Data offline audit method and device based on asymmetric encryption

Abstract

The present invention discloses a method and device for offline data audit based on asymmetric encryption. The method comprises: generating a master key and an auxiliary key by a main server, transmitting the public key of the master key and the auxiliary key to the audit server offline; signing the data to be transmitted by using the auxiliary key based on the audit server, and encrypting the data to be transmitted by using the public key of the master key; transmitting the encrypted data to the main server offline, storing the encrypted data based on an offline environment; and performing decryption verification by using the private key of the master key of the main server to obtain the decrypted data. Through offline transmission with asymmetric encryption, the security of data during transmission and storage is ensured, while protecting the confidentiality of data.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of digital technology, and specifically to a method and device for offline data auditing based on asymmetric encryption. Background Art

[0002] In the digital age, data has become one of the most valuable resources. However, with the widespread and in-depth application of big data, data security issues and privacy leakage risks have become increasingly prominent. Data security involves the confidentiality, integrity and availability of information, while privacy protection focuses on preventing personal information from unauthorized use and disclosure. Traditional data security measures such as access control and firewalls are no longer sufficient to cope with increasingly complex security threats. In particular, the security of data during transmission and storage has become crucial. When auditing data, data needs to be transmitted to the audit server. For security reasons, different networks may not be able to be interconnected but audit data needs to be transmitted. Therefore, a method for data auditing in an offline state is needed. Summary of the invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a method and device for offline data audit based on asymmetric encryption that overcomes the above problems or at least partially solves the above problems.

[0004] According to one aspect of an embodiment of the present invention, a method for offline data auditing based on asymmetric encryption is provided, the method comprising:

[0005] The main server generates the master key and auxiliary key, and transmits the public key of the master key and the auxiliary key to the audit server offline;

[0006] The audit server uses the auxiliary key to sign the data to be transmitted, and uses the public key of the primary key to encrypt the data to be transmitted;

[0007] The encrypted data is transmitted to the main server offline, and the encrypted data is stored in an offline environment;

[0008] Use the private key of the master server's master key to perform decryption verification to obtain the decrypted data.

[0009] According to another aspect of an embodiment of the present invention, there is provided a data offline auditing device based on asymmetric encryption, comprising:

[0010] A key exchange module, adapted to generate a master key and an auxiliary key from a master server, and transmit the public key of the master key and the auxiliary key to an audit server offline;

[0011] An encryption module, adapted to sign the data to be transmitted using the auxiliary secret key based on the audit server, and to encrypt the data to be transmitted using the public key of the primary secret key;

[0012] A transmission storage module, adapted to transmit the encrypted data to the main server offline, and store the encrypted data based on an offline environment;

[0013] The decryption module is suitable for performing decryption verification using the private key of the master key of the main server to obtain decrypted data.

[0014] According to another aspect of an embodiment of the present invention, there is provided a computing device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0015] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute operations corresponding to the above-mentioned data offline audit method based on asymmetric encryption.

[0016] According to another aspect of an embodiment of the present invention, a computer storage medium is provided, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables a processor to perform operations corresponding to the above-mentioned offline data audit method based on asymmetric encryption.

[0017] According to another aspect of an embodiment of the present invention, a computer program product is provided, comprising at least one executable instruction, wherein the executable instruction enables a processor to execute operations corresponding to the above-mentioned offline data audit method based on asymmetric encryption.

[0018] According to the asymmetric encryption-based offline data audit method and device provided in the embodiments of the present invention, the security of data during transmission and storage is ensured through asymmetric encryption offline transmission, while protecting the confidentiality of the data.

[0019] The above description is only an overview of the technical solution of the embodiment of the present invention. In order to more clearly understand the technical means of the embodiment of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiment of the present invention more obvious and easy to understand, the specific implementation method of the embodiment of the present invention is specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the embodiments of the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0021] Figure 1 A flowchart of a method for offline data audit based on asymmetric encryption according to an embodiment of the present invention is shown;

[0022] Figure 2 It shows a schematic diagram of the structure of a data offline audit device based on asymmetric encryption according to an embodiment of the present invention;

[0023] Figure 3 A schematic diagram of the structure of a computing device according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0024] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0025] Figure 1 FIG. 4 shows a flow chart of a method for offline data auditing based on asymmetric encryption according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0026] Step S101: The main server generates a master key and an auxiliary key, and transmits the public key of the master key and the auxiliary key to the audit server offline.

[0027] Data audit is a key process to ensure data compliance, which involves checking the accuracy, completeness and consistency of data, and timely discovering and correcting errors or inappropriate information. In the data-driven decision-making process, the quality of the audit directly affects the correctness of the decision. Data audit also faces many challenges, including how to ensure the originality of data during the audit process, how to prevent data from being tampered with, and how to conduct effective audits without exposing sensitive information.

[0028] In this embodiment, the data audit is performed by the audit server responding to the user's audit request and recording the approval request. The data to be transmitted is transmitted offline by the audit server to the main server for audit. During the offline transmission process, in order to ensure the security of the data, an asymmetric encryption method is adopted, such as RSA, Elgamal and ECC (elliptic curve cryptography), which are not limited here.

[0029] In this embodiment, the main server first generates two pairs of keys, including a primary key and an auxiliary key. The public keys of the primary key and the auxiliary key can be publicly distributed, and the private keys must be kept confidential. The public key can be used to encrypt data and decrypt it using the private key, or the private key can be used to encrypt and the public key can be used to decrypt.

[0030] The main server can transmit the auxiliary key to the audit server offline. Before transmitting it to the audit server, in order to ensure the security of the auxiliary key, the main server can first encrypt the auxiliary key with the private key of the main key, and then transmit the encrypted auxiliary key and the public key of the main key to the audit server offline. After receiving the encrypted auxiliary key, the audit server can decrypt the encrypted auxiliary key based on the public key of the main key to obtain the decrypted auxiliary key. This process realizes the exchange of the auxiliary key from the main server to the audit server, and the auxiliary key is encrypted and transmitted offline, which further ensures the security of the auxiliary key.

[0031] Here, offline transmission refers to transmission that does not rely on network connection. It can be transmitted through physical media, such as USB flash drives, mobile hard drives, optical disks, etc. It can also be achieved by other more convenient methods. The specific settings are based on the implementation situation and are not limited here. Offline transmission does not rely on the network or the certificate authority. It can be transmitted securely in a specific environment to achieve data audit security.

[0032] After the main server generates the master key and auxiliary key, it can save them on the local hard disk, etc., and use the private key of the master key to encrypt the auxiliary key, which increases the security of the auxiliary key transmission process. Even if an attacker intercepts the message carrying the auxiliary key during transmission, he cannot extract useful information from it.

[0033] Step S102, based on the audit server, the data to be transmitted is signed using the auxiliary key, and the data to be transmitted is encrypted using the public key of the primary key.

[0034] Users can initiate data audit requests to the audit server, and the audit server responds to the data audit request and encrypts the data to be transmitted. Encryption includes signature and data encryption. Signature is used to ensure the integrity and true source of data, and data encryption is used to protect the security of data.

[0035] Specifically, the audit server calculates the digital summary of the data to be transmitted to obtain a digital summary. The obtained digital summary is combined with the data to be transmitted to obtain a data packet, and the data packet is signed using the public key of the auxiliary key. The signature can use a preset algorithm to calculate and process the data packet to obtain a string, which is also a valid proof of the authenticity of the sent data. After signing, the public key of the primary key is used to encrypt the data to be transmitted, which ensures both the integrity and security of the data to be transmitted.

[0036] Step S103: Transmit the encrypted data to the main server offline, and store the encrypted data based on the offline environment.

[0037] The encrypted data is transmitted to the main server offline. After the encrypted data is transmitted to the main server, it is stored in an offline environment. In this process, since the private key of the master key is only held by the main server, the security of the encrypted data is guaranteed and it cannot be decrypted.

[0038] Step S104, using the private key of the master key of the main server to perform decryption verification to obtain decrypted data.

[0039] The public keys of the master key and the auxiliary key are retained in the main server. After the encrypted data is stored, the encrypted data can be decrypted using the private key of the master key retained in the main server to obtain a data packet including the data to be transmitted and the digital summary. The private key of the master key is only held by the main server. Before using the private key of the master key for decryption, it can also be judged whether the decryption verification has been authorized, that is, whether the data decryption party (including the decrypted user or system) has authorized it to perform decryption verification. If so, the private key of the master key of the main server can be used for decryption verification to obtain the decrypted data. If not, it cannot use the private key of the master key of the main server for decryption verification, which ensures that only authorized users or systems can use the private key of the master key of the main server, preventing the risk of data leakage or tampering.

[0040] After decryption, the public key of the auxiliary key retained in the main server can also be used to verify the signature of the data packet to further verify the integrity and accuracy of the data.

[0041] This embodiment uses asymmetric encryption to effectively prevent data from being stolen or tampered with during transmission. Even if the encrypted data is intercepted, it cannot be decrypted because there is no private key. The entire data audit process only requires data packaging and transmission, offline synchronization to the main server, and then the main server can automatically decrypt and verify, and the processing is more automated. The process does not rely on network connection, and is more suitable for scenarios that require offline transmission and audit data. Based on the asymmetric encryption method of this embodiment, there is no need to rely on a third-party authority to issue digital certificates, thereby reducing costs and improving efficiency. In addition, due to the use of an asymmetric encryption algorithm, the data transmission process is not susceptible to eavesdropping attacks or other forms of attacks, thereby enhancing overall security. The main server and the audit server can be any server with corresponding functions and service capabilities, such as an enterprise internal gateway server, a virtual host of a cloud service provider, etc. In actual application scenarios, the appropriate main server type can be flexibly selected according to actual conditions, and it is specifically set according to the implementation situation, which is not limited here.

[0042] The data offline audit method based on asymmetric encryption provided in an embodiment of the present invention ensures the security of data during transmission and storage through asymmetric encryption offline transmission, while protecting the confidentiality of the data.

[0043] Figure 2 FIG. 1 is a schematic diagram showing the structure of a data offline audit device based on asymmetric encryption provided by an embodiment of the present invention. Figure 2 As shown, the device comprises:

[0044] The key exchange module 210 is adapted to generate a master key and an auxiliary key by the main server, and transmit the public key of the master key and the auxiliary key to the audit server offline;

[0045] The encryption module 220 is adapted to sign the data to be transmitted using the auxiliary key based on the audit server, and to encrypt the data to be transmitted using the public key of the primary key;

[0046] The transmission storage module 230 is adapted to transmit the encrypted data to the main server offline and store the encrypted data based on the offline environment;

[0047] The decryption module 240 is adapted to perform decryption verification using the private key of the master key of the main server to obtain decrypted data.

[0048] Optionally, the key exchange module 210 is further adapted to:

[0049] The primary server generates the primary key and the secondary key, and encrypts the secondary key based on the private key of the primary key;

[0050] The encrypted auxiliary key and the public key of the primary key are transmitted to the audit server offline, so that the audit server can decrypt the encrypted auxiliary key based on the public key of the primary key to obtain the decrypted auxiliary key.

[0051] Optionally, the encryption module 220 is further adapted to:

[0052] The audit server responds to the data audit request, calculates a digital summary of the data to be transmitted on the audit server, merges the obtained digital summary with the data to be transmitted to obtain a data packet, signs it with the auxiliary key, and encrypts the data to be transmitted using the public key of the primary key.

[0053] Optionally, the primary server retains the public keys of the primary key and the secondary keys.

[0054] Optionally, the decryption module 240 is further adapted to:

[0055] Decrypt the encrypted data using the private key of the master key retained in the master server to obtain a data packet including the data to be transmitted and the digital summary;

[0056] The signature of the data packet is verified using the public key of the auxiliary key retained in the primary server.

[0057] Optionally, the device further comprises: a judgment module 250, adapted to judge whether the decryption verification has been authorized; if so, perform decryption verification using the private key of the master key of the main server to obtain decrypted data.

[0058] The description of each module above refers to the corresponding description in the method embodiment and will not be repeated here.

[0059] An embodiment of the present invention further provides a non-volatile computer storage medium, which stores at least one executable instruction, and the executable instruction can execute operations corresponding to the data offline audit method based on asymmetric encryption in any of the above method embodiments.

[0060] An embodiment of the present application provides a computer program product, which includes at least one executable instruction or computer program, which can enable a processor to perform operations corresponding to the offline data audit method based on asymmetric encryption in any of the above-mentioned method embodiments.

[0061] Figure 3 A schematic diagram of the structure of a computing device according to an embodiment of the present invention is shown, and the specific implementation of the embodiment of the present invention does not limit the specific implementation of the computing device.

[0062] like Figure 3 As shown, the computing device may include: a processor 302 , a communication interface 304 , a memory 306 , and a communication bus 308 .

[0063] in:

[0064] The processor 302 , the communication interface 304 , and the memory 306 communicate with each other via the communication bus 308 .

[0065] The communication interface 304 is used to communicate with other devices such as clients or other servers.

[0066] The processor 302 is used to execute the program 310, and specifically can execute the relevant steps in the above-mentioned embodiment of the data offline audit method based on asymmetric encryption.

[0067] Specifically, the program 310 may include program codes, which include computer operation instructions.

[0068] The processor 302 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention. The one or more processors included in the computing device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0069] The memory 306 is used to store the program 310. The memory 306 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0070] Program 310 can be specifically used to enable processor 302 to execute the data offline audit method based on asymmetric encryption in any of the above-mentioned method embodiments. The specific implementation of each step in program 310 can refer to the corresponding descriptions in the corresponding steps and units in the above-mentioned data offline audit embodiment based on asymmetric encryption, which will not be repeated here. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the above-described equipment and modules can refer to the corresponding process description in the aforementioned method embodiment, which will not be repeated here.

[0071] The algorithm or display provided herein is not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the embodiment of the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the embodiment of the present invention described herein, and the description of the above specific language is to disclose the preferred implementation of the embodiment of the present invention.

[0072] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0073] Similarly, it should be understood that in order to streamline the embodiments of the present invention and to aid in understanding one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present invention, the various features of the embodiments of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, the disclosed method should not be interpreted as reflecting the following intention: that the claimed embodiments of the present invention require more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, the inventive aspects lie in less than all the features of the single embodiment disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, wherein each claim itself serves as a separate embodiment of the present invention.

[0074] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0075] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0076] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components according to the embodiments of the present invention. The embodiments of the present invention may also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing an embodiment of the present invention may be stored on a computer-readable medium, or may have the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0077] It should be noted that the above embodiments illustrate rather than limit the present invention, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim listing a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be understood as limitations on the order of execution.

Claims

1. A data offline audit method based on asymmetric encryption, characterized in that: Methods include: The main server generates a master key and an auxiliary key, and transmits the public key of the master key and the auxiliary key to the audit server offline; Based on the audit server using the auxiliary key to sign the data to be transmitted, and using the public key of the master key to encrypt the data to be transmitted; Transmitting the encrypted data to the main server offline, and storing the encrypted data based on an offline environment; The private key of the master key of the main server is used to perform decryption verification to obtain the decrypted data.

2. The method according to claim 1, characterized in that The generating of the master key and the auxiliary key by the main server and transmitting the public key of the master key and the auxiliary key to the audit server offline further comprises: The primary server generates a primary key and an auxiliary key, and encrypts the auxiliary key based on the private key of the primary key; The encrypted auxiliary key and the public key of the master key are transmitted to the audit server offline, so that the audit server can decrypt the encrypted auxiliary key based on the public key of the master key to obtain the decrypted auxiliary key.

3. The method according to claim 1, characterized in that The audit server uses the auxiliary key to sign the data to be transmitted and uses the public key of the master key to encrypt the data to be transmitted further includes: The audit server responds to the data audit request, calculates a digital summary of the data to be transmitted, combines the obtained digital summary with the data to be transmitted to obtain a data packet, signs it with the auxiliary key, and encrypts the data to be transmitted using the public key of the primary key.

4. The method according to claim 1, characterized in that The primary server retains the public keys of the primary key and the auxiliary key.

5. The method according to claim 4, characterized in that The decryption verification is performed using the private key of the master key of the main server to obtain the decrypted data further comprising: Decrypting the encrypted data using the private key of the master key retained in the master server to obtain a data packet including the data to be transmitted and the digital summary; The signature of the data packet is verified using the public key of the auxiliary key retained in the primary server.

6. The method according to any one of claims 1 to 5, characterized in that Before performing decryption verification using the private key of the master key of the master server to obtain decrypted data, the method further includes: Determine whether decryption verification is authorized; If yes, use the private key of the master key of the main server to perform decryption verification to obtain the decrypted data.

7. A data offline audit device based on asymmetric encryption, characterized in that: The device includes: A key exchange module, adapted to generate a master key and an auxiliary key by a main server, and transmit the public key of the master key and the auxiliary key to an audit server offline; An encryption module, adapted to sign the data to be transmitted using the auxiliary key based on the audit server, and to encrypt the data to be transmitted using the public key of the primary key; A transmission storage module, adapted to transmit the encrypted data to the main server offline, and store the encrypted data based on an offline environment; The decryption module is adapted to perform decryption verification using the private key of the master key of the main server to obtain decrypted data.

8. A computing device, characterized in that include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the data offline audit method based on asymmetric encryption as described in any one of claims 1-6.

9. A computer storage medium, characterized in that The storage medium stores at least one executable instruction, and the executable instruction enables the processor to execute operations corresponding to the data offline audit method based on asymmetric encryption as described in any one of claims 1-6.

10. A computer program product, characterized in that It includes at least one executable instruction, which enables the processor to execute operations corresponding to the data offline audit method based on asymmetric encryption as described in any one of claims 1-6.

Images