Data security management method, device and equipment based on swan monk system, and medium

Abstract

The invention discloses a data security management method, device and equipment based on a swan gap system, and a medium. The method comprises the following steps: encrypting first original data through a first gap terminal according to a first certificate to obtain first encrypted data; decrypting the first encrypted data through a second gap terminal according to a second certificate, and determining decrypted data of the first encrypted data; and determining whether to store the first decrypted data or not through the second gap terminal according to the first equipment code. According to the technical scheme, the data is encrypted through the first certificate of the first gap terminal, the received data is decrypted through the second certificate of the second gap terminal, the data transmission safety is guaranteed, meanwhile, verification is conducted through the second gap terminal according to the first device code contained in the decrypted data, and the verification efficiency is improved. Security management is carried out on data storage, the security of uplink data and downlink data is improved, and data security management based on the Gao Mongolia system is realized.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data security management method, device, equipment and medium based on the Hongmeng system. Background Art

[0002] Currently, in order to ensure the security of devices and data on them, device manufacturers usually burn device certificates into devices in advance when the devices leave the factory. After the device is started, it connects to the device management server through the device certificate and registers the device on the device management server.

[0003] Since the device certificate only exists on the device side, data leakage occurs when the device transmits data to the device management server. After receiving the data, the device management server directly uploads and stores the data, which can easily lead to tampered data entering the device management server, making it impossible to guarantee the database security of the device management server. Summary of the invention

[0004] The present invention provides a data security management method, device, equipment and medium based on the Hongmeng system to realize data security management based on the Hongmeng system.

[0005] In a first aspect, an embodiment of the present invention provides a data security management method based on the Hongmeng system, the method comprising:

[0006] The first certificate is determined by the first Hongmeng terminal, and the second certificate is determined by the second Hongmeng terminal; the first certificate is configured on the first Hongmeng terminal, and the second certificate is configured on the second Hongmeng terminal; the first Hongmeng terminal is a device equipped with the Hongmeng system, and the second Hongmeng terminal is a server that manages the first Hongmeng terminal;

[0007] Encrypting the first original data according to the first certificate by the first Hongmeng terminal to obtain first encrypted data, and sending the first encrypted data to the second Hongmeng terminal;

[0008] Decrypting the first encrypted data according to the second certificate through the second Hongmeng terminal to determine the decrypted data of the first encrypted data, where the decrypted data of the first encrypted data includes the first decrypted data and the first device code;

[0009] Determine whether to store the first decrypted data through the second Hongmeng terminal according to the first device code.

[0010] In a second aspect, an embodiment of the present invention further provides a data security management device based on the Hongmeng system, the device comprising:

[0011] A certificate determination module, configured to determine a first certificate through a first Hongmeng terminal, and to determine a second certificate through a second Hongmeng terminal; the first certificate is configured on the first Hongmeng terminal, and the second certificate is configured on the second Hongmeng terminal; the first Hongmeng terminal is a device equipped with the Hongmeng system, and the second Hongmeng terminal is a server that manages the first Hongmeng terminal;

[0012] a data encryption module, configured to encrypt the first original data according to the first certificate through the first Hongmeng terminal to obtain first encrypted data, and send the first encrypted data to the second Hongmeng terminal;

[0013] a data decryption module, configured to decrypt the first encrypted data according to the second certificate through the second Hongmeng terminal, and determine the decrypted data of the first encrypted data, where the decrypted data of the first encrypted data includes the first decrypted data and the first device code;

[0014] A data management module is used to determine whether to store the first decrypted data according to the first device code through a second Hongmeng terminal.

[0015] In the third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a data security management method based on the Hongmeng system as described in any one of the embodiments of the present invention is implemented.

[0016] In a fourth aspect, an embodiment of the present invention further provides a storage medium storing computer executable instructions, which, when executed by a computer processor, are used to execute a data security management method based on the Hongmeng system as described in any one of the embodiments of the present invention.

[0017] The technical solution of the embodiment of the present invention encrypts data by using the first certificate of the first Hongmeng terminal, and decrypts the received data by using the second certificate of the second Hongmeng terminal, so as to ensure the security of data transmission. At the same time, the second Hongmeng terminal verifies the first device code contained in the decrypted data, and manages the data storage securely, thereby improving the security of uplink data and downlink data.

[0018] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 It is a flow chart of a data security management method based on the Hongmeng system provided in the first embodiment of the present invention;

[0021] Figure 2 It is a structural diagram of a data security management device based on the Hongmeng system provided in the second embodiment of the present invention;

[0022] Figure 3 It is a structural diagram of an electronic device that implements the data security management method based on the Hongmeng system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] Embodiment 1

[0026] Figure 1A flowchart of a data security management method based on Hongmeng system is provided for the first embodiment of the present invention. This embodiment is applicable to data security management based on Hongmeng system. The method can be executed by a data security management device based on Hongmeng system. The data security management device based on Hongmeng system can be implemented in the form of hardware and / or software. The data security management device based on Hongmeng system can be configured in any electronic device with network communication and computing. Figure 1 As shown, the method includes:

[0027] S110. Determine a first certificate through a first Hongmeng terminal, and determine a second certificate through a second Hongmeng terminal.

[0028] In this embodiment, the first Hongmeng terminal is a device equipped with the Hongmeng system, and the second Hongmeng terminal is a server that manages the first Hongmeng terminal. The server can establish connections with multiple device terminals and obtain real-time operating data of the device terminals, such as the working status and performance indicators of the device. In addition, the device end can receive control instructions issued by the server end and perform corresponding operations, such as parameter adjustment and software upgrade.

[0029] Among them, the first certificate is configured on the first Hongmeng terminal, and the second certificate is configured on the second Hongmeng terminal. The first certificate and the second certificate are used to encrypt and decrypt data transmitted between the device and the server, and can also verify the data sending and receiving objects.

[0030] It should be noted that in this embodiment, by configuring certificates on the HarmonyOS terminals on both the device and the server, security verification is ensured when the device uploads data to the server and security verification when the server sends instructions to the device.

[0031] In the current data transmission process, the certificate only exists on the device side, and the data is directly transmitted from the device side to the server side. The security of the data cannot be guaranteed, and the server side cannot verify the source of the data.

[0032] As an optional but non-limiting implementation method, before determining the first certificate by the first Hongmeng terminal and determining the second certificate by the second Hongmeng terminal, it includes:

[0033] Determine the device code of the first Hongmeng terminal through the first Hongmeng terminal, and generate a first key pair according to the device code of the first Hongmeng terminal by using an asymmetric encryption algorithm;

[0034] and determining the device code of the first Hongmeng terminal through the second Hongmeng terminal, and generating a second key pair according to the device code of the first Hongmeng terminal using an asymmetric encryption algorithm;

[0035] The first encryption key is sent to the second HarmonyOS terminal through the first HarmonyOS terminal, and the second encryption key is sent to the first HarmonyOS terminal through the second HarmonyOS terminal.

[0036] In this embodiment, the device code of the first HarmonyOS terminal is used to represent the identification of the first HarmonyOS terminal. The device code can be a 128-bit identifier (Universally Unique Identifier, UUID) composed of numbers and letters. The device code is stored in the device hardware system. The first HarmonyOS terminal can directly obtain the corresponding device code through system tools.

[0037] In this embodiment, the first key pair includes a first encryption key and a first decryption key, wherein the first decryption key can decrypt data encrypted by the first encryption key. The second key pair includes a second encryption key and a second decryption key, wherein the second decryption key can decrypt data encrypted by the second encryption key.

[0038] In this embodiment, the first HarmonyOS terminal and the second HarmonyOS terminal respectively use an asymmetric encryption algorithm to generate a first key pair and a second key pair according to the device code of the first HarmonyOS terminal, thereby improving the key security level and enhancing the security of data transmission.

[0039] Commonly used asymmetric encryption algorithms include RSA (Rivest Shamir Adleman) algorithm and elliptic curve cryptography algorithm.

[0040] It should be noted that the first Hongmeng terminal can generate a first key pair in a security module of the device (such as a hardware security module or a software encryption library). In this embodiment, the first key pair can be generated according to the device code that uniquely identifies the first Hongmeng terminal through the RSA asymmetric encryption algorithm.

[0041] Specifically, the RSA asymmetric encryption algorithm first generates two large prime numbers p and q, and calculates the product n=pq, where the length of n is determined by the selected key length. Then, an integer e that is relatively prime to (p-1)(q-1) is selected (usually a smaller prime number, such as 65537), and d is calculated using the extended Euclidean algorithm so that ed≡1(mod(p-1)(q-1)). Then, (n,e) constitutes the first encryption key, and (n,d) constitutes the first decryption key. It should be noted that the generation of the first key pair is independently completed in the secure environment of the device terminal itself to ensure that it cannot be obtained from the outside.

[0042] The second Hongmeng terminal can obtain the device code of the first Hongmeng terminal through the device profile stored in the database, and generate the second key pair through the key generation tool or software module. Specifically, taking the RSA algorithm as an example, the generation process of the second key pair in the server is similar to the generation process of the first key pair of the device terminal, including generating two large prime numbers, calculating the product, selecting a suitable integer, and calculating the key pair through the extended Euclidean algorithm.

[0043] It should be noted that in this embodiment, the first key pair and the second key pair generated according to the device code of the first Harmony terminal using an asymmetric encryption algorithm are not the same. Through their own independent key pairs, it is ensured that even if the decryption key of the device terminal is leaked, it will not affect the security of the decryption key of the server, thereby improving data security.

[0044] The first key pair of the device terminal is mainly used for the device to decrypt the received information and encrypt the sent information, ensuring that only the device can read the information sent to itself, and the recipient (such as the server) can verify that the information is sent by the device. In addition, the second key pair of the server is used for communication security between the server and the device.

[0045] It should be noted that in this embodiment, in order to ensure the security of data transmission between the device and the server, the first encryption key is sent to the second Hongmeng terminal through the first Hongmeng terminal, so that when the second Hongmeng terminal sends data to the first Hongmeng terminal, the data is encrypted using the first encryption key, and the first Hongmeng terminal can decrypt the encrypted data. In addition, the second encryption key is sent to the first Hongmeng terminal through the second Hongmeng terminal, so that when the first Hongmeng terminal sends data to the second Hongmeng terminal, the data is encrypted using the second encryption key, and the second Hongmeng terminal can decrypt the encrypted data. The first Hongmeng terminal and the second Hongmeng terminal obtain the corresponding decryption key to ensure that the data sent by the other party can be correctly parsed, thereby improving the security of data transmission.

[0046] As an optional but non-limiting implementation method, determining the first certificate by the first Hongmeng terminal, and determining the second certificate by the second Hongmeng terminal, includes:

[0047] Generate a first certificate through the first Hongmeng terminal according to the second encryption key and the first decryption key;

[0048] And generate a second certificate through the second Hongmeng terminal according to the first encryption key and the second decryption key.

[0049] In this embodiment, the first certificate includes the second encryption key and the first decryption key, and the second certificate includes the first encryption key and the second decryption key.

[0050] A first certificate is constructed through the first Hongmeng terminal based on the second encryption key sent and the first decryption key generated, and a second certificate is constructed through the second Hongmeng terminal based on the first encryption key sent and the second decryption key generated.

[0051] It is understandable that the device can use the first certificate to encrypt information such as the device status sent to the server, so that the server can use the second certificate to decrypt the received information. The server can use the second certificate to sign information such as management instructions sent to the device, so that the device terminal can use the second certificate to verify the authenticity of the signature. At the same time, the server can use the second certificate to encrypt data to ensure that only the device with the corresponding first certificate can decrypt the data.

[0052] S120. Encrypt the first original data according to the first certificate through the first Hongmeng terminal to obtain first encrypted data, and send the first encrypted data to the second Hongmeng terminal.

[0053] In this embodiment, the first original data includes the original data sent by the first Hongmeng terminal to the second Hongmeng terminal and the device code of the first Hongmeng terminal. The original data may be the device status information (operation, shutdown, failure, etc.) of the first Hongmeng terminal, the device operation information (such as the temperature, pressure, speed and other physical parameters of the device) or the device performance indicator information (such as the bandwidth utilization rate, delay and other network parameters of the network device), etc. The first encrypted data represents the data after the first Hongmeng terminal encrypts the first original data according to the first certificate.

[0054] The first original data and information such as the device code of the first Harmony terminal are encrypted through the first certificate configured by the first Harmony terminal to obtain first encrypted data, and the first encrypted data is sent to the second Harmony terminal. The first encrypted data is specifically unreadable, so that it is transmitted under a secure communication protocol to prevent the first encrypted data from being tampered with.

[0055] As an optional but non-limiting implementation method, encrypting the first original data according to the first certificate by the first Hongmeng terminal to obtain first encrypted data, and sending the first encrypted data to the second Hongmeng terminal, including:

[0056] The first original data is encrypted by the first Hongmeng terminal according to the second encryption key to obtain the first encrypted data, and the first encrypted data is sent to the second Hongmeng terminal.

[0057] In this embodiment, the second encryption key can be understood as the public key of the second Hongmeng terminal, and the public key can be obtained by an external device. After the first original data is encrypted by the first Hongmeng terminal according to the second encryption key, the first encrypted data is sent to the second Hongmeng terminal, so that the first encrypted data can only be decrypted by the second Hongmeng terminal. During the transmission of the first encrypted data, even if the data is captured and leaked, the data security can be guaranteed.

[0058] S130. Decrypt the first encrypted data according to the second certificate through the second Hongmeng terminal to determine the decrypted data of the first encrypted data.

[0059] In this embodiment, the decrypted data of the first encrypted data includes the first decrypted data and the first device code. It should be noted that the first decrypted data is data information containing device status information (operation, shutdown, failure, etc.), device operation information (such as physical parameters such as temperature, pressure, and speed of the device), or device performance indicator information (such as network parameters such as bandwidth utilization and delay of network devices) after the first encrypted data is decrypted by the second Hongmeng terminal, and the first device code represents the device code obtained after the first encrypted data is decrypted by the second Hongmeng terminal.

[0060] It should be noted that since the first encrypted data is data encrypted according to the second encryption key, and the second decryption key can decrypt the data encrypted by the second encryption key, the first encrypted data can be decrypted by the second certificate of the second Hongmeng terminal to obtain the first decrypted data and the first device code.

[0061] As an optional but non-limiting implementation method, decrypting the first encrypted data according to the second certificate by the second Hongmeng terminal to determine the decrypted data of the first encrypted data includes:

[0062] The first encrypted data is decrypted by the second Hongmeng terminal according to the second decryption key to determine the decrypted data of the first encrypted data, where the decrypted data of the first encrypted data includes the first decrypted data and the first device code.

[0063] In this embodiment, the second decryption key can decrypt the data encrypted by the second encryption key. After the second Hongmeng terminal receives the first encrypted data, it decrypts the first encrypted data by using the second decryption key to obtain the first decrypted data and the first device code.

[0064] If the first Hongmeng terminal uses the RSA asymmetric encryption algorithm for encryption, then the second Hongmeng terminal will operate based on the RSA decryption algorithm. For the first encrypted data c encrypted by RSA, the second Hongmeng terminal can use the existing second decryption key (n, d) according to the decryption calculation formula m=c dmodn, restore the first decrypted data and the corresponding first device code and other information.

[0065] S140. Determine whether to store the first decrypted data according to the first device code through the second Hongmeng terminal.

[0066] In this embodiment, based on the parsed first device code, the second Hongmeng terminal can determine the device type corresponding to the code and the source of the first original data. Through the specific identification bit or field range in the first device code, it can be determined that this is a Hongmeng device with a certain type of specific function (such as smart wearable devices, smart home devices, etc.), or a specific product line. Different device types and sources often have different data storage strategies, because the importance, relevance, and subsequent usage scenarios of the data generated by different types of devices are different.

[0067] After determining that the second Hongmeng terminal can decrypt the first encrypted data, in order to ensure the correctness and effectiveness of data security storage and avoid occupying resources, it is also necessary to judge the first device code after decrypting the first encrypted data to determine whether to store the decrypted first decrypted data, and determine the storage location of the first decrypted data in the database.

[0068] As an optional but non-limiting implementation manner, determining, by the second Hongmeng terminal according to the first device encoding, whether to store the first original data includes:

[0069] Determine through the second Hongmeng terminal whether the first device code and the device code of the first Hongmeng terminal meet the preset conditions, and determine whether to store the first decrypted data.

[0070] In this embodiment, the preset condition may be that the first device code is the same as the device code of the first Hongmeng terminal, and the device code is used to uniquely identify a device.

[0071] It is understandable that if the first device code is the same as the device code of the first Hongmeng terminal in the device file, it means that the first decrypted data after decryption is the data sent by the trusted device of the second Hongmeng terminal, and the first decrypted data is the same as the first original data information, and the first decrypted data can be stored. In addition, the storage location of the first decrypted data can be determined according to the first device code.

[0072] If the first device code is different from the device code of the first Harmony terminal in the device file, it means that the decrypted first decrypted data is not the data sent by the trusted device of the second Harmony terminal. Even if the data is decrypted, it is not stored.

[0073] The data is stored after the second Hongmeng terminal verifies the legality of the data source between the first device code and the device code of the first Hongmeng terminal, thereby improving the security management and storage efficiency of the data at the data receiving end.

[0074] As an optional but non-limiting implementation, the method further includes:

[0075] Encrypting the second original data according to the first encryption key of the second certificate through the second Hongmeng terminal to obtain second encrypted data, and sending the second encrypted data to the first Hongmeng terminal;

[0076] Decrypting the second encrypted data according to the first decryption key of the first certificate through the first Hongmeng terminal to determine the decrypted data of the second encrypted data, where the decrypted data of the second encrypted data includes the second decrypted data and the second device code;

[0077] Determine through the first Hongmeng terminal whether the second device code and the device code of the first Hongmeng terminal meet preset conditions, and determine whether to store the second decrypted data.

[0078] In this embodiment, when the second Hongmeng terminal sends data to the first Hongmeng terminal, the second Hongmeng terminal encrypts the second original data by the first encryption key of the second certificate to obtain the second encrypted data. The second original data includes the original data sent by the second Hongmeng terminal to the first Hongmeng terminal and the device code of the second Hongmeng terminal. The original data sent by the second Hongmeng terminal to the first Hongmeng terminal may be the network configuration information, control instruction data information or system update data information of the second Hongmeng terminal. The second Hongmeng terminal sends the second encrypted data to the first Hongmeng terminal. After the first Hongmeng terminal receives the second encrypted data, the first Hongmeng terminal decrypts the second encrypted data according to the first decryption key of the first certificate to obtain the second decrypted data and the second device code. The second decrypted data is the data information containing the network configuration data, control instruction data or system update data after the second encrypted data is decrypted by the first Hongmeng terminal. The second device code represents the device code obtained after the second encrypted data is decrypted by the first Hongmeng terminal. The first Hongmeng terminal determines whether to send the data to itself according to whether the second device code and the device code of the first Hongmeng terminal meet the preset conditions, and then determines whether to store the second decrypted data.

[0079] In this embodiment, certificates are configured on both the first Hongmeng terminal and the second Hongmeng terminal, and data transmission security is guaranteed when the second Hongmeng terminal sends data to the first Hongmeng terminal.

[0080] The technical solution of the embodiment of the present invention encrypts data by using the first certificate of the first Harmony terminal, and decrypts the received data by using the second certificate of the second Harmony terminal, so as to ensure the security of data transmission. At the same time, the second Harmony terminal verifies the first device code contained in the decrypted data, and manages the data storage securely, thereby improving the security of uplink and downlink data and realizing data security management based on the Harmony system.

[0081] Embodiment 2

[0082] Figure 3 This is a schematic diagram of the structure of a data security management device based on the Hongmeng system provided in the second embodiment of the present invention. This embodiment can be applied to data security management based on the Hongmeng system. The data security management device based on the Hongmeng system can be implemented in the form of hardware and / or software. The data security management device based on the Hongmeng system can be configured in any electronic device with network communication and computing. Figure 3 As shown, the device comprises:

[0083] The certificate determination module 310 is used to determine the first certificate through the first Hongmeng terminal, and to determine the second certificate through the second Hongmeng terminal; the first certificate is configured on the first Hongmeng terminal, and the second certificate is configured on the second Hongmeng terminal; the first Hongmeng terminal is a device equipped with the Hongmeng system, and the second Hongmeng terminal is a server that manages the first Hongmeng terminal;

[0084] A data encryption module 320, configured to encrypt the first original data according to the first certificate through the first Hongmeng terminal to obtain first encrypted data, and send the first encrypted data to the second Hongmeng terminal;

[0085] A data decryption module 330, configured to decrypt the first encrypted data according to the second certificate through the second Hongmeng terminal, and determine the decrypted data of the first encrypted data, where the decrypted data of the first encrypted data includes the first decrypted data and the first device code;

[0086] The data management module 340 is used to determine whether to store the first decrypted data according to the first device code through the second Hongmeng terminal.

[0087] Optionally, before determining the first certificate by the first Hongmeng terminal and determining the second certificate by the second Hongmeng terminal, the method further includes:

[0088] Determine the device code of the first Hongmeng terminal through the first Hongmeng terminal, and generate a first key pair according to the device code of the first Hongmeng terminal using an asymmetric encryption algorithm; the device code of the first Hongmeng terminal is used to represent the identification of the first Hongmeng terminal; the first key pair includes a first encryption key and a first decryption key; the first decryption key can decrypt data encrypted by the first encryption key;

[0089] and determining the device code of the first Hongmeng terminal through the second Hongmeng terminal, and generating a second key pair according to the device code of the first Hongmeng terminal using an asymmetric encryption algorithm; the second key pair includes a second encryption key and a second decryption key; the second decryption key can decrypt data encrypted by the second encryption key;

[0090] The first encryption key is sent to the second HarmonyOS terminal through the first HarmonyOS terminal, and the second encryption key is sent to the first HarmonyOS terminal through the second HarmonyOS terminal.

[0091] Optionally, determining the first certificate by the first Hongmeng terminal, and determining the second certificate by the second Hongmeng terminal, includes:

[0092] Generate a first certificate through the first Hongmeng terminal according to the second encryption key and the first decryption key;

[0093] And generate a second certificate through the second Hongmeng terminal according to the first encryption key and the second decryption key.

[0094] Optionally, encrypting the first original data according to the first certificate by the first Hongmeng terminal to obtain first encrypted data, and sending the first encrypted data to the second Hongmeng terminal includes:

[0095] The first original data is encrypted by the first Hongmeng terminal according to the second encryption key to obtain the first encrypted data, and the first encrypted data is sent to the second Hongmeng terminal.

[0096] Optionally, decrypting the first encrypted data according to the second certificate by the second Hongmeng terminal to determine the decrypted data of the first encrypted data includes:

[0097] The first encrypted data is decrypted by the second Hongmeng terminal according to the second decryption key to determine the decrypted data of the first encrypted data.

[0098] Optionally, determining, by a second Hongmeng terminal according to the first device encoding, whether to store the first original data includes:

[0099] Determine through the second Hongmeng terminal whether the first device code and the device code of the first Hongmeng terminal meet the preset conditions, and determine whether to store the first decrypted data.

[0100] Optionally, the method further includes:

[0101] Encrypting the second original data according to the first encryption key of the second certificate through the second Hongmeng terminal to obtain second encrypted data, and sending the second encrypted data to the first Hongmeng terminal;

[0102] Decrypting the second encrypted data according to the first decryption key of the first certificate through the first Hongmeng terminal to determine the decrypted data of the second encrypted data, where the decrypted data of the second encrypted data includes the second decrypted data and the second device code;

[0103] Determine through the first Harmony terminal whether the second device code is the same as the device code of the first Harmony terminal, and determine whether to store the second decrypted data.

[0104] The technical solution of the embodiment of the present invention encrypts data by using the first certificate of the first Harmony terminal, and decrypts the received data by using the second certificate of the second Harmony terminal, so as to ensure the security of data transmission. At the same time, the second Harmony terminal verifies the first device code contained in the decrypted data, and manages the data storage securely, thereby improving the security of uplink and downlink data and realizing data security management based on the Harmony system.

[0105] The data security management device based on the Hongmeng system provided in an embodiment of the present invention can execute the data security management method based on the Hongmeng system provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0106] Embodiment 3

[0107] Figure 3 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0108] like Figure 3As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0109] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0110] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 performs the various methods and processes described above, such as a data security management method based on the Hongmeng system.

[0111] In some embodiments, the data security management method based on the Hongmeng system may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the data security management method based on the Hongmeng system described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the data security management method based on the Hongmeng system in any other appropriate manner (for example, by means of firmware).

[0112] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0113] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0114] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0115] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0116] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0117] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0118] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0119] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data security management method based on Hongmeng system, characterized in that: include: Determining the first certificate through the first Hongmeng terminal, and determining the second certificate through the second Hongmeng terminal; The first certificate is configured on a first Hongmeng terminal, and the second certificate is configured on a second Hongmeng terminal; the first Hongmeng terminal is a device equipped with the Hongmeng system, and the second Hongmeng terminal is a server that manages the first Hongmeng terminal; Encrypting the first original data according to the first certificate by the first Hongmeng terminal to obtain first encrypted data, and sending the first encrypted data to the second Hongmeng terminal; Decrypting the first encrypted data according to the second certificate through the second Hongmeng terminal to determine the decrypted data of the first encrypted data, where the decrypted data of the first encrypted data includes the first decrypted data and the first device code; Determine whether to store the first decrypted data through the second Hongmeng terminal according to the first device code.

2. The method according to claim 1, characterized in that Before determining the first certificate by the first Hongmeng terminal and determining the second certificate by the second Hongmeng terminal, the method includes: Determine the device code of the first Hongmeng terminal through the first Hongmeng terminal, and generate a first key pair according to the device code of the first Hongmeng terminal using an asymmetric encryption algorithm; the device code of the first Hongmeng terminal is used to represent the identification of the first Hongmeng terminal; the first key pair includes a first encryption key and a first decryption key; the first decryption key can decrypt data encrypted by the first encryption key; and determining the device code of the first Hongmeng terminal through the second Hongmeng terminal, and generating a second key pair according to the device code of the first Hongmeng terminal using an asymmetric encryption algorithm; the second key pair includes a second encryption key and a second decryption key; the second decryption key can decrypt data encrypted by the second encryption key; The first encryption key is sent to the second HarmonyOS terminal through the first HarmonyOS terminal, and the second encryption key is sent to the first HarmonyOS terminal through the second HarmonyOS terminal.

3. The method according to claim 2, characterized in that Determining the first certificate by the first Hongmeng terminal, and determining the second certificate by the second Hongmeng terminal, includes: Generate a first certificate through the first Hongmeng terminal according to the second encryption key and the first decryption key; And generate a second certificate through the second Hongmeng terminal according to the first encryption key and the second decryption key.

4. The method according to claim 1, characterized in that: Encrypting the first original data according to the first certificate by the first Hongmeng terminal to obtain first encrypted data, and sending the first encrypted data to the second Hongmeng terminal, including: The first original data is encrypted by the first Hongmeng terminal according to the second encryption key to obtain the first encrypted data, and the first encrypted data is sent to the second Hongmeng terminal.

5. The method according to claim 1, characterized in that Decrypting the first encrypted data according to the second certificate by the second Hongmeng terminal to determine the decrypted data of the first encrypted data includes: The first encrypted data is decrypted by the second Hongmeng terminal according to the second decryption key to determine the decrypted data of the first encrypted data.

6. The method according to claim 1, characterized in that Determining, by the second Hongmeng terminal according to the first device encoding, whether to store the first original data includes: Determine through the second Hongmeng terminal whether the first device code and the device code of the first Hongmeng terminal meet the preset conditions, and determine whether to store the first decrypted data.

7. The method according to claim 3, characterized in that The method further comprises: Encrypting the second original data according to the first encryption key of the second certificate through the second Hongmeng terminal to obtain second encrypted data, and sending the second encrypted data to the first Hongmeng terminal; Decrypting the second encrypted data according to the first decryption key of the first certificate through the first Hongmeng terminal to determine the decrypted data of the second encrypted data, where the decrypted data of the second encrypted data includes the second decrypted data and the second device code; Determine through the first Harmony terminal whether the second device code is the same as the device code of the first Harmony terminal, and determine whether to store the second decrypted data.

8. A data security management device based on Hongmeng system, characterized in that: include: A certificate determination module, used to determine a first certificate through a first Hongmeng terminal, and to determine a second certificate through a second Hongmeng terminal; The first certificate is configured on a first Hongmeng terminal, and the second certificate is configured on a second Hongmeng terminal; the first Hongmeng terminal is a device equipped with the Hongmeng system, and the second Hongmeng terminal is a server that manages the first Hongmeng terminal; a data encryption module, configured to encrypt the first original data according to the first certificate through the first Hongmeng terminal to obtain first encrypted data, and send the first encrypted data to the second Hongmeng terminal; a data decryption module, configured to decrypt the first encrypted data according to the second certificate through the second Hongmeng terminal, and determine the decrypted data of the first encrypted data, where the decrypted data of the first encrypted data includes the first decrypted data and the first device code; A data management module is used to determine whether to store the first decrypted data according to the first device code through a second Hongmeng terminal.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements the data security management method based on the Hongmeng system as described in any one of claims 1-7.

10. A storage medium storing computer executable instructions, characterized in that: The computer executable instructions, when executed by a computer processor, are used to execute the data security management method based on the Hongmeng system as described in any one of claims 1 to 7.

Images