Data security access method and related equipment

Abstract

The invention discloses a data security access method and related equipment, and relates to the technical field of data security, and the method comprises the steps: defining a natural person assigned with a data access authority as a visitor; configuring encryption logic for a hardware unit carried by a visitor; the encryption logic comprises the following steps: acquiring position change data of a visitor in an enterprise; generating encrypted data I based on the position change data and a preset data encryption rule; if an access login application initiated when the visitor logs in the pre-connected data server is received, performing preset position analysis based on the encrypted data I to obtain action track data I of the visitor in the enterprise and time data I during position change; the first action track data, the first time data and the first encrypted data are combined, and a first dynamic login password is obtained and sent; and when the first dynamic login password input by the visitor is received, executing a decryption process. The method and the device have the effect of reducing the probability that the data are illegally accessed.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a data security access method and related equipment. Background Art

[0002] As business continues to grow, the need to meet data security compliance within an organization becomes more urgent and important. Establishing a suitable identity authentication and access control mechanism can effectively eliminate the risk of unauthorized access to core sensitive data within an organization.

[0003] Taking the manufacturing industry as an example, in order to prevent the leakage of the company's own processes and product solutions, in addition to restricting data interaction with external networks, a data access mechanism is also established. For example, authorized personnel need to be assigned to verify and log in through a password + face verification method before data access can be performed; however, it has the following defects: With the advancement of technology, the probability of passing illegal access verification when the password is stolen is greatly increased, a typical example is the impact of 3D printing technology on face authentication. Therefore, this application proposes a new technical solution. Summary of the invention

[0004] In order to reduce the probability of illegal access to data, the present application provides a data security access method and related equipment.

[0005] In a first aspect, the present application provides a data security access method, which adopts the following technical solution: A data security access method, comprising: Define the natural person who is assigned access rights to the data; Configure encryption logic for the hardware units carried by visitors; The encryption logic comprises: Obtain data on visitor location changes within the enterprise; Generate encrypted data one based on the location change data and a preset data encryption rule; If an access login application is received when a visitor logs in to a pre-connected data server, a preset location analysis is performed based on encrypted data 1 to obtain the visitor's movement trajectory data 1 within the enterprise and the time data 1 when the location changes; Combine the action track data 1, the time data 1 and the encrypted data 1 to obtain the dynamic login password 1 and send them together; When receiving the dynamic login password one input by the visitor, the decryption process is executed; The decryption process includes: Parse the dynamic login password 1 to obtain the action track data 2 and the time data 2; According to the second action trajectory data and the second time data, the monitoring data of the corresponding position is obtained from the pre-connected enterprise monitoring system; Performing a preset position change analysis based on the monitoring data, and generating encrypted data 2 according to the analysis results and data encryption rules; Determine whether the encrypted data 1 is consistent with the encrypted data 2. If so, the login verification is determined to be successful.

[0006] Optionally, the encryption logic further includes: Obtaining the visitor's step number one, and sending the step number one to a pre-connected base station; wherein the base station is preset in a location area within the enterprise that is not covered by the monitoring system and the base station is data-connected to the hardware unit; Generate encrypted data three based on step one and data encryption rule; If an access login application is received from the data platform, the encrypted data three is combined with the encrypted data one to obtain the combined password one and send them together; The decryption process further includes: Establishing a data connection with a base station; Get the visitor's step number 2 from the base station; Generate encrypted data 4 based on step number 2 and data encryption rule, and combine encrypted data 4 with encrypted data 2 to obtain combined password 2; Determine whether combination password one and combination password two are consistent, if so, determine that the login verification is passed.

[0007] Optionally, the second step of obtaining the visitor's step number from the base station includes: Based on the monitoring data and the pre-uploaded layout diagrams of each base station, the ID of the base station closest to the location area entered by the visitor is determined, and the number of steps of the visitor is obtained from the corresponding base station according to the ID.

[0008] Optionally, the decryption process further includes: Get the power level of the hardware unit; If the battery level is lower than the preset threshold, a charging reminder is output and the charging process is executed.

[0009] In a second aspect, the present application provides a data security access system, which adopts the following technical solution: A data security access system comprises: a cloud background, a base station arranged in a location area not covered by an enterprise monitoring system, and a hardware unit carried by a visitor, wherein the base station is in communication connection with the cloud background, the cloud background is used to load and execute a computer program of a data security access method as described in any one of claims 1 to 4, the hardware unit is configured with encryption logic, the hardware unit is connected to a communication module, the communication module comprises an RFID tag and a radio frequency reader / writer, the RFID tag is built into the hardware unit, the radio frequency reader / writer is arranged in a location area not covered by the enterprise monitoring system and is wirelessly connected to the base station.

[0010] Optionally, the hardware unit includes a packaging shell and a control mainboard, a positioning module, a step counting module, a battery module and a charging module integrated in the packaging shell, the control mainboard is connected to the positioning module and the step counting module, the battery module and the charging module, the positioning module is used to obtain the visitor's location change data within the enterprise, the step counting module is used to obtain the visitor's steps, the battery module is used to power the control mainboard, and the charging module is used to charge the battery module.

[0011] In a third aspect, the present application provides a computer device, which adopts the following technical solution: A computer device comprises a memory and a processor, wherein the memory stores a computer program which can be loaded and executed by the processor to implement any of the above-mentioned data security access methods.

[0012] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium stores a computer program, wherein the computer program is executed by a processor to implement any of the data security access methods described above.

[0013] In summary, the present application includes the following beneficial technical effects: by utilizing a hardware unit to record the movement traces of visitors within the enterprise in real time, a corresponding encrypted data 1 is generated and waits for calling; when the visitor connects the hardware unit to the server and logs in to access, a dynamic login password 1 is generated by analyzing the encrypted data 1 and adding the visitor's movement traces and time within the enterprise; when the visitor logs in, the background parses the dynamic login password 1 and calls the monitoring data of the visitor's corresponding traces; by checking the actual situation reflected by the monitoring, not only can the visitor's face be recognized and verified, but also the visitor's actual location changes can be reflected from the monitoring data, and a set of encrypted data is generated accordingly; by comparing the encrypted data (visitor's location changes) generated by the hardware unit carried by the visitor at all times with the encrypted data (visitor's location changes) reflected by calling the monitoring data, it is determined whether it is a safe access, and dual authentication is achieved, thereby reducing the chance of illegal access to data. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is a flow chart of the method of the present application.

[0015] Figure 2 It is a schematic diagram of the system architecture of this application. DETAILED DESCRIPTION

[0016] The following is combined with Figure 1-2 This application is described in further detail.

[0017] The embodiment of the present application discloses a method for secure data access.

[0018] Reference Figure 1 , data security access methods include: S1. Define the natural person who is assigned data access rights as the accessor; S2, configure encryption logic for the hardware unit carried by the visitor; In this embodiment, the hardware unit can be a miniaturized structure, which is convenient for the visitor to carry with him. It is also provided with a data interface (such as a USB interface). The data connection is achieved by plugging the data interface of the hardware unit with the interface of the server carrying the data content to be accessed. Secondly, other hardware structures inside the hardware unit will be described in detail later.

[0019] Regarding encryption logic, it includes: 1) Obtain the visitor's location change data within the enterprise; In this embodiment, the hardware unit includes a packaging shell and a control mainboard, a positioning module, and a battery module integrated in the packaging shell. The control mainboard is connected to the positioning module and the battery module. The positioning module is used to obtain the visitor's location change data within the enterprise, and the battery module is used to power the control mainboard; wherein, the positioning module may adopt WIFI positioning technology, for example: a WIFI router is set up inside the enterprise, when the hardware unit carried by the visitor is connected to the WIFI inside the enterprise, the router determines the location by the signal strength to obtain the visitor's location change data moving within the enterprise, the location change data includes the location data of the visitor's stay in the enterprise and the time when the location changes, so it is also necessary to record the timestamp of each location change, for example: when the visitor moves from the office to the meeting room, record the time when the visitor leaves the office and the time when he arrives at the meeting room.

[0020] 2) Generate encrypted data 1 based on the location change data and the preset data encryption rules; In this embodiment, the data encryption rule is illustrative: a unique binary code is assigned to each location area within the enterprise, forming a location code table stored in the database, such as: the office code is 01, the conference room code is 10, the rest area code is 11, etc., the time is converted into a binary code, and the codes corresponding to the location areas where the visitor has stayed are combined according to the timestamp, for example: entering the office at 8:00, entering the conference room at 8:30, and entering the rest area at 9:10, then the generated binary sequence number (encrypted data one) is "011011".

[0021] 3) If an access login application is received when the visitor logs into the pre-connected data server, a preset location analysis is performed based on the encrypted data 1 to obtain the visitor's movement trajectory data 1 within the enterprise and the time data 1 when the location changes; It can be understood that when the visitor inserts the hardware unit into the data interface of the server and logs into the server to be visited, the server initiates an access login application to the hardware unit, then reads the encrypted data one and performs a location analysis on it. According to the above-mentioned binary coding table for each location area in the enterprise, the encrypted data one (binary sequence) is deciphered to obtain the location of the visitor in the enterprise, and then converted according to the location conversion table stored in the database in advance. In this embodiment, the location conversion table is: office #2, conference room #3, rest area #4.

[0022] Example of location analysis: If the encrypted data is: "011110", then according to the above location coding table stored in the database, it can be known that the visitor's movement trajectory data is: office-lounge area-conference room, and then according to the location conversion table, the movement trajectory data is: "#2#4#3"; and then by calling the monitoring data of the above three locations, the corresponding time of entering and leaving the above locations can be obtained, such as entering the office at 8:00, entering the lounge area at 8:30, and entering the conference room at 9:00, then the time data is "8:008:309:00".

[0023] 4) Combine the action trajectory data 1, time data 1 and encrypted data 1 to obtain the dynamic login password and send them together.

[0024] In this embodiment, for example: if the behavior trajectory data is "#2#4#3", the time data is "8:008:309:00", and the encrypted data is "011011", the dynamic login password obtained by combination is "#2#4#38:008:309:00011011"; the dynamic login password can be sent by displaying it on a display screen preinstalled on the hardware unit, so that the visitor can view the password through the display screen, or it can be sent directly to the visitor's mobile phone by storing the mobile phone number of the visitor carrying the hardware unit in the database, and the visitor uses the dynamic login password to perform login verification when accessing the data.

[0025] S3. When receiving the dynamic login password 1 input by the visitor, the decryption process is executed; Regarding the decryption process, it includes: 1) Analyze the dynamic login password 1 to obtain the action track data 2 and time data 2; It can be understood that, according to the above-mentioned location conversion table, the location where the visitor stayed in the enterprise (action trajectory data 2) and the corresponding time (time data 2) can be obtained.

[0026] 2) According to the action trajectory data 2 and the time data 2, the monitoring data of the corresponding location is obtained from the pre-connected enterprise monitoring system; It can be understood that the corresponding monitoring data is retrieved based on the location where the visitor stays in the enterprise (action trajectory data 2) and the corresponding time (time data 2).

[0027] 3) Perform preset position change analysis based on monitoring data, and generate encrypted data 2 according to the analysis results and data encryption rules; It is understandable that based on the recognition, processing and analysis of the faces in the monitoring data, it should be noted that the basic information of the visitor, including face, name, gender, job responsibilities and the scope of data access authority, is pre-stored in the database. Not only can the face be confirmed by calling the monitoring data, but the visitor's movement can also be tracked to record the actual location and corresponding stay time of the visitor in the enterprise, and according to the above-mentioned data encryption rules, the actual location is converted into a binary sequence number (encrypted data two).

[0028] 4) Determine whether the encrypted data 1 is consistent with the encrypted data 2. If so, the login verification is determined to be successful.

[0029] In this embodiment, if the encrypted data one is consistent with the encrypted data two, it is considered that the security access login verification is passed.

[0030] Through the above settings, by using the hardware unit to record the visitor's movement traces in the enterprise in real time, a corresponding encrypted data one is generated and waits for calling. When the visitor connects the hardware unit to the server and logs in to access, the encrypted data one is analyzed, and the visitor's movement track and time in the enterprise are added to generate a dynamic login password one; the visitor enters the above dynamic login password one when logging in, and the background parses the dynamic login password one and calls the monitoring data of the visitor's corresponding track. By checking the actual situation reflected by the monitoring, not only can the visitor's face be recognized and verified, but also the visitor's actual location change can be reflected from the monitoring data, and a set of encrypted data is generated accordingly. By checking whether the encrypted data generated by the hardware unit carried by the visitor at any time (the visitor's location change) is consistent with the encrypted data (the visitor's location change) reflected by calling the monitoring data, it is determined whether it is a safe access, and double authentication is achieved, thereby reducing the probability of illegal access to data.

[0031] In another embodiment of the present application, because the decryption of the present method is to check the actual location change of the visitor by calling the monitoring data, considering that there may be areas where monitoring cannot be placed in the enterprise, base stations are respectively set in each area where monitoring cannot be placed for data transmission, and the hardware unit can count the number of steps of the visitor and transmit the number of steps to the base station closest to the visitor (the specific method will be described later). Therefore, on the basis of the above, it is also set as follows: Regarding the encryption logic, it also includes: 1) Obtain the visitor's step number 1 and send it to the pre-connected base station; It is understandable that the hardware unit also includes a step counting module integrated in the package shell, and the step counting module is connected to the control mainboard. In this embodiment, the step counting module can be based on the acceleration sensor to capture the acceleration change caused by the swing of the body or arm when the human body walks, and can calculate the number of steps taken by the visitor. In order to be able to transmit the number of steps to the base station, the hardware unit is also connected to a communication module, which can use radio frequency technology, and the details will be described in the subsequent system.

[0032] 2) Generate encrypted data 3 based on step 1 and data encryption rule; It can be understood that the data encryption rule also includes: converting the step number (decimal) into a binary number to obtain encrypted data three.

[0033] 3) If an access login application is received from the data platform, the encrypted data 3 is combined with the encrypted data 1 to obtain the combined password 1 and send them together; It can be understood that when a visitor logs in to access, for example: encrypted data three is 10100011, encrypted data one is 011011, and combination password one is 10100011#011011. In this embodiment, the combination of encrypted data three and encrypted data one can be achieved by adding a # symbol between the two data to separate the data. In other embodiments, other symbols can also be used to separate the data.

[0034] Through the above settings, on the basis of monitoring, step verification is also added, so that when in areas that the monitoring system cannot cover, the step count can be verified.

[0035] When the visitor logs in and enters the combination password into the data server to be accessed, the background executes the decryption process, which also includes: 1) Establish a data connection with the base station; 2) Get the visitor's step number 2 from the base station; In this embodiment, in order to make the data transmission between the hardware unit and the base station more stable, fast and accurate, a base station is set in each independent area not covered by the monitoring system. If a visitor enters an independent room not covered by the monitoring system, and there is also an independent room not covered by the monitoring system near this room, then which base station's step data should be called for more accuracy. For this, the details are as follows: Based on the monitoring data and the pre-uploaded layout diagrams of each base station, the ID of the base station closest to the location area entered by the visitor is determined, and the number of steps of the visitor is obtained from the corresponding base station according to the ID.

[0036] It can be understood that the base station layout map is stored in the database, which can be a location distribution map of each base station set up in the enterprise, and each base station is bound and associated with a unique ID. By calling the monitoring data, it is determined that the location corresponding to the last picture where the visitor appeared in the monitoring is determined, and the base station layout map is searched according to the location to find the ID of the base station closest to the location. According to the ID, the visitor's step number two is obtained from the corresponding base station.

[0037] 3) Generate encrypted data 4 based on step number 2 and data encryption rule, and combine encrypted data 4 with encrypted data 2 to obtain combined password 2; It can be understood that the step number two obtained from the base station is encrypted to obtain encrypted data four, wherein the data encryption rule is the same as above, and the step number two is converted into a binary number.

[0038] 4) Determine whether combination password 1 and combination password 2 are consistent. If so, the login verification is determined to be successful.

[0039] Through the above settings, not only the monitoring data is analyzed, but also the visitor's steps are verified, thereby improving the security of data access.

[0040] In another embodiment of the present application, the decryption process further includes: Get the power level of the hardware unit; In this embodiment, when the hardware unit is inserted into the data interface of the server, the power level of the battery module of the hardware unit is detected.

[0041] If the battery level is lower than the preset threshold, a charging reminder is output and the charging process is executed.

[0042] It is understandable that the hardware unit also includes a charging module connected to the control mainboard. The charging module is used to charge the battery module. When the power is less than 20% of the total power, a charging prompt is output. The prompt may be in the form of a pop-up window, prompting not to unplug the hardware unit and to charge it. The charging process refers to determining the voltage and current through the interface to charge the battery module. When charging is completed, the words "charging completed" may be displayed on the preset display screen of the hardware unit, or a flashing green indicator light may be displayed.

[0043] The embodiment of the present application also discloses a data security access system.

[0044] Reference Figure 2The data security access system includes: a cloud background, a base station set up in a location area of ​​the enterprise that is not covered by the monitoring system, and a hardware unit carried by the visitor. The base station is wirelessly connected to the cloud background. The cloud background is used to load and execute a computer program of any of the data security access methods described above. The hardware unit is configured with encryption logic, and the hardware unit is connected to a communication module, wherein the communication module includes an RFID tag and a radio frequency reader. The RFID tag is built into the hardware unit, and the radio frequency reader is arranged at the entrance and exit of the location area that is not covered by the enterprise monitoring system and is connected to the base station in a wired manner.

[0045] Through the above settings, when the hardware unit carried by the visitor enters a room not covered by the monitoring system, the radio frequency reader reads the information of the RFID tag and establishes a data connection, thereby obtaining the location data and step count data of the hardware unit.

[0046] The hardware unit includes a packaging shell and a control mainboard, a positioning module, a step counting module, a battery module and a charging module integrated in the packaging shell. The control mainboard is connected to the positioning module, the step counting module, the battery module and the charging module. The positioning module is used to obtain the visitor's location change data within the enterprise, the step counting module is used to obtain the visitor's steps, the battery module is used to power the control mainboard, and the charging module is used to charge the battery module.

[0047] An embodiment of the present application further discloses a computer device, including a memory and a processor, wherein the memory stores a computer program that can be loaded and executed by the processor to implement any of the data security access methods described above.

[0048] An embodiment of the present application further discloses a computer-readable storage medium having a computer program stored thereon, and the computer program is executed by a processor to implement the data security access method as described in any one of the above.

[0049] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A data security access method, characterized in that: include: Define the natural person who is assigned access rights to the data; Configure encryption logic for the hardware units carried by visitors; The encryption logic comprises: Obtain data on visitor location changes within the enterprise; Generate encrypted data one based on the location change data and a preset data encryption rule; If an access login application is received when a visitor logs in to a pre-connected data server, a preset location analysis is performed based on encrypted data 1 to obtain the visitor's movement trajectory data 1 within the enterprise and the time data 1 when the location changes; Combine the action track data 1, the time data 1 and the encrypted data 1 to obtain the dynamic login password 1 and send them together; When receiving the dynamic login password one input by the visitor, the decryption process is executed; The decryption process includes: Parse the dynamic login password 1 to obtain the action track data 2 and the time data 2; According to the second action trajectory data and the second time data, the monitoring data of the corresponding position is obtained from the pre-connected enterprise monitoring system; Performing a preset position change analysis based on the monitoring data, and generating encrypted data 2 according to the analysis results and data encryption rules; Determine whether the encrypted data 1 is consistent with the encrypted data 2. If so, the login verification is determined to be successful.

2. A data security access method according to claim 1, characterized in that: The encryption logic further comprises: Obtaining the visitor's step number one, and sending the step number one to a pre-connected base station; wherein the base station is preset in a location area within the enterprise that is not covered by the monitoring system and the base station is data-connected to the hardware unit; Generate encrypted data three based on step one and data encryption rule; If an access login application is received from the data platform, the encrypted data three is combined with the encrypted data one to obtain the combined password one and send them together; The decryption process further includes: Establishing a data connection with a base station; Get the visitor's step number 2 from the base station; Generate encrypted data 4 based on step number 2 and data encryption rule, and combine encrypted data 4 with encrypted data 2 to obtain combined password 2; Determine whether combination password one and combination password two are consistent, if so, determine that the login verification is passed.

3. A data security access method according to claim 2, characterized in that: The second step of obtaining the visitor from the base station includes: Based on the monitoring data and the pre-uploaded layout diagrams of each base station, the ID of the base station closest to the location area entered by the visitor is determined, and the number of steps of the visitor is obtained from the corresponding base station according to the ID.

4. A data security access method according to claim 1, characterized in that: The decryption process further includes: Get the power level of the hardware unit; If the battery level is lower than the preset threshold, a charging reminder is output and the charging process is executed.

5. A data security access system, characterized in that: include: A cloud backend, a base station set up in a location area not covered by the enterprise's monitoring system, and a hardware unit carried by the visitor, the base station is communicatively connected to the cloud backend, the cloud backend is used to load and execute a computer program of the data security access method as described in any one of claims 1-4, the hardware unit is configured with encryption logic, the hardware unit is connected to a communication module, the communication module includes an RFID tag and a radio frequency reader / writer, the RFID tag is built into the hardware unit, the radio frequency reader / writer is arranged in a location area not covered by the enterprise's monitoring system and is wirelessly connected to the base station.

6. The data security access system according to claim 5, characterized in that: The hardware unit includes a packaging shell and a control mainboard, a positioning module, a step counting module, a battery module and a charging module integrated in the packaging shell. The control mainboard is connected to the positioning module and the step counting module, the battery module and the charging module. The positioning module is used to obtain the visitor's location change data within the enterprise, the step counting module is used to obtain the visitor's steps, the battery module is used to power the control mainboard, and the charging module is used to charge the battery module.

7. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program which can be loaded and executed by the processor to implement the data security access method according to any one of claims 1 to 4.

8. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and the computer program is executed by a processor to implement the data security access method as described in any one of claims 1 to 4.

Images