Data processing method and related device

Abstract

The invention discloses a data processing method and a related device, and the method comprises the steps that first equipment obtains a data calling password, and generates a first random number after verification succeeds; encrypting the data calling password and the first random number through a first encryption algorithm, generating a first message, and sending the first message to the second device; the second device decrypts the first message, generates a second random number, generates a secret key through a remainder operation, encrypts the secret key by using a second encryption algorithm and sends the encrypted secret key to the first device; and after decrypting the key, the first device encrypts the secret-related data according to the key and a second encryption algorithm. Therefore, the first device processes the secret-related data according to the secret key and the second encryption algorithm, so that the secret-related data with a large data size can be processed through the second encryption algorithm with higher efficiency, and the encryption and decryption speed is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data processing method and related devices. Background Art

[0002] With the rapid development of information technology, data security has become a focus of attention for enterprises and individuals. How to prevent data stored in computer devices from being stolen has become a topic of concern in the field of information security technology, especially confidential data. Once leaked, it will bring irreparable losses and impacts.

[0003] In the related art, confidential data is usually encrypted and transmitted through a single asymmetric encryption algorithm RSA. However, this method has a slow encryption and decryption speed when encrypting confidential data with a large amount of data. Summary of the invention

[0004] In response to the above problems, the present application provides a data processing method and related devices to solve the problem of insufficient flexibility in encrypting and decrypting confidential data.

[0005] Based on this, this application discloses the following technical solutions:

[0006] In a first aspect, an embodiment of the present application provides a data processing method, the method comprising:

[0007] The first device obtains a data calling password;

[0008] If the data call password is successfully verified, the first device generates a first random number according to the data call password;

[0009] The first device encrypts the data calling password and the first random number by using a first encryption algorithm to obtain a first message;

[0010] The first device sends the first message to the second device, so that the second device decrypts the first message by using a first decryption algorithm to obtain the data calling password and the first random number, the second device generates a second random number according to the data calling password, the second device obtains a key by performing a modulus operation on the first random number and the second random number, the second device encrypts the key by using a second encryption algorithm to obtain an encryption key, and the first decryption algorithm is an algorithm for decrypting content encrypted by the first encryption algorithm;

[0011] The first device obtains the encryption key sent by the second device;

[0012] The first device decrypts the encryption key by using a second decryption algorithm to obtain the key, wherein the second decryption algorithm and the second encryption algorithm are symmetric encryption algorithms;

[0013] The first device processes the confidential data according to the key and the second encryption algorithm.

[0014] Optionally, the first device processes the confidential data according to the key and the second encryption algorithm, including:

[0015] The first device obtains a confidential data identifier of the confidential data;

[0016] The first device encrypts the confidential data identifier according to the key and the second encryption algorithm to obtain a second message;

[0017] The first device sends the second message to the second device, so that the second device decrypts the second message according to the key and the second decryption algorithm to obtain the confidential data identifier, and the second device obtains the confidential data according to the confidential data identifier;

[0018] The first device obtains the confidential data sent by the second device.

[0019] Optionally, the first device processes the confidential data according to the key and the second encryption algorithm, including:

[0020] The first device encrypts the confidential data according to the key and the second encryption algorithm to obtain the encrypted data;

[0021] The first device sends the encrypted data to the second device.

[0022] Optionally, the method further comprises:

[0023] The first device acquires basic information, where the basic information is the employee identification or the employee's physiological characteristics;

[0024] The first device generates the data calling password according to the basic information;

[0025] The first device updates the data calling password at a preset time interval, and the length of the data calling password is greater than or equal to 6 digits, and the preset time is less than or equal to 20 days.

[0026] Optionally, the method further comprises:

[0027] The first device determines the confidentiality level of the confidential data;

[0028] The first device obtains the first encryption algorithm and the second encryption algorithm according to the confidentiality level. The higher the confidentiality level is, the more complex the first encryption algorithm and the second encryption algorithm are.

[0029] Optionally, the method further comprises:

[0030] The first device obtains a login account and a login password;

[0031] If the login account and the login password do not match, the first device prompts for re-entry;

[0032] If the login account and the login password do not match for more than 6 consecutive times, the first device issues an alarm; or,

[0033] The first device detects an abnormal number, where the abnormal number refers to the number of abnormalities in various confidential data or the number of traffic abnormalities in each port of the first device;

[0034] If the number of abnormalities exceeds the number threshold, an alarm is issued.

[0035] Optionally, the first device obtains a data calling password, including:

[0036] The first device obtains the data calling password through a virtual private network.

[0037] In a second aspect, an embodiment of the present application provides a data processing device, the device comprising: the device comprising: an acquisition unit, a generation unit, an encryption unit, a sending unit, a decryption unit and a processing unit;

[0038] The acquisition unit is used for the first device to acquire a data calling password;

[0039] The generating unit is configured to generate a first random number according to the data calling password by the first device if the data calling password is successfully verified;

[0040] The encryption unit is used for the first device to encrypt the data calling password and the first random number by using a first encryption algorithm to obtain a first message;

[0041] The sending unit is configured to cause the first device to send the first message to the second device, so that the second device decrypts the first message by using a first decryption algorithm to obtain the data calling password and the first random number, the second device generates a second random number according to the data calling password, the second device obtains a key by performing a modulus operation on the first random number and the second random number, the second device encrypts the key by using a second encryption algorithm to obtain an encryption key, and the first decryption algorithm is an algorithm for decrypting content encrypted by the first encryption algorithm;

[0042] The obtaining unit is further configured to allow the first device to obtain the encryption key sent by the second device;

[0043] The decryption unit is configured to cause the first device to decrypt the encryption key using a second decryption algorithm to obtain the key, wherein the second decryption algorithm and the second encryption algorithm are symmetric encryption algorithms;

[0044] The processing unit is used for the first device to process confidential data according to the key and the second encryption algorithm.

[0045] In a third aspect, an embodiment of the present application provides a computer device, wherein the computer device includes a processor and a memory:

[0046] The memory is used to store a computer program and transmit the computer program to the processor;

[0047] The processor is configured to execute the method according to the first aspect of claim 1 according to the computer program.

[0048] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method described in the first aspect above.

[0049] In a fifth aspect, an embodiment of the present application provides a computer program product comprising a computer program, which, when executed on a computer device, enables the computer device to execute the method described in the first aspect above.

[0050] It can be seen from the above technical solutions that the present application has at least the following beneficial effects:

[0051] The first device obtains the data call password. If the data call password is successfully verified, the first device generates a first random number according to the data call password. The first device encrypts the data call password and the first random number through the first encryption algorithm to obtain the first message. The first random number increases the randomness and unpredictability of data encryption and decryption, and improves security. The first device sends the first message to the second device so that the second device decrypts the first message through the first decryption algorithm to obtain the data call password and the first random number. The second device generates a second random number according to the data call password. The second device obtains a key by performing a modulus operation on the first random number and the second random number. The second device encrypts the key through the second encryption algorithm to obtain an encryption key. The second random number increases the randomness and unpredictability of data encryption and decryption. The complexity of the verification process between the first device and the second device is further increased by performing a modulus operation on the first random number and the second random number. Even if the encryption key is leaked, it is difficult to crack. The first device obtains the encryption key sent by the second device.

[0052] The first device decrypts the encryption key through the second decryption algorithm to obtain the key. The second decryption algorithm and the second encryption algorithm are symmetric encryption algorithms, which can reduce the computational complexity of encryption and decryption while ensuring data security, thereby increasing the speed of encryption and decryption and improving efficiency. The first device processes the confidential data according to the key and the second encryption algorithm, so that confidential data with a large amount of data can be processed through the more efficient second encryption algorithm, thereby increasing the speed of encryption and decryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0054] Figure 1 A flowchart of a data processing method provided in an embodiment of the present application;

[0055] Figure 2 A schematic diagram of a process flow of confidential data processing provided in an embodiment of the present application;

[0056] Figure 3 A schematic diagram of a confidential data classification system provided in an embodiment of the present application;

[0057] Figure 4 A schematic diagram of a network intrusion detection system provided in an embodiment of the present application;

[0058] Figure 5A schematic diagram of a process flow of a confidential information anti-theft system provided in an embodiment of the present application;

[0059] Figure 6 A schematic diagram of the structure of an information transmission channel isolation system provided in an embodiment of the present application;

[0060] Figure 7 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0061] Figure 8 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0063] Asymmetric encryption algorithm, also known as public key encryption algorithm, is an encryption technology. Asymmetric encryption algorithm encrypts and decrypts data by using mathematically related but non-interactive keys. It is usually encrypted with a public key and decrypted with a private key.

[0064] RSA (Rivest-Shamir-Adleman) is a common asymmetric encryption algorithm that encrypts and decrypts data based on the mathematical principle of large prime number decomposition. When RSA encrypts and decrypts large amounts of data, such as confidential data generated by banking systems, it usually consumes a lot of computing resources and the encryption and decryption speeds are slow. At the same time, in order to ensure security, RSA usually needs to select a longer key.

[0065] Based on this, the embodiment of the present application provides a data processing method and related devices, wherein the first device obtains a data call password, and if the data call password is successfully verified, the first device generates a first random number according to the data call password. The first device encrypts the data call password and the first random number by a first encryption algorithm to obtain a first message. The first random number increases the randomness and unpredictability of data encryption and decryption, thereby improving security. The first device sends the first message to the second device so that the second device decrypts the first message by a first decryption algorithm to obtain the data call password and the first random number, and the second device generates a second random number according to the data call password. The second device obtains a key by performing a modulus operation on the first random number and the second random number, and the second device encrypts the key by a second encryption algorithm to obtain an encryption key. The second random number increases the randomness and unpredictability of data encryption and decryption, and the complexity of the verification process between the first device and the second device is further improved by performing a modulus operation on the first random number and the second random number, so that it is difficult to crack even if the encryption key is leaked. The first device obtains the encryption key sent by the second device.

[0066] The first device decrypts the encryption key through the second decryption algorithm to obtain the key. The second decryption algorithm and the second encryption algorithm are symmetric encryption algorithms, which can reduce the computational complexity of encryption and decryption while ensuring data security, thereby increasing the speed of encryption and decryption and improving efficiency. The first device processes the confidential data according to the key and the second encryption algorithm, so that confidential data with a large amount of data can be processed through the more efficient second encryption algorithm, thereby increasing the speed of encryption and decryption.

[0067] The data processing method provided in this application can be applied to computer devices with data processing capabilities, such as terminal devices and servers. Specifically, the terminal device can be a desktop computer, a laptop computer, a mobile phone, a tablet computer, etc. The server can be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, and this application does not limit this.

[0068] All data collected by this application (such as confidential data) are collected with the consent and authorization of the object to which the data belongs (such as users, institutions or enterprises), and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0069] See also Figure 1 , which is a flow chart of the data processing method provided in the embodiment of the present application. For the convenience of description, the following embodiment is introduced by taking the execution subject of the data processing method as the first device as an example. Figure 1 As shown, the method includes S101-S107.

[0070] S101: The first device obtains a data calling password.

[0071] The first device is a device that initiates a confidential data call, for example, the first device may be a client. The data call password is a key or password used to verify the identity of the first device to ensure that subsequent operations are authorized operations.

[0072] In a possible implementation, the first device obtains the data calling password through a virtual private network.

[0073] A Virtual Private Network (VPN) is a network technology that establishes a secure, encrypted connection channel through a public network (such as the Internet) to enable remote users to access corporate internal network resources as if they were in a local network. The main purpose of a VPN is to protect the security of data transmission and ensure that data is not stolen or tampered with during transmission.

[0074] In this way, other devices on the public network can be connected to the first device through VPN to perform data operations such as encryption and decryption verification. At this time, the first device serves as the receiving end of the instruction, and VPN can prevent external attackers from scanning the public network IP address to discover the confidential first device.

[0075] S102: If the data calling password is successfully verified, the first device generates a first random number according to the data calling password.

[0076] After obtaining the data call password, the first device performs verification, for example, the format and validity period of the data call password can be verified. If the verification is successful, it means that the subsequent operation is authorized, and a first random number is generated according to the call password. The first random number is a random value. The introduction of random numbers increases the complexity of mutual verification between devices and improves security.

[0077] S103: The first device encrypts the data calling password and the first random number by using a first encryption algorithm to obtain a first message.

[0078] The first encryption algorithm is an encryption algorithm used to encrypt the first random number and the data call password. Correspondingly, the data encrypted by the first encryption algorithm can be decrypted by the first decryption algorithm. For example, the first decryption algorithm can be RSA. The first message is a data packet encrypted by the first encryption algorithm, including the encrypted data call password and the first random number.

[0079] S104: The first device sends the first message to the second device, so that the second device decrypts the first message through the first decryption algorithm to obtain the data call password and the first random number. If the data call password is successfully verified, the second device generates a second random number according to the data call password. The second device obtains the key by performing a modulus operation on the first random number and the second random number. The second device encrypts the key through the second encryption algorithm to obtain an encryption key.

[0080] The second device is a device for generating a key, for example, the second device can be a gateway server. The first decryption algorithm is an algorithm for decrypting content encrypted by the first encryption algorithm, which is the inverse operation of the first encryption algorithm, and the second random number is a random value. Through the remainder operation, the complexity of the first random number and the second random number, which already have randomness, is further improved. The remainder operation, also known as the modulus operation or the modulus operation, is a mathematical operation used to find the remainder after dividing two numbers. When generating keys and performing encryption and decryption, the remainder operation can increase randomness and unpredictability.

[0081] The second encryption algorithm is a symmetric encryption algorithm. Correspondingly, the second decryption algorithm is an algorithm for decrypting the content encrypted by the second encryption algorithm, which is the inverse operation of the second encryption algorithm. A symmetric encryption algorithm is an encryption technology that uses the same key for encryption and decryption. Compared with an asymmetric encryption algorithm, a symmetric encryption algorithm has the characteristics of lower computing resource consumption, shorter key length, faster encryption and decryption speed, and is more suitable for encrypting large amounts of data. For example, the second encryption algorithm can be Data Encryption Standard (DES), Advanced Encryption Standard (AES), Triple DES (3DES), etc.

[0082] S105: The first device obtains the encryption key sent by the second device.

[0083] S106: The first device decrypts the encryption key using a second decryption algorithm to obtain a key.

[0084] The second decryption algorithm and the second encryption algorithm are symmetric encryption algorithms.

[0085] S107: The first device processes the confidential data according to the key and the second encryption algorithm.

[0086] According to the key generated by performing a modulus operation on the first random number and the second random number, confidential data can be encrypted and decrypted. Confidential data is data that needs to be protected to prevent leakage, such as bank customer information, bank business platform background data, etc.

[0087] The embodiments of the present application do not limit the processing method of confidential data. Two processing methods are used as examples for illustration. For processing method 1, see A1-A4, and for processing method 2, see B1-B2.

[0088] First, we will explain the first processing method, see A1-A4:

[0089] A1: The first device obtains a confidential data identifier of confidential data.

[0090] Confidential data identification is information used to uniquely identify confidential data.

[0091] A2: The first device encrypts the confidential data identifier according to the key and the second encryption algorithm to obtain a second message.

[0092] The second message is a data packet encrypted by a second encryption algorithm and includes a confidential data identifier.

[0093] A3: The first device sends a second message to the second device, so that the second device decrypts the second message according to the key and the second decryption algorithm to obtain a confidential data identifier, and the second device obtains the confidential data according to the confidential data identifier.

[0094] A4: The first device obtains the confidential data sent by the second device.

[0095] Therefore, through the encryption and decryption process of the confidential data identifier, the second device can obtain the confidential data according to the confidential data identifier, thereby ensuring the security of the confidential data during transmission and processing.

[0096] The second processing method is described below, see B1-B2:

[0097] B1: The first device encrypts the confidential data according to the key and the second encryption algorithm to obtain encrypted data.

[0098] B2: The first device sends encrypted data to the second device, so that the second device decrypts the encrypted data according to the key and the second decryption algorithm to obtain confidential data, and sends the confidential data to the third device. After receiving the confidential data, the third device returns a third message to the first device.

[0099] The third device is a device for receiving confidential data, for example, the third device can be a service server. The third message is used to inform the first device that the third device has received the decrypted confidential data. After the first device sends encrypted data to the second device for a preset waiting time, if the third message is not received, the encrypted data is resent.

[0100] See also Figure 2 , Figure 2A flow chart of a confidential data processing process provided for an embodiment of the present application includes confidential data processing processes of S101-S106, and B1-B2.

[0101] The confidential data is encrypted by the second encryption algorithm, which fully utilizes the characteristics of the symmetric encryption algorithm, such as small computational complexity and suitability for encrypting and decrypting large amounts of data, thereby improving the efficiency of the confidential data encryption and decryption process.

[0102] It can be seen from the above technical solution that the first device obtains the data call password. If the data call password is successfully verified, the first device generates a first random number according to the data call password. The first device encrypts the data call password and the first random number through the first encryption algorithm to obtain the first message. The first random number increases the randomness and unpredictability of data encryption and decryption, and improves security. The first device sends the first message to the second device so that the second device decrypts the first message through the first decryption algorithm to obtain the data call password and the first random number. The second device generates a second random number according to the data call password. The second device obtains a key by performing a modulus operation on the first random number and the second random number. The second device encrypts the key through the second encryption algorithm to obtain an encryption key. The second random number increases the randomness and unpredictability of data encryption and decryption. The complexity of the verification process between the first device and the second device is further improved by performing a modulus operation on the first random number and the second random number. Even if the encryption key is leaked, it is difficult to be cracked. The first device obtains the encryption key sent by the second device.

[0103] The first device decrypts the encryption key through the second decryption algorithm to obtain the key. The second decryption algorithm and the second encryption algorithm are symmetric encryption algorithms, which can reduce the computational complexity of encryption and decryption while ensuring data security, thereby increasing the speed of encryption and decryption and improving efficiency. The first device processes the confidential data according to the key and the second encryption algorithm, so that confidential data with a large amount of data can be processed through the more efficient second encryption algorithm, thereby increasing the speed of encryption and decryption.

[0104] In a possible implementation, an embodiment of the present application provides a method for generating a data call password based on basic information: a first device obtains basic information, and the basic information is an employee identification or an employee physiological characteristic. The first device generates a data call password based on the basic information. The first device updates the data call password at a preset time, and the length of the data call password is greater than or equal to 6 digits, and the preset time is less than or equal to 20 days.

[0105] The preset time is a time determined based on the bank's business scenario.

[0106] Therefore, by generating a data call password with a length requirement based on the basic information of bank employees and updating the data call password regularly, the security of the data call password is improved and the risk of being cracked is reduced.

[0107] The length and preset time of the data call password can also be adjusted according to actual conditions. For example, when the data call password is generated by a password generator, the length of the data call password is greater than or equal to 6 digits, and the preset time is less than or equal to 20 days; if a combination of an IC card and a data call password is used, the length of the data call password is greater than or equal to 12 digits, and the preset time is less than or equal to 10 days, and the data call password must be a mixture of letters, characters, and numbers; for top secret confidential data, the data call password is generated using the employee's physiological characteristics.

[0108] The present application embodiment provides a method for classifying confidential data into confidential levels and using different corresponding encryption algorithms:

[0109] The first device determines the confidentiality level of the confidential data and obtains the first encryption algorithm and the second encryption algorithm according to the confidentiality level. The higher the confidentiality level, the more complex the first encryption algorithm and the second encryption algorithm.

[0110] join Figure 3 , Figure 3 A schematic diagram of a confidential data classification system provided for an embodiment of the present application can determine the data type of confidential data through customized classification (creating your own classification system), adopting an existing classification system or through a machine learning model, and determine the data status of confidential data through metadata, such as data source, format, date, etc., and determine the confidentiality level of confidential data according to the data status and data type, so as to adopt encryption algorithms of different complexity for confidential data of different confidentiality levels.

[0111] Therefore, by establishing a corresponding relationship between the confidentiality level and the complexity of the encryption algorithm, a more secure encryption algorithm can be used for confidential data that needs to be protected more, thereby improving the security of confidential data.

[0112] In a possible implementation, the present application embodiment provides two alarm mechanisms:

[0113] Alarm mechanism 1: The first device obtains the login account and login password. If the login account and login password do not match, the first device prompts to re-enter. If the login account and login password do not match for more than 6 consecutive times, the first device issues an alarm.

[0114] Alarm mechanism 2: The first device detects the number of abnormalities, which refers to the number of abnormalities in various confidential data or the number of abnormal traffic in each port of the first device. If the number of abnormalities exceeds the number threshold, an alarm is issued.

[0115] join Figure 4 , Figure 4 A schematic diagram of a network intrusion detection system provided in an embodiment of the present application. Network intrusion detection includes: abnormal behavior detection and traffic analysis. Abnormal behavior detection is used to detect frequent logins, browsing of specific types of files, and the number of failed login attempts. If there is a significant change in behavior habits, there may be an intrusion. Among them, the threshold for the number of failed login attempts is set to six times. When the number of consecutive logins by a user exceeds the threshold, it is determined that there is an intrusion, and an alarm is issued according to the threat intelligence database.

[0116] Traffic analysis is used to detect abnormal numbers of specific resources and abnormal numbers arriving at specific ports, thereby identifying ongoing network activities and determining whether suspicious activities are ongoing. When the number of abnormalities exceeds the threshold, an alarm is issued based on the threat intelligence database.

[0117] The above two alarm mechanisms can detect network intrusions, prevent network intrusions such as brute force password cracking or network packet capture, and promptly discover potential risks to confidential data.

[0118] See also Figure 5 , Figure 5 A schematic diagram of a process of a confidential information anti-theft system provided in an embodiment of the present application, the system includes the following 8 processing steps:

[0119] (1) Isolation of information transmission channels. Physical isolation of confidential computers and networks from the Internet and other public information networks. (2) Data classification. Classification of data confidentiality according to data type. (3) Setting passwords. Accessing corresponding data through passwords and changing passwords regularly. (4) Strengthening data transmission management. (5) Network intrusion detection. Monitoring and analyzing network traffic to identify potential risks in a timely manner. (6) Setting up multi-level security protection measures. (7) Hiding IP addresses. Protecting and hiding the addresses of confidential computers. (8) Data security backup.

[0120] Specifically, for step 1, see Figure 6 , Figure 6A structural diagram of an information transmission channel isolation system provided for an embodiment of the present application, wherein information transmission channel isolation includes processing using an independent local area network and a physical isolation device; the system is also implemented by means of logical isolation, data isolation or access isolation, wherein logical isolation is to isolate confidential computers and networks from public information networks, but does not require complete physical isolation, which can be achieved through VPN, security protocols, data encryption and other technologies. Data isolation is to isolate confidential data from public data to ensure that only authorized persons can access confidential data, which can be achieved through data encryption, data classification, security auditing and other technologies. Access isolation is to strictly control the access rights of confidential computers and network users to ensure that only authorized persons can access confidential information, which can be achieved through identity authentication, access control lists (ACLs), security policies and other methods.

[0121] Specifically, for step 4, set up a data service area. The data service area is a dedicated network security protection area between the production area and the development and testing area. The security management and control of sensitive data is achieved through dedicated virtual desktops, bastion host systems, network access control and other means. Files no longer used in the data service area should be deleted in a timely manner. For data files that need to be reused, the retention period can be appropriately extended according to actual conditions. The data service area can only receive files transmitted from the production area in one direction, and no personnel are allowed to transfer files from the data service area to the production area.

[0122] Specifically, for step 6, security protection measures include establishing a firewall, establishing a VPN, and using a security authentication protocol. After the firewall is deployed, the working status, rule configuration, and alarm settings of the firewall are regularly checked to ensure that it always complies with security policies and compliance requirements. Through log analysis and alarms, abnormal behaviors can be discovered and responded to in a timely manner to prevent potential threats from entering computer devices involved in confidential data.

[0123] Specifically, for step 8, data security backup includes backing up confidential data to multiple servers or cloud storage. Each server is located at a certain distance, so as to avoid the loss of all data due to problems with a single server. While backing up, time nodes are set to achieve scheduled backup.

[0124] The system can also achieve the backup of confidential data in the following ways: Confidential data is backed up to the hard disk or solid-state drive inside the computer so that confidential data can be quickly restored. If the computer equipment fails, the backed-up data can be used for recovery; the data is backed up to a server or cloud storage in a remote location so that the data can be quickly restored when needed. This method can restore and update the data without affecting the original data. The frequency of data backup should be determined according to the actual situation. Generally speaking, backing up once a day is a common method. At the same time, the backup time point should also be set to ensure that the data can be restored at any time. In more detail, the effect quality of the shielding technology of computer equipment depends largely on the material properties used to make the shielding device. The shielding performance calculation formula can be simplified to Se = A + R, A refers to absorption loss, and R refers to reflection loss. The information leakage shielding effect of selecting high-quality electronic shielding materials is also better and more efficient, thereby establishing an effective safety net for computer information. Usually, the impedance of the shielding material is affected by the proportional change of the electric field and the magnetic field. The factors that affect the shielding effect are mainly the thickness of the shielding material, the relative magnetic permeability and the relative conductivity. In order to improve the effect of shielding materials in absorbing losses, in the embodiment of the present application, the shielding materials of computer equipment involving confidential data can be made of iron materials.

[0125] See also Figure 7 , Figure 7 A data processing device provided in an embodiment of the present application, the device 700 includes: an acquisition unit 701, a generation unit 702, an encryption unit 703, a sending unit 704, a decryption unit 705 and a processing unit 706;

[0126] The acquisition unit 701 is used for the first device to acquire a data calling password;

[0127] The generating unit 702 is configured to generate a first random number according to the data calling password by the first device if the data calling password is successfully verified;

[0128] The encryption unit 703 is used for the first device to encrypt the data calling password and the first random number by using a first encryption algorithm to obtain a first message;

[0129] The sending unit 704 is configured to cause the first device to send the first message to the second device, so that the second device decrypts the first message by using a first decryption algorithm to obtain the data calling password and the first random number, the second device generates a second random number according to the data calling password, the second device obtains a key by performing a modulus operation on the first random number and the second random number, the second device encrypts the key by using a second encryption algorithm to obtain an encryption key, and the first decryption algorithm is an algorithm for decrypting content encrypted by the first encryption algorithm;

[0130] The obtaining unit 701 is further configured for the first device to obtain the encryption key sent by the second device;

[0131] The decryption unit 705 is configured to cause the first device to decrypt the encryption key using a second decryption algorithm to obtain the key, wherein the second decryption algorithm and the second encryption algorithm are symmetric encryption algorithms;

[0132] The processing unit 706 is used for the first device to process confidential data according to the key and the second encryption algorithm.

[0133] It can be seen from the above technical solution that the data call password is obtained by the first device through the acquisition unit. If the data call password is successfully verified, the first random number is generated according to the data call password by the first device of the generation unit. The first device of the encryption unit encrypts the data call password and the first random number through the first encryption algorithm to obtain the first message. The first random number increases the randomness and unpredictability of data encryption and decryption, and improves security. The first device of the sending unit sends the first message to the second device, so that the second device decrypts the first message through the first decryption algorithm to obtain the data call password and the first random number. The second device generates a second random number according to the data call password. The second device obtains the key by performing a modulus operation on the first random number and the second random number. The second device encrypts the key by the second encryption algorithm to obtain the encryption key. The second random number increases the randomness and unpredictability of data encryption and decryption. The complexity of the verification process between the first device and the second device is further improved by performing a modulus operation on the first random number and the second random number. Even if the encryption key is leaked, it is difficult to be cracked. The encryption key sent by the second device is obtained by the first device of the acquisition unit.

[0134] The first device of the decryption unit decrypts the encryption key through the second decryption algorithm to obtain the key. The second decryption algorithm and the second encryption algorithm are symmetric encryption algorithms, which can reduce the computational complexity of encryption and decryption while ensuring data security, thereby increasing the encryption and decryption speed and efficiency. The first device of the processing unit processes the confidential data according to the key and the second encryption algorithm, so that the confidential data with a large amount of data can be processed through the more efficient second encryption algorithm, thereby increasing the encryption and decryption speed.

[0135] As a possible implementation manner, the processing unit 706 is specifically configured to:

[0136] The first device obtains a confidential data identifier of the confidential data;

[0137] The first device encrypts the confidential data identifier according to the key and the second encryption algorithm to obtain a second message;

[0138] The first device sends the second message to the second device, so that the second device decrypts the second message according to the key and the second decryption algorithm to obtain the confidential data identifier, and the second device obtains the confidential data according to the confidential data identifier;

[0139] The first device obtains the confidential data sent by the second device.

[0140] As a possible implementation manner, the processing unit 706 is specifically configured to:

[0141] The first device encrypts the confidential data according to the key and the second encryption algorithm to obtain the encrypted data;

[0142] The first device sends the encrypted data to the second device.

[0143] As a possible implementation, the device further includes a password unit, which is used to:

[0144] The first device acquires basic information, where the basic information is the employee identification or the employee's physiological characteristics;

[0145] The first device generates the data calling password according to the basic information;

[0146] The first device updates the data calling password at a preset time interval, and the length of the data calling password is greater than or equal to 6 digits, and the preset time is less than or equal to 20 days.

[0147] As a possible implementation manner, the device further includes a classification unit, which is used to:

[0148] The first device determines the confidentiality level of the confidential data;

[0149] The first device obtains the first encryption algorithm and the second encryption algorithm according to the confidentiality level. The higher the confidentiality level is, the more complex the first encryption algorithm and the second encryption algorithm are.

[0150] As a possible implementation manner, the device further includes an alarm unit, which is used to:

[0151] The first device obtains a login account and a login password;

[0152] If the login account and the login password do not match, the first device prompts for re-entry;

[0153] If the login account and the login password do not match for more than 6 consecutive times, the first device issues an alarm; or,

[0154] The first device detects an abnormal number, where the abnormal number refers to the number of abnormalities in various confidential data or the number of traffic abnormalities in each port of the first device;

[0155] If the number of abnormalities exceeds the number threshold, an alarm is issued.

[0156] As a possible implementation manner, the acquisition unit is specifically used to:

[0157] The first device obtains the data calling password through a virtual private network.

[0158] See also Figure 8 , the embodiment of the present application further provides a computer device, the computer device comprising a memory 801 and a processor 802:

[0159] The memory is used to store a computer program and transmit the computer program to the processor;

[0160] The processor is configured to execute the method of the above method embodiment according to the computer program.

[0161] An embodiment of the present application further provides a computer-readable storage medium, characterized in that the computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method of the above method embodiment.

[0162] The embodiment of the present application also provides a computer program product including a computer program, which, when executed on a computer device, enables the computer device to execute the method of the above method embodiment.

[0163] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0164] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0165] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0166] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0167] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0168] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data processing method, characterized in that: The method comprises: The first device obtains a data calling password; If the data call password is successfully verified, the first device generates a first random number according to the data call password; The first device encrypts the data calling password and the first random number by using a first encryption algorithm to obtain a first message; The first device sends the first message to the second device, so that the second device decrypts the first message by using a first decryption algorithm to obtain the data calling password and the first random number, the second device generates a second random number according to the data calling password, the second device obtains a key by performing a modulus operation on the first random number and the second random number, the second device encrypts the key by using a second encryption algorithm to obtain an encryption key, and the first decryption algorithm is an algorithm for decrypting content encrypted by the first encryption algorithm; The first device obtains the encryption key sent by the second device; The first device decrypts the encryption key by using a second decryption algorithm to obtain the key, wherein the second decryption algorithm and the second encryption algorithm are symmetric encryption algorithms; The first device processes the confidential data according to the key and the second encryption algorithm.

2. The method according to claim 1, characterized in that The first device processes the confidential data according to the key and the second encryption algorithm, including: The first device obtains a confidential data identifier of the confidential data; The first device encrypts the confidential data identifier according to the key and the second encryption algorithm to obtain a second message; The first device sends the second message to the second device, so that the second device decrypts the second message according to the key and the second decryption algorithm to obtain the confidential data identifier, and the second device obtains the confidential data according to the confidential data identifier; The first device obtains the confidential data sent by the second device.

3. The method according to claim 1, characterized in that The first device processes the confidential data according to the key and the second encryption algorithm, including: The first device encrypts the confidential data according to the key and the second encryption algorithm to obtain the encrypted data; The first device sends the encrypted data to the second device.

4. The method according to claim 1, characterized in that: The method further comprises: The first device acquires basic information, where the basic information is the employee identification or the employee's physiological characteristics; The first device generates the data calling password according to the basic information; The first device updates the data calling password at a preset time interval, and the length of the data calling password is greater than or equal to 6 digits, and the preset time is less than or equal to 20 days.

5. The method according to claim 1, characterized in that The method further comprises: The first device determines the confidentiality level of the confidential data; The first device obtains the first encryption algorithm and the second encryption algorithm according to the confidentiality level. The higher the confidentiality level is, the more complex the first encryption algorithm and the second encryption algorithm are.

6. The method according to claim 1, characterized in that The method further comprises: The first device obtains a login account and a login password; If the login account and the login password do not match, the first device prompts for re-entry; If the login account and the login password do not match for more than 6 consecutive times, the first device issues an alarm; or, The first device detects an abnormal number, where the abnormal number refers to the number of abnormalities in various confidential data or the number of traffic abnormalities in each port of the first device; If the number of abnormalities exceeds the number threshold, an alarm is issued.

7. The method according to claim 1, characterized in that The first device obtains a data calling password, including: The first device obtains the data calling password through a virtual private network.

8. A data processing device, characterized in that: The device comprises: an acquisition unit, a generation unit, an encryption unit, a sending unit, a decryption unit and a processing unit; The acquisition unit is used for the first device to acquire a data calling password; The generating unit is configured to generate a first random number according to the data calling password by the first device if the data calling password is successfully verified; The encryption unit is used for the first device to encrypt the data calling password and the first random number by using a first encryption algorithm to obtain a first message; The sending unit is configured to cause the first device to send the first message to the second device, so that the second device decrypts the first message by using a first decryption algorithm to obtain the data calling password and the first random number, the second device generates a second random number according to the data calling password, the second device obtains a key by performing a modulus operation on the first random number and the second random number, the second device encrypts the key by using a second encryption algorithm to obtain an encryption key, and the first decryption algorithm is an algorithm for decrypting content encrypted by the first encryption algorithm; The obtaining unit is further configured to allow the first device to obtain the encryption key sent by the second device; The decryption unit is configured to cause the first device to decrypt the encryption key using a second decryption algorithm to obtain the key, wherein the second decryption algorithm and the second encryption algorithm are symmetric encryption algorithms; The processing unit is used for the first device to process confidential data according to the key and the second encryption algorithm.

9. A computer device, characterized in that: The device comprises a processor and a memory: The memory is used to store program codes and transmit the program codes to the processor; The processor is used to execute the method according to any one of claims 1 to 7 according to the instructions in the program code.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method according to any one of claims 1 to 7.

Images