Data protection method and device, computer equipment and storage medium

Abstract

The invention relates to a data protection method and device, computer equipment and a storage medium. The method comprises the following steps: in a process of encrypting each piece of privacy data, determining a data security type of each piece of privacy data according to a privacy data level of each piece of privacy data; for each piece of privacy data, according to the data security type, determining a target encryption algorithm corresponding to the data security type, different data security types corresponding to different encryption algorithms; and performing encryption processing on the privacy data by using the target encryption algorithm to obtain encrypted data. By adopting the method, the resource consumption in the encryption processing process can be reduced.

Description

Technical Field

[0001] The present application relates to the field of data protection technology, and in particular to a data protection method, apparatus, computer device and storage medium. Background Art

[0002] With the continuous development of cloud computing, various cloud computing related services are entering daily life. For example, with the help of cloud computing service providers, enterprises have reduced their physical resources and labor costs such as equipment, office, management, and monitoring. However, corresponding security issues, especially data privacy protection issues, are also becoming increasingly prominent.

[0003] In traditional technology, in order to protect data privacy, encryption algorithms with higher security levels are usually used to process data.

[0004] However, conventional technologies suffer from the problem of high resource consumption during data encryption processing. Summary of the invention

[0005] Based on this, it is necessary to provide a data protection method, device, computer equipment and storage medium that can reduce the consumption of resources during encryption processing in order to solve the above technical problems.

[0006] In a first aspect, the present application provides a data protection method. The method comprises:

[0007] In the process of encrypting each private data, determining the data security type of each private data according to the privacy data level of each private data;

[0008] For each of the privacy data, according to the data security type, determine the target encryption algorithm corresponding to the data security type, where different data security types correspond to different encryption algorithms;

[0009] The target encryption algorithm is used to encrypt the private data to obtain encrypted data.

[0010] In one embodiment, the data security type includes a first data security type and a second data security type, and determining, according to the data security type, a target encryption algorithm corresponding to the data security type includes:

[0011] If the data security type is the first data security type, determining that the target encryption algorithm is the first encryption algorithm;

[0012] If the data security type is the second data security type, the target encryption algorithm is determined to be the second encryption algorithm, the privacy data level corresponding to the first data security type is higher than the privacy data level corresponding to the second data security type, and the security level of the first encryption algorithm is higher than the security level of the second encryption algorithm.

[0013] In one embodiment, when the target encryption algorithm is the first encryption algorithm, encrypting the private data using the target encryption algorithm to obtain encrypted data includes:

[0014] Using the first encryption algorithm to initially encrypt the private data to obtain initial encrypted data;

[0015] Sending the initial encrypted data and the algorithm identifier of the first encryption algorithm to a server, wherein the algorithm identifier is used by the server to perform an algebraic operation on the initial encrypted data to obtain the encrypted data;

[0016] Receive the encrypted data returned by the server.

[0017] In a second aspect, the present application also provides a data protection method. The method comprises: receiving a data access request sent by a client, the data access request comprising a user identifier and a data identifier of encrypted data to be accessed, the encrypted data being encrypted according to the method described in the first aspect above;

[0018] Determining, according to the data identifier, a data security type corresponding to the encrypted data;

[0019] The data access request is responded to according to the data security type, the user identification and the encrypted data.

[0020] In one embodiment, the data security type includes a first data security type and a second data security type, the privacy data level corresponding to the first data security type is higher than the privacy data level corresponding to the second data security type, and responding to the data access request according to the data security type, the user identifier, and the encrypted data includes:

[0021] If the data security type is the first data security type, comparing the user identifier with a reference user identifier corresponding to the encrypted data, and sending the encrypted data to the client if the user identifier is the same as the reference user identifier;

[0022] If the data security type is the second data security type, the data access permission corresponding to the user identifier is determined, and the data access request is responded to according to the data access permission and the encrypted data.

[0023] In one embodiment, responding to the data access request according to the data access permission and the encrypted data includes:

[0024] If the data access rights meet the access rights range corresponding to the encrypted data, the encrypted data and the authorization identifier are sent to the client, and the authorization identifier is used by the client to decrypt the encrypted data, or the decrypted data is obtained using the authorization identifier and sent to the client.

[0025] In a third aspect, the present application also provides a data protection device. The device comprises:

[0026] A first determination module, configured to determine the data security type of each private data according to the privacy data level of each private data during the process of encrypting each private data;

[0027] A second determination module is used to determine, for each of the privacy data, a target encryption algorithm corresponding to the data security type according to the data security type, where different data security types correspond to different encryption algorithms;

[0028] The encryption module is used to encrypt the private data using the target encryption algorithm to obtain encrypted data.

[0029] In a fourth aspect, the present application further provides a data protection device. The device comprises:

[0030] A receiving module, configured to receive a data access request sent by a client, wherein the data access request includes a user identifier and a data identifier of encrypted data to be accessed, wherein the encrypted data is encrypted according to the method described in the first aspect above;

[0031] A third determination module, used to determine the data security type corresponding to the encrypted data according to the data identifier;

[0032] A response module is used to respond to the data access request according to the data security type, the user identification and the encrypted data.

[0033] In a fifth aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method described in the first and second aspects are implemented.

[0034] In a sixth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method described in the first and second aspects above are implemented.

[0035] In a seventh aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the method described in the first aspect and the second aspect are implemented.

[0036] In the above-mentioned data protection method, apparatus, computer equipment and storage medium, during the process of encrypting each privacy data, the terminal first determines the data security type of each privacy data according to the privacy data level of each privacy data, then, for each privacy data, determines the target encryption algorithm corresponding to the data security type according to the data security type, and then, uses the target encryption algorithm to encrypt the privacy data to obtain encrypted data. Since different data security types correspond to different encryption algorithms, privacy data of different privacy data levels can be encrypted using a matching target encryption algorithm, thereby avoiding the use of an encryption algorithm with complex encryption processing to encrypt all privacy data, and then can encrypt the privacy data, thereby improving data security while reducing the resource consumption of the terminal during the encryption processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 is an application environment diagram of a data protection method in an embodiment;

[0039] Figure 2 is a flow chart of a data protection method in one embodiment;

[0040] Figure 3 is a flow chart of step 203 in one embodiment;

[0041] Figure 4 is a flow chart of a data protection method in another embodiment;

[0042] Figure 5 is a structural block diagram of a data protection device in one embodiment;

[0043] Figure 6is a structural block diagram of a data protection device in another embodiment;

[0044] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0046] In the application scenario of cloud computing, user data can be sent to cloud servers for processing to save computing resources and computing costs. In the cloud computing environment, the "ownership" and "management" of user data are separated from each other, that is, the data is owned by the user, but the data management is provided by the cloud computing service provider. In the process of transmitting user data to the cloud server, there may be data security issues such as data loss or data leakage, which increases the risk of privacy data leakage in user data. Therefore, the management of information life cycle, encryption and key management, and identity and access management have become the three major areas of cloud computing security threats.

[0047] In traditional technology, in order to reduce the risk of privacy data leakage, an encryption algorithm with a higher security level is usually used to encrypt the privacy data. The higher the security level of the encryption algorithm, the more complex the calculation process, and the more resources the encryption process consumes. However, different privacy data has different privacy levels. For privacy data with a lower privacy level, an encryption algorithm with a lower security level can be used for encryption processing, and for privacy data with a higher privacy level, an encryption algorithm with a higher security level can be used for encryption processing. Therefore, there is a problem of high resource consumption in the data encryption process in traditional technology. In view of this, the present application proposes a data protection method to reduce the consumption of resources in the encryption process.

[0048] The data protection method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. In the process of encrypting each privacy data, the terminal 102 determines the data security type of each privacy data according to the privacy data level of each privacy data. Then, the terminal 102 determines the target encryption algorithm corresponding to the data security type for each privacy data according to the data security type. Different data security types correspond to different encryption algorithms. Then, the terminal 102 uses the target encryption algorithm to encrypt the privacy data to obtain encrypted data. Among them, the terminal 102 can be but not limited to various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0049] In an exemplary embodiment, Figure 2 As shown, a data protection method is provided, which is applied to Figure 1 The terminal in is used as an example to illustrate, including the following steps:

[0050] Step 201 : in the process of encrypting each privacy data, determine the data security type of each privacy data according to the privacy data level of each privacy data.

[0051] It should be noted that the terminal can send the private data to be processed to the cloud for data processing or data storage. Before sending, in order to avoid security attacks such as theft and tampering of the private data during transmission, the terminal can encrypt the private data to be sent. Among them, private data is sensitive data owned by the user and not open to the public. For example, private data can be the user's name, date of birth, ID number, bank card number, telephone number and other data. It can be understood that different private data correspond to different privacy data levels. Optionally, the privacy data level can be divided into a high privacy data level and a low privacy data level. In this embodiment, privacy data belonging to the same privacy data level can be divided into the same data security type, so that the same encryption algorithm can be used to encrypt the privacy data of the same data security type.

[0052] As a possible implementation method, the terminal can also receive a user privacy data classification scheme sent by a cloud server that provides data management for the data sent by the terminal, wherein the user privacy data classification scheme may include input parameters, output parameters, signature information, account information, processing resources allocated by the cloud server, and other information corresponding to each privacy data. The terminal can determine the privacy data level corresponding to each privacy data based on the information in the user privacy data classification scheme. Accordingly, if the information in the user privacy data classification scheme is incorrect, the terminal can also send information such as the user's business characteristics and industry characteristics to the cloud server so that the cloud server can modify the user privacy data classification scheme.

[0053] Exemplarily, if the user privacy data classification scheme divides privacy data into two categories: Class A data and Class B data, Class A data is data with a higher privacy level, such as personal login account and password, telephone number, ID number, home address, personal business data, electronic finance, personal preferences, software operation status and other data that cannot be made public; Class B data is data with a lower privacy level, such as activity movements, web browsing history, job category, work unit, personal credit, email address, web browsing traffic, consumption bills and other semi-public data.

[0054] In this embodiment, during the process of encrypting each privacy data, the terminal can first divide the privacy data into different categories according to the privacy data level of each privacy data, and then determine the data security type corresponding to each category, thereby determining the data security type corresponding to each privacy data.

[0055] Step 202: for each privacy data, determine the target encryption algorithm corresponding to the data security type according to the data security type. Different data security types correspond to different encryption algorithms.

[0056] When performing encryption processing, the terminal needs to allocate corresponding computing resources for encryption processing. In order to save resources consumed in the encryption processing process, different encryption algorithms can be used for privacy data of different privacy data levels. Among them, the target encryption algorithm refers to the encryption algorithm corresponding to different data security types. It can be understood that different data security types correspond to different encryption algorithms. Optionally, if the security level corresponding to the data security type is low, the security level of the target encryption algorithm is also low; if the security level corresponding to the data security type is high, the security level of the target encryption algorithm is also high.

[0057] In this embodiment, for each privacy data, the terminal can determine an encryption algorithm with a matching security level according to the security level corresponding to the data security type corresponding to each privacy data, and thus use the encryption algorithm as the target encryption algorithm corresponding to the data security type.

[0058] Step 203: encrypt the private data using the target encryption algorithm to obtain encrypted data.

[0059] The encrypted data refers to the data obtained by encrypting the private data.

[0060] In this embodiment, the terminal may encrypt the private data using a target encryption algorithm corresponding to the private data, and use the encrypted data as encrypted data.

[0061] As a possible implementation mode, for multiple private data, the terminal may perform encryption processing using a target encryption algorithm corresponding to each private data to obtain encrypted data corresponding to each private data.

[0062] In the above data protection method, when the terminal encrypts each privacy data, it first determines the data security type of each privacy data according to the privacy data level of each privacy data. Then, for each privacy data, according to the data security type, it determines the target encryption algorithm corresponding to the data security type. Then, the target encryption algorithm is used to encrypt the privacy data to obtain encrypted data. Since different data security types correspond to different encryption algorithms, privacy data of different privacy data levels can be encrypted using a matching target encryption algorithm, thereby avoiding the use of an encryption algorithm with complex encryption processing to encrypt all privacy data. Then, the privacy data can be encrypted, which improves data security while reducing the resource consumption of the terminal during the encryption process.

[0063] In an exemplary embodiment, the data security type includes a first data security type and a second data security type. The following describes the process of determining the target encryption algorithm corresponding to the two data security types. The above step 202 includes:

[0064] The first type: if the data security type is the first data security type, the target encryption algorithm is determined to be the first encryption algorithm.

[0065] Among them, the first data security type represents the data security type corresponding to privacy data with a higher privacy level, and the first encryption algorithm is an encryption algorithm with a higher security level. For example, the first encryption algorithm can be an AES encryption algorithm, an SM2 encryption algorithm, etc.

[0066] In this embodiment, the terminal can determine an encryption algorithm with a higher security level as the target encryption algorithm when the data security type is the first data security type. For example, the terminal can use the AES encryption algorithm as the first encryption algorithm to encrypt the privacy data belonging to the first data security type to obtain encrypted data.

[0067] The second type: If the data security type is the second data security type, the target encryption algorithm is determined to be the second encryption algorithm, the privacy data level corresponding to the first data security type is higher than the privacy data level corresponding to the second data security type, and the security level of the first encryption algorithm is higher than the security level of the second encryption algorithm.

[0068] Among them, the second data security type represents the data security type corresponding to privacy data with a lower privacy level, and the second encryption algorithm can be an encryption algorithm with a lower security level. For example, the second encryption algorithm can be an RC2 encryption algorithm, a DES encryption algorithm, an RSA encryption algorithm, a CP-ABE encryption algorithm, etc.

[0069] In this embodiment, when the data security type is the second data security type, the terminal may determine an encryption algorithm with a lower security level as the target algorithm.

[0070] Exemplarily, if the data security type is the second data security type, the terminal may determine that the target encryption algorithm is the CP-ABE encryption algorithm, and thereby encrypt the data using the CP-ABE encryption algorithm to obtain encrypted data.

[0071] In this embodiment, by determining the target encryption algorithm to be the first encryption algorithm when the data security type is the first data security type, and determining the target encryption algorithm to be the second encryption algorithm when the data security type is the second data security type, since the privacy data level corresponding to the first data security type is higher than the privacy data level corresponding to the second data security type, and the security level of the first encryption algorithm is higher than the security level of the second encryption algorithm, encryption algorithms with different security levels can be used to encrypt the privacy data in the corresponding data security type, thereby reducing the resources consumed by the entire encryption process.

[0072] In the above scenario where the target encryption algorithm is used to encrypt the private data to obtain the encrypted data, for encryption algorithms with a higher security level, the terminal can also send the private data to the cloud for algebraic operations to improve the security level of the encrypted data. In an exemplary embodiment, when the target encryption algorithm is the first encryption algorithm, such as Figure 3 As shown, the above step 203 includes:

[0073] Step 301: Initially encrypt the private data using a first encryption algorithm to obtain initial encrypted data.

[0074] It should be noted that when the terminal sends private data to the cloud for encryption, the private data needs to be initially encrypted to prevent the private data from being attacked during the process of being sent to the cloud. The first encryption algorithm can be an asymmetric encryption algorithm, and the terminal can generate a corresponding public key and private key pair for each private data, and use the public key to encrypt the private data.

[0075] In this embodiment, the terminal may use the first encryption algorithm to perform initial encryption processing on the private data, and then use the result of the initial encryption processing as the initial encrypted data.

[0076] Step 302: Send the initial encrypted data and the algorithm identifier of the first encryption algorithm to the server. The algorithm identifier is used by the server to perform algebraic operations on the initial encrypted data to obtain encrypted data.

[0077] The algorithm identifier of the first encryption algorithm refers to the identification information of the encryption algorithm. When the server receives the algorithm identifier, it can determine the privacy data level of the initial encrypted data according to the algorithm identifier, and then use the corresponding algebraic operation to encrypt the initial encrypted data to obtain the encrypted data. Exemplarily, the server can perform algebraic operations on the initial encrypted data according to the homomorphic encryption algorithm to ensure that the server performs algebraic operations without decrypting the initial encrypted data and obtains the encrypted operation result.

[0078] Exemplarily, we can assume an algebraic system U, where U includes a set S, a set of operations f1, f2,…, fn, a set of predicates p1, p2,…, pn, and some possible characters s1, s2,…, sn, and define the algebraic system as <S; f1, f2,…, fn; p1, p2,…, pn; s1, s2,…, sn>.

[0079] Under the integer set, the corresponding algebraic system is <Z; +, -, *, / ; <, >; 0, 1>; suppose another algebraic system is <S'; f'1, f'2, ..., f'n; p'1, ​​p'2, ..., p'n; s'1, s'2, ..., s'n>, and suppose the encryption function Φ: S→S' and the corresponding decryption function Φ': S'→S. Then, for m∈S, c∈S', Φ(m)=c, Φ'(c)=m; if Φ is homomorphic, then fi(m)=Φ'(f'i(c)), pi(m)≡Φ'(p'i(c)).

[0080] In this embodiment, the terminal may send the initial encrypted data and the algorithm identifier of the first encryption algorithm to the server through the network, so that the server can perform algebraic operations on the initial encrypted data according to the algorithm identifier to obtain encrypted data.

[0081] It is understandable that for the private data encrypted using the first encryption algorithm, the key corresponding to the encrypted data is only held by the user himself. The server can only perform algebraic operations on the encrypted initial encrypted data and cannot obtain the private data.

[0082] Step 303: Receive the encrypted data returned by the server.

[0083] In this embodiment, the terminal can also receive encrypted data sent by the server through the network.

[0084] It is understandable that after the terminal decrypts the encrypted data returned by the server, the decryption result obtained is consistent with the result of performing the same algebraic operation on the plaintext.

[0085] In this embodiment, the terminal initially encrypts the private data by using the first encryption algorithm to obtain initial encrypted data, and sends the initial encrypted data and the algorithm identifier of the first encryption algorithm to the server. The algorithm identifier can be used by the server to perform algebraic operations on the initial encrypted data to obtain encrypted data, and then receive the encrypted data returned by the server. Since the encrypted data returned by the server is obtained after the server performs algebraic operations, the security of the initial encrypted data can be improved, thereby improving the security of encrypting the private data of the first data security type.

[0086] In an exemplary embodiment, Figure 4 As shown, a data protection method is also provided, which is applied to Figure 1 The server in the example is used to illustrate the following steps:

[0087] Step 401: receiving a data access request sent by a client, the data access request including a user identifier and a data identifier of encrypted data to be accessed, the encrypted data being encrypted using the above data protection method.

[0088] Among them, the data access request is a request sent by the client to the server through a computer device, terminal and other devices. The data access request user obtains the data to be accessed from the server, wherein the data to be accessed can be encrypted data stored in the cloud by the terminal. It can be understood that the encrypted data is obtained by encrypting the privacy data according to the target encryption algorithm corresponding to the data security type to which the privacy data belongs in the above data protection method. Privacy data of different data security types correspond to different target encryption algorithms.

[0089] The user identifier refers to the user information corresponding to the data access request. For example, if the data access request is sent by the user of the application through the terminal, the user identifier can be the login account of the user. The data identifier refers to the unique identifier of the encrypted data to be accessed, and the data security type corresponding to the encrypted data to be accessed can be determined through the data identifier.

[0090] In this embodiment, the server may receive a data access request sent by the client through a network, and then obtain a data identifier and a user identifier from the data access request.

[0091] Step 402: Determine the data security type corresponding to the encrypted data according to the data identifier.

[0092] The data security type may be used to indicate the privacy data level corresponding to the encrypted data to be accessed. For example, encrypted data with a high privacy data level corresponds to one data security type, and encrypted data with a low privacy data level corresponds to another data security type.

[0093] In this embodiment, the server may determine the privacy data level of the encrypted data to be accessed according to the data representation in the data access request, and thereby determine the corresponding data security type according to the privacy data level.

[0094] Step 403: respond to the data access request according to the data security type, user identification and encrypted data.

[0095] It should be noted that different data security types of the encrypted data to be accessed indicate different privacy data levels corresponding to the encrypted data, and different encryption algorithms are used when encrypting the privacy data. Therefore, when responding to a data access request, the server may respond in different ways according to different data security types.

[0096] In this embodiment, the server can determine the privacy data level of the encrypted data to be accessed based on the data security type, and determine the client's access rights to the encrypted data to be accessed based on the user identifier, thereby returning the encrypted data to the client if it has access rights, or returning the decrypted data to the client after decrypting the encrypted data.

[0097] In this embodiment, the server receives a data access request sent by the client. Since the data access request includes a user identifier and a data identifier of the encrypted data to be accessed, and the encrypted data is encrypted according to the above-mentioned data protection method, the server can determine the data security type corresponding to the data to be accessed according to the data identifier, and thus can determine the client's access rights to the encrypted data to be accessed according to the data security type, and then can respond to the data access request based on the data security type, user identifier and encrypted data, thereby avoiding the leakage of encrypted data with a high privacy level to other users, thereby improving the security of privacy data protection.

[0098] In an exemplary embodiment, the data security type includes a first data security type and a second data security type, and the privacy data level corresponding to the first data security type is higher than the privacy data level corresponding to the second data security type. The following describes the server's response process to data access requests of the two data security types. The above step 403 includes:

[0099] The first type: if the data security type is the first data security type, the user identifier is compared with the reference user identifier corresponding to the encrypted data, and when the user identifier is the same as the reference user identifier, the encrypted data is sent to the client.

[0100] The reference user identifier refers to the data holder of the encrypted data. It should be noted that for the private data of the first data security type, only the data holder of the private data has the key and can use the key to decrypt the encrypted data to obtain the decrypted data, and other users cannot access the private data.

[0101] In this embodiment, when the data security type is the first data security type, the server can determine that the privacy data level of the encrypted data is higher, and thus can use a text comparison algorithm to compare the user identifier with the reference identifier corresponding to the encrypted data to be accessed, and then determine whether the user identifier is the same as the reference user identifier based on the comparison result. Then, when the user identifier is the same as the reference user identifier, it is determined that the client can have access to the encrypted data, and the encrypted data is sent to the client.

[0102] The second type: if the data security type is the second data security type, determine the data access permission corresponding to the user identifier, and respond to the data access request according to the data access permission and the encrypted data.

[0103] As a possible implementation method, the terminal can set corresponding access permissions based on the privacy data of the second data security type, and establish an access control policy tree based on the correspondence between each privacy data and the corresponding accessible user, so that when a data access request is received, the data access permission corresponding to the user identifier can be determined according to the access control policy tree.

[0104] In this embodiment, when the data security type is the second data security type, the server can determine that the privacy data level of the encrypted data is low, and thus can determine a reference user identifier that is the same as the user identifier based on a pre-established access control policy tree, and then determine the data access permission corresponding to the reference user identifier as the data access permission corresponding to the user identifier, and then determine whether the client can access the encrypted data based on the data access permission, and then send the encrypted data to the client if the client can access the encrypted data, or decrypt the encrypted data and send the decrypted data to the client.

[0105] As an optional implementation, the above “responding to the data access request according to the data access permission and the encrypted data” may include:

[0106] If the data access rights meet the access rights range corresponding to the encrypted data, the encrypted data and the authorization identifier are sent to the client, and the authorization identifier is used by the client to decrypt the encrypted data. Alternatively, the decrypted data is obtained using the authorization identifier and sent to the client.

[0107] Among them, the access permission range refers to the range between the maximum access permission and the minimum access permission that the client can access. For example, the levels of user 1, user 2, and user 3 decrease in sequence. If encrypted data A can be accessed by user 1, user 2, and user 3 at the same time, then the access permission range of encrypted data A is determined to include user 1, user 2, and user 3. If encrypted data B can only be accessed by user A, then the access permission range of encrypted data B is determined to include user 1.

[0108] The authorization identifier is used to indicate that the client is allowed to access the encrypted data, and the authorization identifier may be a key corresponding to the encrypted data.

[0109] In this embodiment, the server can determine that the client can access the encrypted data if the data access rights meet the access rights scope corresponding to the encrypted data, and then send the encrypted data and the authorization identifier to the client, so that the client can decrypt the encrypted data according to the authorization identifier to obtain the decrypted data; alternatively, the server can also use the authorization identifier to decrypt the encrypted data to obtain the decrypted data, and send the decrypted data to the client.

[0110] In this embodiment, when the data security type is the first data security type, the server compares the user identifier with the reference user identifier corresponding to the encrypted data, and sends the encrypted data to the client when the user identifier is the same as the reference user identifier; and when the data security type is the second data security type, the server determines the data access rights corresponding to the user identifier, and responds to the data access request based on the data access rights and the encrypted data, thereby being able to respond to the data access request in a corresponding response manner for the encrypted data to be accessed of different data security types, thereby being able to protect the security of the privacy data while responding to the data access request.

[0111] To facilitate understanding by those skilled in the art, the data protection method provided by the present application is described in detail below. The method may include:

[0112] S1, the terminal receives the privacy data classification strategy sent by the cloud server, and determines the privacy data level of each privacy data according to the privacy data classification strategy.

[0113] S2. The terminal determines the data security type of each privacy data according to the privacy data level of each privacy data.

[0114] S3: For each privacy data, if the data security type is the first data security type, the terminal determines that the target encryption algorithm is the first encryption algorithm.

[0115] S4, the terminal uses the first encryption algorithm to initially encrypt the private data to obtain initial encrypted data.

[0116] S5, the terminal sends the initial encrypted data and the algorithm identifier of the first encryption algorithm to the server.

[0117] S6, the server performs algebraic operations on the initial encrypted data according to the algorithm identifier to obtain encrypted data.

[0118] S7, the terminal receives the encrypted data returned by the server.

[0119] S8. If the data security type is the second data security type, the terminal determines that the target encryption algorithm is the second encryption algorithm, and uses the second encryption algorithm to encrypt the privacy data corresponding to the second data security type to obtain encrypted data.

[0120] S9, the server receives the data access request sent by the client.

[0121] S10, the server determines the data security type corresponding to the encrypted data according to the data identifier.

[0122] S11, if the data security type is the first data security type, the server compares the user identifier with a reference user identifier corresponding to the encrypted data, and sends the encrypted data to the client if the user identifier is the same as the reference user identifier.

[0123] S12: If the data security type is the second data security type, the server determines the data access permission corresponding to the user identifier, and responds to the data access request according to the data access permission and the encrypted data.

[0124] S13, if the data access rights meet the access rights range corresponding to the encrypted data, the server sends the encrypted data and the authorization identifier to the client, and the authorization identifier is used by the client to decrypt the encrypted data, or the decrypted data is obtained using the authorization identifier and sent to the client.

[0125] It should be noted that for the descriptions in the above S1-S13, reference may be made to the relevant descriptions in the above embodiments, and the effects are similar, so this embodiment will not be repeated here.

[0126] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0127] Based on the same inventive concept, the embodiment of the present application also provides a data protection device for implementing the data protection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more data protection device embodiments provided below can refer to the limitations on the data protection method above, and will not be repeated here.

[0128] In one embodiment, Figure 5 As shown, a data protection device is provided, including: a first determination module 501, a second determination module 502 and an encryption module 503, wherein:

[0129] A first determination module 501 is used to determine the data security type of each privacy data according to the privacy data level of each privacy data during the encryption process of each privacy data;

[0130] The second determination module 502 is used to determine, for each privacy data, a target encryption algorithm corresponding to the data security type according to the data security type, and different encryption algorithms correspond to different data security types;

[0131] The encryption module 503 is used to encrypt the private data using a target encryption algorithm to obtain encrypted data.

[0132] The data protection device provided in this embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0133] In one embodiment, the data security type includes a first data security type and a second data security type, and the encryption module 503 includes:

[0134] A first determining unit, configured to determine that the target encryption algorithm is the first encryption algorithm if the data security type is the first data security type;

[0135] The second determination unit is used to determine that the target encryption algorithm is the second encryption algorithm if the data security type is the second data security type, the privacy data level corresponding to the first data security type is higher than the privacy data level corresponding to the second data security type, and the security level of the first encryption algorithm is higher than the security level of the second encryption algorithm.

[0136] The data protection device provided in this embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0137] In one embodiment, when the target encryption algorithm is the first encryption algorithm, the encryption module 503 includes:

[0138] An encryption unit, used to perform initial encryption on the private data using a first encryption algorithm to obtain initial encrypted data;

[0139] A sending unit, used to send the initial encrypted data and an algorithm identifier of the first encryption algorithm to the server, the algorithm identifier is used by the server to perform algebraic operations on the initial encrypted data to obtain encrypted data;

[0140] The receiving unit is used to receive the encrypted data returned by the server.

[0141] The data protection device provided in this embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0142] Each module in the above data protection device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0143] In one embodiment, Figure 6 As shown, a data protection device is also provided, including: a receiving module 601, a third determining module 602 and a responding module 603, wherein:

[0144] A receiving module 601 is used to receive a data access request sent by a client, where the data access request includes a user identifier and a data identifier of encrypted data to be accessed, where the encrypted data is encrypted according to the method of claim 1 or 2;

[0145] A third determination module 602, configured to determine the data security type corresponding to the encrypted data according to the data identifier;

[0146] The response module 603 is used to respond to the data access request according to the data security type, user identification and encrypted data.

[0147] In one embodiment, the data security type includes a first data security type and a second data security type, and the privacy data level corresponding to the first data security type is higher than the privacy data level corresponding to the second data security type. The above-mentioned response module 603 includes:

[0148] a first determining unit, configured to compare the user identifier with a reference user identifier corresponding to the encrypted data if the data security type is a first data security type, and send the encrypted data to the client if the user identifier is the same as the reference user identifier;

[0149] The second determining unit is configured to determine the data access permission corresponding to the user identifier if the data security type is the second data security type, and respond to the data access request according to the data access permission and the encrypted data.

[0150] The data protection device provided in this embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0151] In one embodiment, the second determining unit is specifically configured to:

[0152] If the data access rights meet the access rights range corresponding to the encrypted data, the encrypted data and the authorization identifier are sent to the client, and the authorization identifier is used by the client to decrypt the encrypted data, or the decrypted data is obtained using the authorization identifier and sent to the client.

[0153] The data protection device provided in this embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0154] Each module in the above data protection device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0155] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a data protection method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0156] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0157] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0158] In the process of encrypting each privacy data, the data security type of each privacy data is determined according to the privacy data level of each privacy data;

[0159] For each privacy data, determine the target encryption algorithm corresponding to the data security type according to the data security type. Different data security types correspond to different encryption algorithms.

[0160] The private data is encrypted using the target encryption algorithm to obtain encrypted data.

[0161] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0162] If the data security type is the first data security type, determining the target encryption algorithm to be the first encryption algorithm;

[0163] If the data security type is the second data security type, the target encryption algorithm is determined to be the second encryption algorithm, the privacy data level corresponding to the first data security type is higher than the privacy data level corresponding to the second data security type, and the security level of the first encryption algorithm is higher than the security level of the second encryption algorithm.

[0164] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0165] Using a first encryption algorithm to initially encrypt the private data to obtain initial encrypted data;

[0166] Sending the initial encrypted data and the algorithm identifier of the first encryption algorithm to the server, where the algorithm identifier is used by the server to perform algebraic operations on the initial encrypted data to obtain encrypted data;

[0167] Receive the encrypted data returned by the server.

[0168] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0169] Receiving a data access request sent by a client, the data access request including a user identifier and a data identifier of encrypted data to be accessed, the encrypted data being encrypted according to the above data protection method;

[0170] Determine the data security type corresponding to the encrypted data according to the data identifier;

[0171] Respond to data access requests based on data security type, user identity, and encrypted data.

[0172] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0173] If the data security type is the first data security type, comparing the user identifier with a reference user identifier corresponding to the encrypted data, and sending the encrypted data to the client if the user identifier is the same as the reference user identifier;

[0174] If the data security type is the second data security type, the data access permission corresponding to the user identifier is determined, and the data access request is responded to according to the data access permission and the encrypted data.

[0175] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0176] If the data access rights meet the access rights range corresponding to the encrypted data, the encrypted data and the authorization identifier are sent to the client, and the authorization identifier is used by the client to decrypt the encrypted data, or the decrypted data is obtained using the authorization identifier and sent to the client.

[0177] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0178] In the process of encrypting each privacy data, the data security type of each privacy data is determined according to the privacy data level of each privacy data;

[0179] For each privacy data, determine the target encryption algorithm corresponding to the data security type according to the data security type. Different data security types correspond to different encryption algorithms.

[0180] The private data is encrypted using the target encryption algorithm to obtain encrypted data.

[0181] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0182] If the data security type is the first data security type, determining the target encryption algorithm to be the first encryption algorithm;

[0183] If the data security type is the second data security type, the target encryption algorithm is determined to be the second encryption algorithm, the privacy data level corresponding to the first data security type is higher than the privacy data level corresponding to the second data security type, and the security level of the first encryption algorithm is higher than the security level of the second encryption algorithm.

[0184] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0185] Using a first encryption algorithm to initially encrypt the private data to obtain initial encrypted data;

[0186] Sending the initial encrypted data and the algorithm identifier of the first encryption algorithm to the server, where the algorithm identifier is used by the server to perform algebraic operations on the initial encrypted data to obtain encrypted data;

[0187] Receive the encrypted data returned by the server.

[0188] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0189] Receiving a data access request sent by a client, the data access request including a user identifier and a data identifier of encrypted data to be accessed, the encrypted data being encrypted according to the above data protection method;

[0190] Determine the data security type corresponding to the encrypted data according to the data identifier;

[0191] Respond to data access requests based on data security type, user identity, and encrypted data.

[0192] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0193] If the data security type is the first data security type, comparing the user identifier with a reference user identifier corresponding to the encrypted data, and sending the encrypted data to the client if the user identifier is the same as the reference user identifier;

[0194] If the data security type is the second data security type, the data access permission corresponding to the user identifier is determined, and the data access request is responded to according to the data access permission and the encrypted data.

[0195] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0196] If the data access rights meet the access rights range corresponding to the encrypted data, the encrypted data and the authorization identifier are sent to the client, and the authorization identifier is used by the client to decrypt the encrypted data, or the decrypted data is obtained using the authorization identifier and sent to the client.

[0197] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0198] In the process of encrypting each privacy data, the data security type of each privacy data is determined according to the privacy data level of each privacy data;

[0199] For each privacy data, determine the target encryption algorithm corresponding to the data security type according to the data security type. Different data security types correspond to different encryption algorithms.

[0200] The private data is encrypted using the target encryption algorithm to obtain encrypted data.

[0201] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0202] If the data security type is the first data security type, determining the target encryption algorithm to be the first encryption algorithm;

[0203] If the data security type is the second data security type, the target encryption algorithm is determined to be the second encryption algorithm, the privacy data level corresponding to the first data security type is higher than the privacy data level corresponding to the second data security type, and the security level of the first encryption algorithm is higher than the security level of the second encryption algorithm.

[0204] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0205] Using a first encryption algorithm to initially encrypt the private data to obtain initial encrypted data;

[0206] Sending the initial encrypted data and the algorithm identifier of the first encryption algorithm to the server, where the algorithm identifier is used by the server to perform algebraic operations on the initial encrypted data to obtain encrypted data;

[0207] Receive the encrypted data returned by the server.

[0208] In one embodiment, a computer program product is also provided, including a computer program, which, when executed by a processor, implements the following steps:

[0209] Receiving a data access request sent by a client, the data access request including a user identifier and a data identifier of encrypted data to be accessed, the encrypted data being encrypted according to the above data protection method;

[0210] Determine the data security type corresponding to the encrypted data according to the data identifier;

[0211] Respond to data access requests based on data security type, user identity, and encrypted data.

[0212] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0213] If the data security type is the first data security type, comparing the user identifier with a reference user identifier corresponding to the encrypted data, and sending the encrypted data to the client if the user identifier is the same as the reference user identifier;

[0214] If the data security type is the second data security type, the data access permission corresponding to the user identifier is determined, and the data access request is responded to according to the data access permission and the encrypted data.

[0215] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0216] If the data access rights meet the access rights range corresponding to the encrypted data, the encrypted data and the authorization identifier are sent to the client, and the authorization identifier is used by the client to decrypt the encrypted data, or the decrypted data is obtained using the authorization identifier and sent to the client.

[0217] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0218] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0219] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data protection method, characterized in that: The method comprises: In the process of encrypting each private data, determining the data security type of each private data according to the privacy data level of each private data; For each of the privacy data, according to the data security type, determine the target encryption algorithm corresponding to the data security type, where different data security types correspond to different encryption algorithms; The target encryption algorithm is used to encrypt the private data to obtain encrypted data.

2. The method according to claim 1, characterized in that The data security type includes a first data security type and a second data security type, and determining, according to the data security type, a target encryption algorithm corresponding to the data security type includes: If the data security type is the first data security type, determining that the target encryption algorithm is the first encryption algorithm; If the data security type is the second data security type, the target encryption algorithm is determined to be the second encryption algorithm, the privacy data level corresponding to the first data security type is higher than the privacy data level corresponding to the second data security type, and the security level of the first encryption algorithm is higher than the security level of the second encryption algorithm.

3. The method according to claim 2, characterized in that In a case where the target encryption algorithm is the first encryption algorithm, encrypting the private data using the target encryption algorithm to obtain encrypted data includes: Using the first encryption algorithm to initially encrypt the private data to obtain initial encrypted data; Sending the initial encrypted data and the algorithm identifier of the first encryption algorithm to a server, wherein the algorithm identifier is used by the server to perform an algebraic operation on the initial encrypted data to obtain the encrypted data; Receive the encrypted data returned by the server.

4. A data protection method, characterized in that: The method comprises: Receiving a data access request sent by a client, the data access request including a user identifier and a data identifier of encrypted data to be accessed, the encrypted data being encrypted according to the method according to any one of claims 1 to 3; Determining, according to the data identifier, a data security type corresponding to the encrypted data; The data access request is responded to according to the data security type, the user identification and the encrypted data.

5. The method according to claim 4, characterized in that The data security type includes a first data security type and a second data security type, the privacy data level corresponding to the first data security type is higher than the privacy data level corresponding to the second data security type, and responding to the data access request according to the data security type, the user identifier, and the encrypted data includes: If the data security type is the first data security type, comparing the user identifier with a reference user identifier corresponding to the encrypted data, and sending the encrypted data to the client if the user identifier is the same as the reference user identifier; If the data security type is the second data security type, the data access permission corresponding to the user identifier is determined, and the data access request is responded to according to the data access permission and the encrypted data.

6. The method according to claim 5, characterized in that The responding to the data access request according to the data access permission and the encrypted data includes: If the data access rights meet the access rights range corresponding to the encrypted data, the encrypted data and the authorization identifier are sent to the client, and the authorization identifier is used by the client to decrypt the encrypted data, or the decrypted data is obtained using the authorization identifier and sent to the client.

7. A data protection device, characterized in that: The device comprises: A first determination module, configured to determine the data security type of each private data according to the privacy data level of each private data during the process of encrypting each private data; A second determination module is used to determine, for each of the privacy data, a target encryption algorithm corresponding to the data security type according to the data security type, where different data security types correspond to different encryption algorithms; The encryption module is used to encrypt the private data using the target encryption algorithm to obtain encrypted data.

8. A data protection device, characterized in that: The device comprises: A receiving module, configured to receive a data access request sent by a client, wherein the data access request includes a user identifier and a data identifier of encrypted data to be accessed, wherein the encrypted data is encrypted according to the method according to any one of claims 1 to 3; A third determination module, used to determine the data security type corresponding to the encrypted data according to the data identifier; A response module is used to respond to the data access request according to the data security type, the user identification and the encrypted data.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images