in the server and the management server; After decrypting the stored ciphertext using the management server based on the first sub-storage key and the second sub-storage key to obtain the target data and store it, the method further includes: Using the client to send a read request matching the target data type to the server; In response to the server receiving the read request, the server sends the target data type matching the read request and the authentication identifier corresponding to the client to the management server; Encrypting the target data corresponding to the target data type using the management server to obtain a corresponding read ciphertext and a read key; wherein the read key is split into a first sub-read key and a second sub-read key; Using the management server, the read ciphertext and the first sub-read key are sent to the client, and the second sub-read key is sent to the server; Using the server, the received second sub-read key is sent to the client; The client is used to decrypt the read ciphertext based on the first sub-read key and the second sub-read key to obtain and store the target data.

6. The method according to claim 5, characterized in that Before using the server to send the target data type matching the read request and the authentication identifier corresponding to the client to the management server, the method further includes: The server confirms the corresponding client based on the authentication identifier, and responds to the read request to confirm the target data type that matches the read request.

7. The method according to claim 5, characterized in that The read request corresponds to a request time; After sending the second sub-read key to the server, the method further includes: The server stores the authentication identifier corresponding to the client, the request time, the target data type and the second sub-read key in a log.

8. The method according to claim 5, characterized in that The encrypting the target data corresponding to the target data type by using the management server includes: The target data is encrypted using a one-time symmetric encryption key using the management server.

9. An electronic device, characterized in that: The method comprises a memory and a processor coupled to each other, wherein the memory stores program instructions, and the processor is configured to execute the program instructions to implement the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that Program instructions that can be executed by a processor are stored, and the program instructions are used to implement the method according to any one of claims 1 to 8.

Images