Data security protection method and device, equipment, medium and product

Abstract

The invention discloses a data security protection method, device and equipment, a medium and a product. The method comprises the following steps: under the condition that an information authentication request sent by a service mobile terminal is received, determining authentication associated information; sending the object identifier and the to-be-verified identifier to a first block chain node, so as to perform information authentication based on the first block chain node according to the object identifier and the to-be-verified identifier; acquiring digital signature information corresponding to the access request object according to the authentication identifier under the condition that the received first authentication result fed back by the first block chain node is that the authentication is passed; and determining a second authentication result corresponding to the access request object according to the object identifier, the to-be-verified identifier, the first key encryption password and the digital signature information, and feeding back the second authentication result to the service mobile terminal. According to the technical scheme, secondary authentication is performed on the object information in combination with a block chain technology, so that the effect that the data and the system are always in a safe state is ensured, and the data are effectively ensured to be real and effective.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data security protection method, device, equipment, medium and product. Background Art

[0002] In the financial industry, the security protection of sensitive risk data is of vital importance. Therefore, financial institutions need to take effective measures to protect the security of these sensitive risk data.

[0003] In the related art, sensitive risk data is usually protected by password verification. However, single-factor verification has relatively weak protection, and the effectiveness of password verification for security protection in mobile terminals is reduced, which leads to the inability to effectively protect data security in mobile terminals. Summary of the invention

[0004] The present invention provides a data security protection method, device, equipment, medium and product to achieve secondary authentication of object information in combination with blockchain technology to ensure that the data and system are always in a safe state, effectively ensuring that the data is authentic and valid.

[0005] According to one aspect of the present invention, a data security protection method is provided, the method comprising:

[0006] In the case of receiving an information authentication request sent by the service mobile terminal, determining authentication association information corresponding to the information authentication request; wherein the authentication association information at least includes an object identifier corresponding to the access request object, an authentication identifier, a first key encryption password, and an identifier to be verified;

[0007] Sending the object identifier and the identifier to be verified to a first blockchain node, so as to perform information authentication based on the object identifier and the identifier to be verified by the first blockchain node;

[0008] When the first authentication result fed back by the first blockchain node is that the authentication is passed, obtaining digital signature information corresponding to the access request object according to the authentication identifier;

[0009] A second authentication result corresponding to the access request object is determined according to the object identifier, the identifier to be verified, the first key encryption password and the digital signature information, and the second authentication result is fed back to the service mobile terminal.

[0010] According to another aspect of the present invention, there is provided a data security protection device, the device comprising:

[0011] An authentication information determination module, configured to determine authentication-related information corresponding to an information authentication request sent by a service mobile terminal upon receiving the information authentication request; wherein the authentication-related information at least includes an object identifier corresponding to an access request object, an authentication identifier, a first key encryption password, and an identifier to be verified;

[0012] An identification authentication module, used to send the object identification and the identification to be verified to the first blockchain node, so as to perform information authentication based on the object identification and the identification to be verified by the first blockchain node;

[0013] A signature information determination module, configured to obtain digital signature information corresponding to the access request object according to the authentication identifier when receiving a first authentication result fed back by the first blockchain node indicating that the authentication is passed;

[0014] An authentication result determination module is used to determine a second authentication result corresponding to the access request object based on the object identifier, the identifier to be verified, the first key encryption password and the digital signature information, and feed back the second authentication result to the business mobile terminal.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data security protection method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data security protection method described in any embodiment of the present invention when executed.

[0020] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the data security protection method described in any embodiment of the present invention is implemented.

[0021] The technical solution of the embodiment of the present invention determines the authentication association information corresponding to the information authentication request when receiving the information authentication request sent by the business mobile terminal; wherein the authentication association information at least includes the object identifier, authentication identifier, first key encryption password and to-be-verified identifier corresponding to the access request object; further, the object identifier and the to-be-verified identifier are sent to the first blockchain node, so as to perform information authentication based on the first blockchain node according to the object identifier and the to-be-verified identifier; further, when the first authentication result fed back by the first blockchain node is that the authentication is passed, the digital signature information corresponding to the access request object is obtained according to the authentication identifier; further, the second authentication result corresponding to the access request object is determined according to the object identifier, the to-be-verified identifier, the first key encryption password and the digital signature information, and the second authentication result is fed back to the business mobile terminal, thereby solving the problem that the sensitive risk data of the mobile terminal cannot be effectively protected in the related technology, and realizing the effect of performing secondary authentication on the object information in combination with the blockchain technology to ensure that the data and the system are always in a safe state, effectively ensuring the authenticity and validity of the data, preventing data tampering, protecting the digital asset security of the user, and improving the authenticity of the data.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 is a flow chart of a data security protection method provided according to Embodiment 1 of the present invention;

[0025] Figure 2 is a flow chart of a data security protection method provided according to Embodiment 2 of the present invention;

[0026] Figure 3 is a structural schematic diagram of a data security protection device provided according to Embodiment 3 of the present invention;

[0027] Figure 4 It is a structural schematic diagram of an electronic device for implementing the data security protection method of an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] Embodiment 1

[0031] Figure 1 This is a flow chart of a data security protection method provided by the first embodiment of the present invention. This embodiment is applicable to the case where object-related information is authenticated before data access. The method can be executed by a data security protection device, which can be implemented in the form of hardware and / or software, and can be configured in a terminal and / or server. Figure 1 As shown, the method includes:

[0032] S110. When receiving an information authentication request sent by a business mobile terminal, determine the authentication association information corresponding to the information authentication request; wherein the authentication association information at least includes an object identifier corresponding to the access request object, an authentication identifier, a first key encryption password and an identifier to be verified.

[0033] It should be noted that the technical solution of the embodiment of the present invention can be applied to an information processing server. The information processing server can be used to perform information registration and information authentication.

[0034] Among them, the business mobile terminal can be a mobile terminal that receives the user's business request and provides corresponding business data based on the business request. Optionally, the business mobile terminal includes a financial business mobile terminal, for example, a mobile terminal installed with a financial business application and / or a financial business applet, etc. The information authentication request can be understood as an instruction for requesting to perform the information authentication operation. The authentication-related information can be understood as information associated with the information authentication process. The authentication-related information can be the information required to respond to the information authentication request. The authentication-related information at least includes an object identifier, an authentication identifier, a first key encryption password, and a to-be-verified identifier corresponding to the access request object. The access request object can be an object that requests relevant business data based on the business mobile terminal. Generally, for the security of data, before requesting relevant business data, it is necessary to perform information authentication on the access request object. Furthermore, when the information authentication is successful, the corresponding business data can be fed back based on the business request input by the access request object. It should be noted that the access request object can be an object that has completed registration in the relevant application of the business mobile terminal; or, it can also be an object that has not been registered in the relevant application of the business mobile terminal. The object identifier can be a set of data that uniquely identifies the object. Optionally, the object identifier may be an object account name, an object name, or other information that can uniquely identify the object. The authentication identifier may be unique, reliable, and difficult to forge information used to confirm the identity of the object. Optionally, the authentication identifier may be a unique information authentication identifier, such as a security token. The first key encryption password may be a string of characters encrypted using a key, which is used to verify the identity and authority of the object. The identifier to be verified may be an identifier for information verification. The identifier to be verified may be a global object identifier to be verified.

[0035] In this embodiment, the access request object can input corresponding authentication association information based on the business mobile terminal. Furthermore, when the business mobile terminal receives the authentication association information, an information authentication request can be generated based on the authentication association information, and the information authentication request can be sent to the information processing server. Further, when the information processing server receives the information authentication request sent by the business mobile terminal, the information authentication request can be parsed and the authentication association information corresponding to the access request object can be obtained. The authentication association information can include the object identifier, authentication identifier, first key encryption password and identification to be verified corresponding to the access request object.

[0036] S120. Send the object identifier and the identifier to be verified to the first blockchain node, so as to perform information authentication based on the object identifier and the identifier to be verified by the first blockchain node.

[0037] The first blockchain node may be any blockchain node in the target blockchain network. The target blockchain network may be a blockchain network associated with the business mobile terminal. It is understood that a blockchain node generally refers to a computer in the target blockchain network, which can be used to maintain and update data on the target blockchain.

[0038] In this embodiment, when the information processing server determines the authentication-related information, a blockchain node can be randomly selected in the target blockchain network associated with the service mobile terminal, and the blockchain node can be used as the first blockchain node, and the object identifier and the identifier to be verified in the authentication-related information can be sent to the first blockchain node based on the information processing server. Further, when the first blockchain node receives the object identifier and the identifier to be verified, information authentication can be performed based on the object identifier and the identifier to be verified.

[0039] Optionally, information authentication is performed based on the first blockchain node according to the object identifier and the identifier to be verified, including: retrieving the global object identifier corresponding to the access request object from the target blockchain based on the object identifier; and comparing the identifier to be verified with the global object identifier to obtain a first authentication result.

[0040] Among them, the target blockchain can be a chain structure composed of at least one block in the target blockchain network, and the chain structure can be used to verify and store relevant data. It should be noted that the type of the target blockchain can be a public chain. The advantage of this setting is that the public chain can support the decentralization of the blockchain, which can greatly improve efficiency, effectively reduce transaction costs, effectively improve security, and have persistence, can store a large amount of data for a long time, and will not fail due to hardware or software failures. The global object identifier can be understood as information that can uniquely identify an object, and this information can be mutually recognized and circulated between different systems, platforms and applications.

[0041] As an optional implementation of this embodiment, when the first blockchain node receives the object identifier and the identifier to be verified, the data stored in the target blockchain can be queried based on the object identifier to determine the global object identifier corresponding to the object identifier. Furthermore, the identifier to be verified can be compared with the global object identifier, and then, the first authentication result can be determined based on the comparison result.

[0042] Optionally, the identifier to be verified and the global object identifier are compared to obtain a first authentication result, including: when the identifier to be verified and the global object identifier are consistent, determining the first authentication result as authentication success; when the identifier to be verified and the global object identifier are inconsistent, determining the first authentication result as authentication failure.

[0043] As an optional implementation of this embodiment, when the identity to be verified and the retrieved global object identity are consistent, the first authentication result can be determined as authentication success. When the identity to be verified and the retrieved global object identity are inconsistent, the first authentication result can be determined as authentication failure.

[0044] S130. When the first authentication result fed back by the first blockchain node is that the authentication is passed, obtain the digital signature information corresponding to the access request object based on the authentication identifier.

[0045] The digital signature information may be understood as a specific data string generated by encrypting the data using a specific ciphertext. Optionally, the specific ciphertext may be a private key of the corresponding object. In this embodiment, the digital signature information may be a specific data string generated by encrypting the summary of the data using the private key of the object.

[0046] In this embodiment, when the first blockchain node determines the first authentication result, the first authentication result can be sent to the information processing server based on the first blockchain node. Further, when the first authentication result received by the information processing server is authentication passed, the digital signature information corresponding to the access request object can be obtained based on the first blockchain node according to the authentication identifier.

[0047] Optionally, obtaining digital signature information corresponding to the access request object based on the authentication identifier includes: determining a second blockchain node from at least one blockchain node, and sending an information acquisition request to the second blockchain node, so that the second blockchain node retrieves the digital signature information corresponding to the access request object from the target blockchain based on the information acquisition request; and receiving the digital signature information corresponding to the access request object fed back by the second blockchain node.

[0048] Among them, at least one blockchain node belongs to the target blockchain network associated with the business mobile terminal. The second blockchain node can be any blockchain node in the target blockchain network. It should be noted that the second blockchain node can be the same blockchain node as the first blockchain node; or, the second blockchain node can also be two different blockchain nodes from the first blockchain node. The information acquisition request can be understood as an instruction for requesting to perform the operation of obtaining information. The information acquisition request includes an authentication identifier.

[0049] As an optional implementation of this embodiment, a blockchain node can be randomly selected in the target blockchain network associated with the business mobile terminal, and the blockchain node can be used as the second blockchain node. Further, an information acquisition request can be generated based on the authentication identifier, and the information acquisition request can be sent to the second blockchain node. Further, in the case where the second blockchain node receives the information acquisition request, the digital signature information corresponding to the access request object can be retrieved from the target blockchain according to the information acquisition request. Further, in the case where the second blockchain node obtains the digital signature information, the obtained digital signature information can be fed back to the information processing server.

[0050] S140. Determine a second authentication result corresponding to the access request object according to the object identifier, the identifier to be verified, the first key encryption password and the digital signature information, and feed back the second authentication result to the service mobile terminal.

[0051] The second authentication result may be used to represent the information authentication result of the access application object. The second authentication result may include authentication success or authentication failure.

[0052] In this embodiment, when the information processing server receives the digital signature information, it can perform information authentication on the access request object according to the object identifier, the identifier to be verified, the first key encryption password and the digital signature information to obtain a second authentication result.

[0053] Optionally, a second authentication result corresponding to the access request object is determined based on the object identifier, the identifier to be verified, the first key encryption password and the digital signature information, including: decrypting the digital signature information based on the identifier to be verified and the first key encryption password to obtain a first information summary; processing the object identifier and the first key encryption password according to a preset summary extraction function to obtain a second information summary; and determining the second authentication result corresponding to the access request object based on the first information summary and the second information summary.

[0054] Among them, the first information digest can be an information digest obtained after decrypting the digital signature information. The information digest is information obtained after highly summarizing and refining the relevant data. The summary extraction function can be a function that can extract the code summary from the code file. Optionally, the summary extraction function can be an MD5 summary extraction function. It can be understood that the MD5 summary extraction function generally refers to the summary calculation of the input data (such as a string, a file, etc.) through the MD5 algorithm, and outputs a hash value of a fixed length (usually 128 bits, i.e. 16 bytes, 32 characters after hexadecimal encoding). The second information digest can be an information digest obtained after the object identifier and the key encryption password are extracted.

[0055] As an optional implementation of this embodiment, when the information processing server receives the digital signature information, the digital signature information can be decrypted according to the identifier to be verified and the first key encryption password. Then, the information digest obtained by decryption is used as the first information digest. And, the object identifier and the first key encryption password can be abstracted according to a preset abstract extraction function, and the abstract obtained is used as the second information digest. Furthermore, the first information digest and the second information digest can be compared, and the second authentication result can be determined according to the summary comparison result.

[0056] Optionally, based on the first information digest and the second information digest, a second authentication result corresponding to the access request object is determined, including: when the first information digest and the second information digest are consistent, determining the second authentication result as authentication passed; when the first information digest and the second information digest are inconsistent, determining the second authentication result as authentication failed.

[0057] As an optional implementation of this embodiment, when the first information digest and the second information digest are consistent, the second authentication result corresponding to the access request object can be determined as authentication passed. When the first information digest and the second information digest are inconsistent, the second authentication result corresponding to the access request object can be determined as authentication failed.

[0058] In this embodiment, when the service mobile terminal receives the second authentication result corresponding to the access request object, the subsequent data access process can be determined according to the second authentication result.

[0059] Based on this, on the basis of the above-mentioned technical solutions, it also includes: when the second authentication result received by the business mobile terminal is authentication passed and a data access request input by the access request object is received, the request feedback data corresponding to the data access request is retrieved and the request feedback data is displayed.

[0060] The data access request may be understood as an instruction for requesting to perform the data access operation, and the request feedback data may be understood as the business data requested based on the data access request.

[0061] As an optional implementation of this embodiment, when the second authentication result received by the business mobile terminal is authentication passed, the data access interface can be entered. Further, the access request object can input a data access request for the data access interface. Furthermore, when the business mobile terminal receives the data access request, the business data corresponding to the data access request can be retrieved based on the data access request, and the retrieved business data can be used as request feedback data. Furthermore, the request feedback data can be displayed on the relevant interface of the business mobile terminal.

[0062] In this embodiment, when the second authentication result received by the service mobile terminal is an authentication failure, authentication failure information can be generated and displayed on a relevant interface of the service mobile terminal.

[0063] The technical solution of the embodiment of the present invention determines the authentication association information corresponding to the information authentication request when receiving the information authentication request sent by the business mobile terminal; wherein the authentication association information at least includes the object identifier, authentication identifier, first key encryption password and to-be-verified identifier corresponding to the access request object; further, the object identifier and the to-be-verified identifier are sent to the first blockchain node, so as to perform information authentication based on the first blockchain node according to the object identifier and the to-be-verified identifier; further, when the first authentication result fed back by the first blockchain node is that the authentication is passed, the digital signature information corresponding to the access request object is obtained according to the authentication identifier; further, the second authentication result corresponding to the access request object is determined according to the object identifier, the to-be-verified identifier, the first key encryption password and the digital signature information, and the second authentication result is fed back to the business mobile terminal, thereby solving the problem that the sensitive risk data of the mobile terminal cannot be effectively protected in the related technology, and realizing the effect of performing secondary authentication on the object information in combination with the blockchain technology to ensure that the data and the system are always in a safe state, effectively ensuring the authenticity and validity of the data, preventing data tampering, protecting the digital asset security of the user, and improving the authenticity of the data.

[0064] Embodiment 2

[0065] Figure 2 This is a flow chart of a data security protection method provided by Embodiment 2 of the present invention. Based on the above embodiment, before information authentication, the user can also register information so that authentication can be performed based on the information stored during registration. The specific implementation method can refer to the technical solution of this embodiment. Among them, the technical terms that are the same or similar to those in the above embodiment are not repeated here.

[0066] like Figure 2 As shown, the method includes:

[0067] S210. Upon receiving an information registration request sent by the service mobile terminal, determine registration associated information corresponding to the information registration request; wherein the registration associated information includes at least an object identifier, an authentication identifier and a second key encryption password corresponding to the object to be registered.

[0068] Among them, the information registration request can be understood as an instruction for requesting to perform the information registration operation. The registration-related information can be understood as information associated with the information registration process. The registration-related information can be the information required to respond to the information registration request. The registration-related information includes at least an object identifier, an authentication identifier, and a second key encryption password corresponding to the object to be registered. The object to be registered can be an object to be registered for information in an application on a mobile business terminal. The object identifier can be a set of data that uniquely identifies the object. Optionally, the object identifier can be an object account name, an object name, or other information that can uniquely identify the object. The authentication identifier can be unique, reliable, and not easily forged information used to confirm the identity of the object. Optionally, the authentication identifier can be a unique information authentication identifier, such as a security token. The second key encryption password can be a string of characters encrypted using a key, which is used to verify the identity and authority of the object.

[0069] As an optional implementation of this embodiment, an information registration interface can be displayed based on the business mobile terminal. The information registration interface includes information registration items and information registration controls. The information registration items may include object identification input items, authentication identification input items, and key encryption password input items. Further, the object to be registered can input corresponding registration-related information for the information registration items. When a control trigger operation for the information registration control is detected, an information registration request can be generated based on the registration-related information input in the information registration interface, and the information registration request can be sent to the information processing server. Further, when the information processing server receives the information registration request sent by the business mobile terminal, the information registration request can be parsed and the registration-related information corresponding to the information registration request can be obtained. The registration-related information may include the object identification, authentication identification, and the second key encryption password corresponding to the object to be registered.

[0070] S220. Determine the object ciphertext information corresponding to the object to be registered according to the second key encryption password, generate pre-registration success information, and feed back the object ciphertext information and the pre-registration success information to the service mobile terminal.

[0071] The object ciphertext information includes the global object identifier and the first ciphertext information. The object ciphertext information can be understood as the decrypted ciphertext information required for the information authentication stage and kept by the object to be registered. The first ciphertext information can be a public key ciphertext. The pre-registration success information can be used to indicate that the pre-registration result of the object to be registered is a successful registration.

[0072] In this embodiment, when the information processing server determines the registration association information, the second key encryption password in the registration association information can be processed to determine the global object identifier and the first ciphertext information corresponding to the object to be registered. Further, the object ciphertext information corresponding to the object to be registered can be obtained.

[0073] Optionally, determining the object ciphertext information corresponding to the object to be registered based on the second key encryption password includes: processing the second key encryption password according to a preset encryption algorithm to obtain first ciphertext information and second ciphertext information; using the second ciphertext information as the global object identifier corresponding to the object to be registered, and using the global object identifier and the first ciphertext information as the object ciphertext information corresponding to the object to be registered.

[0074] The preset encryption algorithm may be a pre-written program code for implementing an encryption function. Exemplarily, the preset encryption algorithm may be a symmetric encryption algorithm or an asymmetric encryption algorithm. In this embodiment, the preset encryption algorithm may be an asymmetric encryption algorithm, such as an RSA encryption algorithm, that is, two different keys are used for encryption and decryption. When the preset encryption algorithm is an asymmetric encryption algorithm, the first ciphertext information may be a public key ciphertext, and the second ciphertext information may be a private key ciphertext.

[0075] As an optional implementation of this embodiment, the second key encryption password can be processed according to a preset encryption algorithm, and the first ciphertext information and the second ciphertext information can be obtained. Further, the second ciphertext information can be used as a global object identifier corresponding to the object to be registered. Furthermore, the global object identifier and the first ciphertext information can be used as object ciphertext information corresponding to the object to be registered. Further, pre-registration success information can be generated based on the information processing server, and the object ciphertext information and the pre-registration success information can be fed back to the service mobile terminal.

[0076] It should be noted that after obtaining the object ciphertext information corresponding to the object to be registered, when the object ciphertext information is sent to the business mobile terminal, the object ciphertext information can also be stored in the information processing server to continue to perform subsequent information registration operations based on the stored object ciphertext information.

[0077] S230: Determine the digital signature information corresponding to the object to be registered according to the object identifier and the authentication identifier.

[0078] In this embodiment, when it is determined that the pre-registration is successful, the object identifier and the authentication identifier may be processed based on the information processing server to obtain digital signature information corresponding to the object to be registered.

[0079] Optionally, the digital signature information corresponding to the object to be registered is determined based on the object identifier and the authentication identifier, including: processing the object identifier and the authentication identifier according to a preset summary extraction function to obtain an information summary corresponding to the object to be registered; encrypting the information summary based on the first ciphertext information to obtain the digital signature information corresponding to the object to be registered.

[0080] The digest extraction function may be a function capable of extracting a code digest from a code file. Optionally, the digest extraction function may be an MD5 digest extraction function. The information digest may be a digest obtained by extracting a digest of an object identifier and an authentication identifier.

[0081] As an optional implementation of this embodiment, the object identifier and the authentication identifier can be subjected to digest extraction processing according to a preset digest extraction function, and the extracted digest can be used as the information digest corresponding to the object to be registered. Further, the information digest can be encrypted according to the first ciphertext information, and the encrypted information can be used as the digital signature information corresponding to the object to be registered.

[0082] S240. Send the object identifier, the global object identifier, and the digital signature information to the third blockchain node, so that the third blockchain node updates the target blockchain based on the object identifier, the global object identifier, and the digital signature information.

[0083] The third blockchain node may be any blockchain node in the target blockchain network. It should be noted that the third blockchain node may be the same blockchain node as the first blockchain node and the second blockchain node; or the second blockchain node may be two different blockchain nodes from the first blockchain node and / or the second blockchain node.

[0084] In this embodiment, when the digital signature information is obtained, the object identifier, the global object identifier and the digital signature information can be sent to the third blockchain node based on the information processing server. Furthermore, the object identifier, the global object identifier and the digital signature information can be recorded in the corresponding blockchain based on the third blockchain node to update the target blockchain.

[0085] Optionally, updating the target blockchain based on the object identifier, the global object identifier and the digital signature information includes: assembling the object identifier, the global object identifier and the digital signature information based on a third blockchain node to obtain transaction information; broadcasting the transaction information to the target blockchain network associated with the business mobile terminal, and recording the transaction information to the target block in the target blockchain network through a consensus mechanism; adding the target block to the target blockchain in the target blockchain network.

[0086] The transaction information may include transaction data and transaction identification. The transaction data may be assembled from an object identification, a global object identification and digital signature information. The transaction identification may be information that uniquely identifies the transaction data. Optionally, the transaction identification may be a transaction code. The transaction identification may be obtained by processing the transaction data through an encryption algorithm. The consensus mechanism is a mechanism for reaching consensus in a distributed system, that is, reaching agreement between different nodes in the network to ensure the reliability and security of the system. The target block may be a newly created block.

[0087] As an optional implementation of this embodiment, the object identifier, global object identifier and digital signature information of the object to be registered can be assembled based on the third blockchain node to obtain transaction data. Afterwards, the transaction data is processed according to the encryption algorithm to obtain the transaction identifier, and the transaction data and the transaction identifier are assembled, and the information obtained after the assembly is used as the transaction information corresponding to the object to be registered. Further, the transaction information can be broadcast to the target blockchain network associated with the business mobile terminal, and the transaction information can be recorded in the newly created target block through the consensus mechanism. Further, after the transaction information is recorded in the target block, the target block of the recorded information can be linked to the target blockchain in the target blockchain network. Furthermore, the object identifier, global object identifier and digital signature information corresponding to the object to be registered can be associated and stored on the target blockchain in the target blockchain network.

[0088] S250. When the target blockchain update result fed back by the third blockchain node is a successful update, generate registration success information and feed back the registration success information to the business mobile terminal.

[0089] In this embodiment, after the target block is successfully added to the target blockchain based on the third blockchain node, it can be determined that the update result of the target blockchain is a successful update. Further, the update result of the target blockchain can be fed back to the information processing server. Further, in the case where the update result of the target blockchain based on the feedback of the third blockchain node received by the information processing server is a successful update, a successful registration message can be generated, and the successful registration message can be fed back to the business mobile terminal and displayed on the relevant interface of the business mobile terminal, so that the object to be registered can clearly and intuitively understand the information registration result.

[0090] It should be noted that when the target blockchain update result received from the third blockchain node is an update failure, registration failure information can be generated, and the registration failure information can be fed back to the business mobile terminal and displayed on the relevant interface of the business mobile terminal.

[0091] S260. When receiving an information authentication request sent by the business mobile terminal, determine the authentication association information corresponding to the information authentication request; wherein the authentication association information at least includes an object identifier corresponding to the access request object, an authentication identifier, a first key encryption password and an identifier to be verified.

[0092] S270. Send the object identifier and the identifier to be verified to the first blockchain node, so that the first blockchain node performs information authentication based on the object identifier and the identifier to be verified.

[0093] S280. When the first authentication result fed back by the first blockchain node is that the authentication is passed, obtain the digital signature information corresponding to the access request object based on the authentication identifier.

[0094] S290. Determine a second authentication result corresponding to the access request object according to the object identifier, the identifier to be verified, the first key encryption password and the digital signature information, and feed back the second authentication result to the service mobile terminal.

[0095] The technical solution of the embodiment of the present invention, when receiving an information registration request sent by a business mobile terminal, determines the registration association information corresponding to the information registration request; wherein the registration association information at least includes an object identifier, an authentication identifier and a second key encryption password corresponding to the object to be registered; further, the object ciphertext information corresponding to the object to be registered is determined according to the second key encryption password, pre-registration success information is generated, and the object ciphertext information and the pre-registration success information are fed back to the business mobile terminal; wherein the object ciphertext information includes a global object identifier and a first ciphertext information; further, the digital signature information corresponding to the object to be registered is determined according to the object identifier and the authentication identifier; further, the object identifier, the global object identifier and the digital signature information are sent to a third blockchain node, so that the third blockchain node updates the target blockchain based on the object identifier, the global object identifier and the digital signature information; further, when the target blockchain update result fed back by the third blockchain node is a successful update, a registration success information is generated, and the registration success information is fed back to the business mobile terminal, so that all the transaction information involved in the business mobile terminal is put on the chain, and then the transaction information is securely protected based on the blockchain, thereby improving the data security of the business mobile terminal.

[0096] Embodiment 3

[0097] Figure 3 Schematic diagram of the structure of a data security protection device provided by Embodiment 3 of the present invention. Figure 3 As shown, the device includes: an authentication information determination module 310, an identification authentication module 320, a signature information determination module 330 and an authentication result determination module 340.

[0098] Among them, the authentication information determination module 310 is used to determine the authentication-related information corresponding to the information authentication request when receiving the information authentication request sent by the business mobile terminal; wherein the authentication-related information at least includes the object identifier, authentication identifier, first key encryption password and identifier to be verified corresponding to the access request object; the identifier authentication module 320 is used to send the object identifier and the identifier to be verified to the first blockchain node, so as to perform information authentication based on the object identifier and the identifier to be verified by the first blockchain node; the signature information determination module 330 is used to obtain the digital signature information corresponding to the access request object according to the authentication identifier when the first authentication result fed back by the first blockchain node is that the authentication is passed; the authentication result determination module 340 is used to determine the second authentication result corresponding to the access request object according to the object identifier, the identifier to be verified, the first key encryption password and the digital signature information, and feed the second authentication result back to the business mobile terminal.

[0099] The technical solution of the embodiment of the present invention determines the authentication association information corresponding to the information authentication request when receiving the information authentication request sent by the business mobile terminal; wherein the authentication association information at least includes the object identifier, authentication identifier, first key encryption password and to-be-verified identifier corresponding to the access request object; further, the object identifier and the to-be-verified identifier are sent to the first blockchain node, so as to perform information authentication based on the first blockchain node according to the object identifier and the to-be-verified identifier; further, when the first authentication result fed back by the first blockchain node is that the authentication is passed, the digital signature information corresponding to the access request object is obtained according to the authentication identifier; further, the second authentication result corresponding to the access request object is determined according to the object identifier, the to-be-verified identifier, the first key encryption password and the digital signature information, and the second authentication result is fed back to the business mobile terminal, thereby solving the problem that the sensitive risk data of the mobile terminal cannot be effectively protected in the related technology, and realizing the effect of performing secondary authentication on the object information in combination with the blockchain technology to ensure that the data and the system are always in a safe state, effectively ensuring the authenticity and validity of the data, preventing data tampering, protecting the digital asset security of the user, and improving the authenticity of the data.

[0100] Optionally, the identification authentication module 320 includes: an identification retrieval unit and an identification authentication unit.

[0101] an identification retrieving unit, configured to retrieve, based on the first blockchain node and according to the object identification, a global object identification corresponding to the access request object from the target blockchain;

[0102] The identification authentication unit is used to compare the identification to be verified with the global object identification to obtain a first authentication result.

[0103] Optionally, the signature information determination module 330 includes: a signature information requesting unit and a signature information receiving unit.

[0104] A signature information request unit, configured to determine a second blockchain node from at least one blockchain node, and send an information acquisition request to the second blockchain node, so that the second blockchain node retrieves the digital signature information corresponding to the access request object from the target blockchain according to the information acquisition request; wherein the at least one blockchain node belongs to the target blockchain network associated with the business mobile terminal; and the information acquisition request includes the authentication identifier;

[0105] A signature information receiving unit is used to receive the digital signature information corresponding to the access request object fed back by the second blockchain node.

[0106] Optionally, the authentication result determination module 340 includes: a first information summary determination unit, a second information summary determination unit and an authentication result determination unit.

[0107] A first information digest determining unit, configured to decrypt the digital signature information according to the identifier to be verified and the first key encryption password to obtain a first information digest;

[0108] a second information digest determining unit, configured to process the object identifier and the first key encrypted password according to a preset digest extraction function to obtain a second information digest;

[0109] An authentication result determining unit is used to determine a second authentication result corresponding to the access request object according to the first information digest and the second information digest.

[0110] Optionally, the device further includes: a data access module.

[0111] A data access module is used to retrieve request feedback data corresponding to the data access request and display the request feedback data when the second authentication result received by the business mobile terminal is authentication passed and a data access request input by the access request object is received.

[0112] Optionally, the device also includes: a registration information determination module, a pre-registration module, a digital signature determination module, a blockchain update module and a registration success information generation module.

[0113] A registration information determination module, configured to determine, upon receiving an information registration request sent by a service mobile terminal, registration-related information corresponding to the information registration request; wherein the registration-related information at least includes an object identifier, an authentication identifier, and a second key encryption password corresponding to the object to be registered;

[0114] A pre-registration module, configured to determine the object ciphertext information corresponding to the object to be registered according to the second key encryption password, generate pre-registration success information, and feed back the object ciphertext information and the pre-registration success information to the service mobile terminal; wherein the object ciphertext information includes a global object identifier and the first ciphertext information;

[0115] A digital signature determination module, used to determine the digital signature information corresponding to the object to be registered according to the object identifier and the authentication identifier;

[0116] A blockchain update module, configured to send the object identifier, the global object identifier, and the digital signature information to a third blockchain node, so that the third blockchain node updates a target blockchain based on the object identifier, the global object identifier, and the digital signature information;

[0117] A registration success information generation module is used to generate registration success information when the target blockchain update result fed back by the third blockchain node is a successful update, and feed back the registration success information to the business mobile terminal.

[0118] Optionally, the pre-registration module includes: a ciphertext information determination unit and a global object identifier determination unit.

[0119] a ciphertext information determining unit, configured to process the second key encrypted password according to a preset encryption algorithm to obtain first ciphertext information and second ciphertext information;

[0120] The global object identifier determining unit is configured to use the second ciphertext information as the global object identifier corresponding to the object to be registered, and use the global object identifier and the first ciphertext information as the object ciphertext information corresponding to the object to be registered.

[0121] Optionally, the digital signature determination module includes: an information summary determination unit and a digital signature determination unit.

[0122] An information summary determination unit, used to process the object identifier and the authentication identifier according to a preset summary extraction function to obtain an information summary corresponding to the object to be registered;

[0123] A digital signature determination unit is used to encrypt the information summary according to the first ciphertext information to obtain digital signature information corresponding to the object to be registered.

[0124] Optionally, the blockchain update module includes: an information assembly unit, an information recording unit and a blockchain update unit.

[0125] an information assembling unit, configured to assemble the object identifier, the global object identifier and the digital signature information based on the third blockchain node to obtain transaction information;

[0126] An information recording unit, used to broadcast the transaction information to a target blockchain network associated with the business mobile terminal, and record the transaction information into a target block through a consensus mechanism;

[0127] A blockchain updating unit is used to add the target block to the target blockchain in the target blockchain network.

[0128] The data security protection device provided in the embodiment of the present invention can execute the data security protection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0129] Embodiment 4

[0130] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0131] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0132] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0133] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a data security protection method.

[0134] In some embodiments, the data security protection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the data security protection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the data security protection method in any other appropriate manner (e.g., by means of firmware).

[0135] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0136] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0137] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0138] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0139] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a target blockchain network, and the Internet.

[0140] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0141] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0142] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data security protection method, characterized in that: include: In the case of receiving an information authentication request sent by the service mobile terminal, determining authentication association information corresponding to the information authentication request; wherein the authentication association information at least includes an object identifier corresponding to the access request object, an authentication identifier, a first key encryption password, and an identifier to be verified; Sending the object identifier and the identifier to be verified to a first blockchain node, so as to perform information authentication based on the object identifier and the identifier to be verified by the first blockchain node; When the first authentication result fed back by the first blockchain node is that the authentication is passed, obtaining digital signature information corresponding to the access request object according to the authentication identifier; A second authentication result corresponding to the access request object is determined according to the object identifier, the identifier to be verified, the first key encryption password and the digital signature information, and the second authentication result is fed back to the service mobile terminal.

2. The data security protection method according to claim 1, characterized in that: The performing information authentication based on the first blockchain node according to the object identifier and the identifier to be verified includes: Retrieving, based on the first blockchain node and according to the object identifier, a global object identifier corresponding to the access request object from the target blockchain; The identification to be verified is compared with the global object identification to obtain a first authentication result.

3. The data security protection method according to claim 1, characterized in that: The obtaining, according to the authentication identifier, digital signature information corresponding to the access request object includes: Determine a second blockchain node from at least one blockchain node, and send an information acquisition request to the second blockchain node, so that the second blockchain node retrieves the digital signature information corresponding to the access request object from the target blockchain according to the information acquisition request; wherein the at least one blockchain node belongs to the target blockchain network associated with the business mobile terminal; and the information acquisition request includes the authentication identifier; Receive the digital signature information corresponding to the access request object fed back by the second blockchain node.

4. The data security protection method according to claim 1, characterized in that: The determining, according to the object identifier, the identifier to be verified, the first key encryption password and the digital signature information, a second authentication result corresponding to the access request object comprises: Decrypting the digital signature information according to the identifier to be verified and the first key encryption password to obtain a first information summary; Processing the object identifier and the first key encryption password according to a preset summary extraction function to obtain a second information summary; A second authentication result corresponding to the access request object is determined according to the first information digest and the second information digest.

5. The data security protection method according to claim 1, characterized in that: Also includes: In a case where the second authentication result received by the business mobile terminal is authentication passed and a data access request input by the access request object is received, request feedback data corresponding to the data access request is retrieved and the request feedback data is displayed.

6. The data security protection method according to claim 1, characterized in that: Also includes: In the case of receiving an information registration request sent by the service mobile terminal, determining registration associated information corresponding to the information registration request; wherein the registration associated information at least includes an object identifier corresponding to the object to be registered, an authentication identifier, and a second key encryption password; Determine the object ciphertext information corresponding to the object to be registered according to the second key encryption password, generate pre-registration success information, and feed back the object ciphertext information and the pre-registration success information to the service mobile terminal; wherein the object ciphertext information includes the global object identifier and the first ciphertext information; Determine the digital signature information corresponding to the object to be registered according to the object identifier and the authentication identifier; Sending the object identifier, the global object identifier, and the digital signature information to a third blockchain node, so that the third blockchain node updates a target blockchain based on the object identifier, the global object identifier, and the digital signature information; When the target blockchain update result received from the third blockchain node is a successful update, registration success information is generated and the registration success information is fed back to the business mobile terminal.

7. The data security protection method according to claim 6, characterized in that: The step of determining the object ciphertext information corresponding to the object to be registered according to the second key encryption password includes: Processing the second key encryption password according to an encryption algorithm to obtain first ciphertext information and second ciphertext information; The second ciphertext information is used as the global object identifier corresponding to the object to be registered, and the global object identifier and the first ciphertext information are used as the object ciphertext information corresponding to the object to be registered.

8. The data security protection method according to claim 6, characterized in that: The step of determining the digital signature information corresponding to the object to be registered according to the object identifier and the authentication identifier includes: Processing the object identifier and the authentication identifier according to a preset summary extraction function to obtain an information summary corresponding to the object to be registered; The information summary is encrypted according to the first ciphertext information to obtain digital signature information corresponding to the object to be registered.

9. The data security protection method according to claim 6, characterized in that: The updating of the target blockchain based on the object identifier, the global object identifier and the digital signature information includes: Assembling the object identifier, the global object identifier, and the digital signature information based on the third blockchain node to obtain transaction information; Broadcasting the transaction information to the target blockchain network associated with the business mobile terminal, and recording the transaction information into the target block through a consensus mechanism; Add the target block to the target blockchain in the target blockchain network.

10. A data security protection device, characterized in that: include: An authentication information determination module, configured to determine authentication-related information corresponding to an information authentication request sent by a service mobile terminal upon receiving the information authentication request; wherein the authentication-related information at least includes an object identifier corresponding to an access request object, an authentication identifier, a first key encryption password, and an identifier to be verified; An identification authentication module, used to send the object identification and the identification to be verified to the first blockchain node, so as to perform information authentication based on the object identification and the identification to be verified by the first blockchain node; A signature information determination module, configured to obtain digital signature information corresponding to the access request object according to the authentication identifier when receiving a first authentication result fed back by the first blockchain node indicating that the authentication is passed; An authentication result determination module is used to determine a second authentication result corresponding to the access request object based on the object identifier, the identifier to be verified, the first key encryption password and the digital signature information, and feed back the second authentication result to the business mobile terminal.

Images