Data protection method and device and storage medium

Abstract

The invention discloses a data protection method and device and a storage medium, and the data protection method is applied to a data sending end, and comprises the steps: carrying out the encryption processing of communication data through employing an obtained data encryption key in response to a communication connection between the data sending end and a server, and obtaining encrypted data; and sending the data encryption key and the encrypted data to a server, so that the server encrypts the data encryption key according to the obtained key encryption key to obtain a storage encryption frame, and merges the storage encryption frame and the encrypted data to obtain encrypted storage data. According to the scheme, data protection can be effectively realized.

Description

Technical Field

[0001] The present application relates to the field of data encryption technology, and in particular to a data protection method, device and storage medium. Background Art

[0002] Information security is crucial to the current Internet communication scenario.

[0003] Usually, the data transmitter encrypts the communication data, and then sends the encrypted data to the data receiver, which decrypts it to protect the data during the communication process. For example, encrypting audio and video data streams before transmission can effectively avoid information security issues caused by data stream leakage during transmission.

[0004] However, current encryption methods fail to fully cover communication links, and data protection effectiveness is still flawed. Summary of the invention

[0005] The present application at least provides a data protection method, apparatus, device and computer-readable storage medium.

[0006] The first aspect of the present application provides a data protection method, which is applied to a data sending end, and the method includes: in response to the existence of a communication connection between the data sending end and the server end, encrypting the communication data using an acquired data encryption key to obtain encrypted data; sending the data encryption key and the encrypted data to the server end, so that the server end encrypts the data encryption key according to the acquired key encryption key to obtain a storage encryption frame, and merging the storage encryption frame and the encrypted data to obtain encrypted storage data.

[0007] In one embodiment, the method of encrypting the communication data using the acquired data encryption key to obtain encrypted data includes: encrypting the communication data according to the acquired encryption algorithm and the data encryption key to obtain encrypted data; generating a transmission encryption frame according to the data encryption key and the encrypted data; and merging the transmission encryption frame and the encrypted data to obtain the encrypted data.

[0008] In one embodiment, after merging the transmission encryption frame and the encrypted data to obtain the encrypted data, the method further includes: sending the data encryption key and the encrypted data to the server, so that the server merges the storage encryption frame with the transmission encryption frame and stores them to obtain the encrypted storage data.

[0009] In one embodiment, in response to the existence of a communication connection between the data sending end and the server, the communication data is encrypted using the acquired data encryption key to obtain the encrypted data, and the method further includes: exchanging authentication information with the server and performing a two-way authentication process to obtain a two-way authentication result; in response to the two-way authentication result indicating that the data sending end and the server have passed the two-way authentication, establishing the communication connection based on the received access token sent by the server.

[0010] In one embodiment, exchanging authentication information with the server and performing two-way authentication processing to obtain a two-way authentication result includes: sending security information supported by the data sending end to the server for security verification to obtain a security verification result; in response to the security verification result indicating that the verification is successful, generating first signature information and sending it to the server, so that the server generates second signature information and sends it to the data sending end after verifying the first signature information; in response to the second signature information being verified successfully, encrypting the device information of the data sending end using the server's key to obtain encrypted device information; sending the encrypted device information to the server, so that the server uses the key to decrypt the encrypted device information to obtain the device information, and verifying the device information to obtain the two-way authentication result.

[0011] The second aspect of the present application provides a data protection method, which is applied to a server, and includes: in response to the existence of a communication connection between the server and a data sending end, receiving a data encryption key and encrypted data sent by the data sending end; using the acquired key encryption key to encrypt the data encryption key to obtain a stored encrypted frame; the encrypted data is obtained by the data sending end encrypting the communication data using the data encryption key; and merging the stored encrypted frame and the encrypted data to obtain encrypted stored data.

[0012] In one embodiment, the encrypted data includes video data, and the merging of the stored encrypted frame and the encrypted data to obtain the encrypted stored data includes: identifying key frame data in the video data; and adding a stored encrypted frame to each key frame data to obtain the encrypted stored data.

[0013] In one embodiment, in response to the existence of a communication connection between the server and the data sending end, before receiving the data encryption key and encrypted data sent by the data sending end, the method also includes: in response to the received authentication request of the data sending end, exchanging authentication information with the data sending end and performing two-way authentication processing to obtain a two-way authentication result; in response to the two-way authentication result indicating that the data sending end and the server have passed the two-way authentication, sending an access token to the server and establishing the communication connection.

[0014] The third aspect of the present application provides a data protection device, which is applied to a data sending end, including: a data encryption module, which is used to encrypt the communication data using an acquired data encryption key in response to the existence of a communication connection between the data sending end and the server end, so as to obtain encrypted data; a data sending module, which is used to send the data encryption key and the encrypted data to the server end, so that the server end encrypts the data encryption key according to the acquired key encryption key to obtain a storage encryption frame, and merges the storage encryption frame and the encrypted data to obtain encrypted storage data.

[0015] The fourth aspect of the present application provides a data protection device, which is applied to a server, and includes: a data receiving module, which is used to receive a data encryption key and encrypted data sent by the data sending end in response to the existence of a communication connection between the server and the data sending end; a key encryption module, which is used to encrypt the data encryption key using an acquired key encryption key to obtain a stored encrypted frame; the encrypted data is obtained by the data sending end encrypting the communication data using the data encryption key; a data storage module, which is used to merge the stored encrypted frame and the encrypted data to obtain encrypted stored data.

[0016] A fifth aspect of the present application provides an electronic device, including a memory and a processor, wherein the processor is used to execute program instructions stored in the memory to implement the above-mentioned data protection method.

[0017] A sixth aspect of the present application provides a computer-readable storage medium on which program instructions are stored, and the program instructions implement the above-mentioned data protection method when executed by a processor.

[0018] In the above scheme, if there is a communication connection between the data sender and the server, the data sender can use the acquired data encryption key to encrypt the communication data to obtain encrypted data; send the data encryption key and the encrypted data to the server; the server can encrypt the data encryption key of the data sender according to the acquired key encryption key to obtain a storage encrypted frame, and then merge the storage encrypted frame and the encrypted data to obtain the encrypted storage data and store it, thereby realizing transmission protection and storage protection of the communication data during the communication process, thereby improving data security.

[0019] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

[0021] Figure 1 is a flowchart of an exemplary embodiment of the data protection method of the present application; Figure 2 is a timing diagram of an exemplary two-way authentication process in the data protection method of the present application; Figure 3 is a schematic diagram of an exemplary video cloud storage system architecture in the data protection method of the present application; Figure 4 is a timing diagram of an exemplary one-way authentication process in the data protection method of the present application; Figure 5 It is a simplified schematic diagram of the certificate management process in the data protection method of the present application; Figure 6 is a block diagram of a data protection device shown in an exemplary embodiment of the present application; Figure 7 It is a structural schematic diagram of an embodiment of the electronic device of the present application; Figure 8 It is a structural diagram of an embodiment of a computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0022] The scheme of the embodiment of the present application is described in detail below in conjunction with the drawings of the specification.

[0023] In the following description, for the purpose of explanation rather than limitation, specific details such as specific system structures, interfaces, and technologies are provided to facilitate a thorough understanding of the present application.

[0024] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the objects associated before and after are in an "or" relationship. In addition, "many" in this article means two or more than two. In addition, the term "at least one" in this article means any combination of at least two of any one or more of a plurality of, for example, including at least one of A, B, and C, can mean including any one or more elements selected from the set consisting of A, B, and C.

[0025] For ease of explanation, one of the applicable scenarios of the present application is now exemplified. The data protection method of the present application can be used to protect various types of data in the network communication process, such as text data, image data, video data, audio data, etc., which are not limited here. For ease of understanding, the present application is mainly explained by taking video data as an example, but does not limit the applicable scenarios of the present application.

[0026] See also Figure 1 , Figure 1 1 is a flow chart of an exemplary embodiment of the data protection method of the present application. The method is applied to the data sending end. Specifically, it may include the following steps: Step S110, in response to the existence of a communication connection between the data sending end and the server end, the communication data is encrypted using the acquired data encryption key to obtain encrypted data.

[0027] Among them, the data sending end refers to the device end responsible for sending data during the communication process, and the server end refers to the server end that provides related services to the data sending end. In addition, the server end can also provide related services to the data receiving end, which will not be elaborated here.

[0028] For example, when the communication data is video data, the data transmitter can be a front-end device for collecting video data, such as an IP Camera (IPC) and other devices; and the server can be a server that provides data storage services and / or data management services and other related services for the IPC device. Among them, the IPC device can transmit the collected video data (such as video code stream) to the server for data storage, which is one of the communication processes between the data transmitter and the server.

[0029] It is understandable that if the communication process in the above example is to be carried out, a communication connection is required between the data sending end and the server end. Then, the data sending end can encrypt the video data according to the acquired data encryption key to obtain encrypted data. Among them, the data encryption key is used to encrypt the communication data in the communication process, that is, to encrypt the video stream data in the video application scenario. The data encryption key can be pre-set in the data sending end, or it can be obtained by the data sending end from the server end and / or other devices (other servers) and / or other systems (such as key management systems (Key Management System, KMS)), and a data sending end can have one or more data encryption keys, and different data sending ends can have the same or different data encryption keys, which are not limited here.

[0030] The data sending end encrypts the communication data using the data encryption key to obtain encrypted data. The data sending end can then transmit the encrypted data during the communication process, thereby avoiding problems such as data leakage during the data transmission process and ensuring data security during the data transmission process.

[0031] Step S120, sending the data encryption key and the encrypted data to the server, so that the server encrypts the data encryption key according to the acquired key encryption key to obtain a storage encryption frame, and combines the storage encryption frame and the encrypted data to obtain encrypted storage data.

[0032] In conjunction with the above steps, the data sending end may send the data encryption key and the encrypted data to the server end.

[0033] Among them, the data encryption key and the encrypted data can be sent simultaneously or at different times; and the data sending end can send the corresponding data encryption key each time it sends encrypted data, or it can be sent by the data sending end at some pre-set specified time (for example, the data sending end sends the data encryption key during the process of establishing a communication connection with the server end, and / or the data sending end sends the data encryption key after establishing a communication connection with the server end, and / or the data sending end sends the data encryption key when sending encrypted data to the server end for the first time, and / or the data sending end sends the data encryption key to the server end when modifying and updating the data encryption key, etc.), which is not limited here.

[0034] In addition, the server can also obtain it from the KMS system. The KMS system can be a key management system set on the server of this application, or a key management system set in other devices (other servers) that have a communication connection with the server. This is not limited here. The KMS system can have communication connections with the data sending end and the server respectively, so as to manage the keys in the data sending end and the server. The key management services that the KMS system can provide can refer to the existing KMS technology, and the details are not repeated here.

[0035] Furthermore, after receiving the encrypted data sent by the data sending end and the data encryption key used to encrypt the communication data, the server can use the obtained key encryption key to process the data encryption key to obtain a storage encryption frame. Among them, the values ​​of the key encryption key and the data encryption key can be the same or different, which is not limited here; but the uses of the key encryption key and the data encryption key are different. The data encryption key is used to encrypt communication data (such as a video stream), and the key encryption key is used to encrypt a key (such as a data encryption key), that is, the key encryption key is a key used by the server to encrypt the data encryption key of the data sending end. In this way, a storage encryption frame can be obtained, and the storage encryption frame is mainly used for auxiliary encryption during data storage.

[0036] The server merges the stored encrypted frame and the encrypted data to obtain the encrypted stored data, and stores the encrypted stored data. This can protect the data storage process, avoid data leakage when the data is stored on the server, and ensure data security during the data storage process.

[0037] In summary, the method of the present application can realize data transmission encryption and data storage encryption through two encryption processes during the communication between the data sender and the server, thereby improving the reliability and security of data transmission and data storage.

[0038] It can be seen that through the above method, if there is a communication connection between the data sending end and the server end, the data sending end can use the acquired data encryption key to encrypt the communication data to obtain encrypted data; send the data encryption key and the encrypted data to the server end; the server end can encrypt the data encryption key of the data sending end according to the acquired key encryption key to obtain a storage encrypted frame, and then merge the storage encrypted frame and the encrypted data to obtain the encrypted storage data and store it, thereby realizing transmission protection and storage protection of the communication data during the communication process, thereby improving data security.

[0039] Based on the above embodiment, the embodiment of the present application describes the steps of encrypting the communication data using the acquired data encryption key to obtain the encrypted data. Specifically, the method of this embodiment includes the following steps: The communication data is encrypted according to the acquired encryption algorithm and data encryption key to obtain encrypted data; a transmission encryption frame is generated according to the data encryption key and the encrypted data; the transmission encryption frame and the encrypted data are combined and processed to obtain encrypted data.

[0040] Among them, the encryption algorithm in the data sending end can be preset in advance, or obtained from the server, or obtained from other devices (other servers), which is not limited here.

[0041] It should be noted that the encryption algorithm of the data sending end of the present application may include but is not limited to an asymmetric encryption algorithm, a hash algorithm, a symmetric encryption algorithm, and a signature algorithm, etc. One or more encryption algorithms may be set in the data sending end according to the needs of the specific application scenario, which is not limited here. The data sending end encrypts the communication data using the encryption algorithm and data encryption key it has, and can obtain the encrypted data (encrypted communication data).

[0042] If the data sender needs to transmit the encrypted communication data, it is also necessary to add a transmission encryption frame to the encrypted communication data, and use the transmission encryption frame format for transmission during the data transmission process. The transmission encryption frame can be sent separately or expanded on the basis of the communication data and then sent together, which is not limited here. Among them, the transmission encryption frame includes encryption information of the communication data, such as encryption type, encryption offset and encryption length, which are not described here.

[0043] For example, reference may be made to the following table 1, which is an exemplary frame structure for transmitting an encrypted frame in the data protection method of the present application:

[0044] The first row of the table represents the byte sequence number, and the second row represents the field corresponding to the byte sequence number. In this embodiment, the main fields of the transmission encryption frame are described, and the actual application scenario may include but is not limited to the above fields, which will not be repeated here.

[0045] For example, from the transmission encryption frame shown in Table 1 above, it can be known that the transmission encryption frame header type is 0xB5; the frame length refers to the length of the transmission encryption frame; the encryption type may include but is not limited to: 0: keep the original data without encryption; 1: AES256-OFB-NOPADDING; 2: SM4-OFB-NOPADDING; 3: SM4-ECB-NOPADDING; 4: SM1-OFB-NOPADDING; 5: SM1-ECB-NOPADDING; Among them, 0-5 represent the corresponding encryption types, such as AES256, SM4, SM1, etc. refer to encryption algorithms, while OFB (Output feedback) and ECB (Electronic CodeBook) refer to encryption modes. More types of encryption algorithms and encryption modes can be set in different application scenarios, which are not described here. Among them, if the communication data is audio data (audio code stream) or video data (video code stream), OFB mode and NOPADDING mode (no padding mode, no padding of plaintext data blocks during encryption) can be preferred. OFB mode and no padding mode can be used efficiently as streaming encryption, which is suitable for audio and video code streams, such as type 2 or type 4. However, the PKCS5 padding mode is required under the GB35114 standard.

[0046] In addition, the transmission encryption frame also includes an encryption offset. For video data, it is a code stream encryption offset, which is used to indicate that the current video data corresponding to the current transmission encryption frame is encrypted after the offset of the original raw code stream data, which is equivalent to the encryption offset position of the current video data. The encryption length indicates the length of the encrypted data starting from the encryption offset position, and the unit can be bytes, which indicates how much data in the current video data needs to be decrypted to play normally.

[0047] The key ID (key identifier) ​​refers to the identifier of the data encryption key used when encrypting the current video data. Since there can be one or more data encryption keys in the data sending end, the key identifier can be used to characterize which key is used. Among them, for video encryption, the data encryption key can be a video encryption key VK (Video Key), also known as VEK (Video Encryption Key), and the key identifier can be a VKID (Video Key Identity Document). The data sending end, the server end, and the data receiving end can all use VKID to find the corresponding VK for decrypting the corresponding video data, which will not be described here. CRC16 is a data verification algorithm, namely cyclic redundancy check, which is mainly used to detect or verify errors that may occur after data transmission or storage. The CRC16 checksum can be calculated by the verification algorithm before the communication data is encrypted and stored in the transmission encryption frame, and then it can be used by the server end and / or the data receiving end to verify when decoding data (such as decoding video bitstream) to determine whether the data is complete. IV refers to the initialization vector (Initialization Vector) commonly used in the encryption process, which will not be described here.

[0048] In summary, during the execution of this embodiment, the above transmission encrypted frame can be generated according to the relevant information of the data encryption key and the relevant information of the encrypted data as exemplified in the above embodiment. Then, the transmission encrypted frame can be written into the streaming file corresponding to the video code stream for merging and processing to obtain encrypted data.

[0049] Based on the above embodiment, the embodiment of the present application describes the steps after the transmission encrypted frame and the encrypted data are combined to obtain the encrypted data. Specifically, the method of this embodiment includes the following steps: The data encryption key and the encrypted data are sent to the server, so that the server combines the storage encryption frame with the transmission encryption frame for storage, and obtains the encrypted storage data.

[0050] In conjunction with the above-mentioned embodiment, the encrypted data may include encrypted communication data and transmission encryption frames. After obtaining the encrypted data, the data sending end may send the encrypted data to the service end for data storage.

[0051] Exemplarily, before transmitting the encrypted data, the data encryption key corresponding to the encrypted data segment can be pushed by means of a digital envelope (encrypting the key by means of asymmetric encryption). The specific key sending process can be the data sending end sending to the server end and / or the data receiving end, or the KMS system sending to the data sending end, the server end and / or the data receiving end respectively. For details, please refer to the above example description, and can also be adaptively adjusted in combination with specific application scenarios, which will not be elaborated here. In this way, the server end can obtain the data encryption key of the data sending end.

[0052] After receiving the data encryption key from the data sender, or after receiving the encrypted data and the corresponding data encryption key from the data sender, the server can use the key encryption key to encrypt the data encryption key of the data sender to obtain a storage encryption frame, and then merge the storage encryption frame with the transmission encryption frame for storage to obtain encrypted storage data.

[0053] For video data, the data encryption key (video encryption key) is VK, and the key encryption key (video key encryption key) is VKEK (Video Key Encryption Key). The VKEK of the server can refer to the key acquisition process mentioned in the above embodiment, for example, obtained from the KMS system. Then the server can use VKEK to encrypt VK and obtain the stored encrypted frame.

[0054] For example, reference may be made to Table 2 below, which is an exemplary frame structure for storing encrypted frames in the data protection method of the present application:

[0055] Among them, the format of the storage encryption frame can also refer to the example description of the transmission encryption frame in the aforementioned embodiment. This embodiment mainly describes the main fields in the storage encryption frame. In specific application scenarios, it may include but is not limited to the above field information. For example, the frame header type of the storage encryption frame is 0x04; VKEK ID can be the identifier of the VKEK assigned by the KMS system to the server; VKEK type can indicate how the VKEK in the storage encryption frame is obtained. For example, the VKEK type can include but is not limited to 0x00 (indicating KMS allocation), 0x01 (indicating user allocation), 0x02 (indicating U shield (USBKey) allocation), etc. a and b can be adaptively set according to specific application scenarios, and are not limited here. Other relevant data can also be attached to the storage encryption frame as needed, which is not limited here.

[0056] In summary, after obtaining the transmission encryption frame and the storage encryption frame, the server can merge the storage encryption frame with the transmission encryption frame and store the encrypted data to obtain the encrypted storage data. For example, the storage encryption frame is inserted before the frame header of the transmission encryption frame to achieve the merged storage. Among them, the storage encryption frame can be an adjacent frame of the transmission encryption frame and the frame sequence of the storage encryption frame is earlier than the frame sequence of the transmission encryption frame.

[0057] On the basis of the above embodiments, the embodiment of the present application describes the steps before obtaining encrypted data by encrypting the communication data using the acquired data encryption key in response to the communication connection between the data sending end and the server end. Specifically, the method of this embodiment includes the following steps: Exchange authentication information with the server and perform two-way authentication processing to obtain a two-way authentication result; in response to the two-way authentication result indicating that the data sender and the server have passed the two-way authentication, establish a communication connection based on the access token sent by the server.

[0058] In conjunction with the above-mentioned embodiments, in the data protection method of the present application, in addition to protecting the data transmission process and the data storage process, the data sending end accessing the server end can also be protected. Therefore, before establishing a communication connection between the data sending end and the server end, the present application can also provide a data protection method that allows the data sending end and the server end to perform a two-way authentication process to ensure that the data sending end will not connect to an unauthorized server end (or an unsafe server end). Similarly, it can also ensure that the server end will not access an unauthorized device (such as an unauthorized data sending end), etc., thereby ensuring the data security in the data sending end and the server end.

[0059] Exemplarily, the two-way authentication process of the present application may include but is not limited to the two parties mutually verifying each other's certificates, signatures and other information, thereby determining the validity, compliance, etc. of both parties, and obtaining a two-way authentication result. If the two-way authentication result indicates that the data sender and the server have passed the two-way authentication, the server can send an access token to the data sender, and the data sender can establish a communication connection with the server based on the received access token.

[0060] Based on the above embodiments, the present embodiment of the present application describes the steps of exchanging authentication information with the server and performing two-way authentication processing to obtain a two-way authentication result. Specifically, the method of this embodiment includes the following steps: The security information supported by the data sending end is sent to the server end for security verification to obtain a security verification result; in response to the security verification result indicating that the verification is passed, a first signature information is generated and sent to the server end, so that the server end generates a second signature information and sends it to the data sending end after verifying the first signature information; in response to the second signature information being verified, the device information of the data sending end is encrypted using the key of the server end to obtain encrypted device information; the encrypted device information is sent to the server end, so that the server end uses the key to decrypt the encrypted device information to obtain the device information, and the device information is verified to obtain a two-way authentication result.

[0061] Among them, the security information may include but is not limited to the security algorithm set supported by the data sending end. There may be one or more security algorithms (encryption algorithms) in the security algorithm set. For details, please refer to the above example description, and the steps are not repeated here. The security information of the data sending end can characterize the security capabilities of the data sending end. For example, if the data sending end A is equipped with an asymmetric encryption algorithm and a symmetric encryption algorithm, and the data sending end B is equipped with a symmetric encryption algorithm, it can be determined that the security capability of the data sending end A is stronger than that of the data sending end B, which means that the security of the data sending end A is better than that of the data sending end B.

[0062] Exemplarily, the method for evaluating security capability in the present application may include but is not limited to the above example, which can be evaluated according to the type of security algorithm supported by the data sending end. For example, the corresponding security score is pre-set for each type of security algorithm, and the security capability of the data sending end is determined according to the sum of the security scores of each security algorithm in the security algorithm set of the data sending end. If the security capability of the data sending end is greater than the preset security threshold, it can be determined that the data sending end has passed the security verification of the server; otherwise, it can be determined that the data sending end has not passed the security verification of the server. If the security verification is not passed, the data sending end and the server cannot establish a communication connection this time.

[0063] Alternatively, the security verification evaluation criteria can be pre-set as "the existence of a specified security algorithm in the security algorithm set (which can be one or more specified algorithms)". If the specified security algorithm type exists in the security algorithm set of the data sender (which can be partially or completely present, set as needed), it can be determined that the data sender has passed the security verification of the server; otherwise, it can be determined that the data sender has not passed the security verification of the server.

[0064] In addition, it is also possible to combine a variety of relevant information of the data sending end with the type of security algorithm to evaluate the security capabilities of the data sending end. Among them, the relevant information may include but is not limited to network information, device identification information, etc. For example, the network information may be the network type (external network or internal network, which can be judged according to the network where the server is located, and the details are not repeated). For example, the security score of the same data sending end when accessing the same internal network as the server can be higher than the security score when accessing the external network. For example, the network information may include an IP address, and IP addresses in different regions may correspond to the same or different security scores. The device identification information may be a unique identifier of the data sending end (such as MAC address, IMEI, serial number, device ID, SIM card number, Internet of Things card number, etc.). The server may pre-store the identification information of the security device or the rules for judging the identification information of the security device (such as regular expressions, etc.), thereby judging whether the data sending end is a security device, and then assigning it a security score from the perspective of the device identification information.

[0065] In summary, in the specific implementation process, one or more methods in the above examples can be selected to determine the final security score of the data sender. If multiple methods are selected for evaluation, each method may be required to pass the evaluation criteria (for example, the data sender needs to have a specified security algorithm and be in a specified IP address area and have a compliant device identification, etc.). In addition, a weighted judgment can also be made, such as pre-setting the corresponding security weight for each evaluation benchmark, such as a weight of 50% for the security algorithm type, 30% for the network information, and 20% for the device identification information; the security scores of each benchmark are weighted and summed according to the above security weights to obtain the final security score.

[0066] For example, reference may be made to Figure 2 As shown, Figure 2It is a timing diagram of an exemplary two-way authentication process in the data protection method of the present application. The data sending end can send a connection request (or a registration request) and carry the security algorithm set it has. After receiving the connection request, the server can determine the security capability of the data sending end by verifying the security algorithm set possessed by the data sending end. If the security capability of the data sending end reaches the preset security threshold (or meets the preset security evaluation criteria), it can be considered that the data sending end has passed the security verification result. Then the server needs to select a target security algorithm from the security algorithm set possessed by the data sending end (the target security algorithm is an algorithm used by the data sending end and the server end to encrypt the data transmitted to each other during the verification process of establishing a communication connection. In the subsequent verification process, the data sent by the data sending end to the server end and / or the data sent by the server end to the data sending end can be encrypted using the target security algorithm, which will not be described in detail), and a random number will be generated to obtain a first random number R1, and the target security algorithm and the first random number R1 will be returned to the data sending end as the data carried in the security verification result to inform the data sending end that the security verification has been passed. The security verification result may be encrypted using the public key of the data sender before being sent, and the data sender may decrypt the security verification result using its own private key after receiving the security verification result.

[0067] After the data sender confirms that it has passed the security verification of the server, it can send the generated second random number R2 and generate its own first signature information (digital signature S1, which can be generated using its own private key. The specific generation method can refer to the existing signature generation method, which will not be described in detail here). For example, the first verification token TokenCS is sent to the server, and TokenCS can be composed of R1, R2, the data sender certificate ID and S1. The specific composition method can be numerical splicing, or the above data is merged into other calculation results through a preset algorithm, etc., which is not limited here. Among them, the data sender certificate ID refers to the ID of the data sender's authorization certificate (Certificate Authority). The CA certificate is the technical basis for digital signatures and is also a proof of the identity of an online entity. It can prove the identity of an entity and the legitimacy of its public key, and prove the matching relationship between the entity and the public key. Each device in this application (such as a data sender, a server, and a data receiver) can have its own certificate. Each device can have one or more certificates. The certificate can be pre-set (such as application and issuance) in each device, which will not be described here.

[0068] After receiving TokenCS, the server can verify the digital signature S1 therein. The specific verification method can refer to the various existing verification technologies (for example, whether the CA certificate of the data sender is valid, and / or whether the public key corresponding to the certificate can be used to decrypt the digital signature S1, and / or perform numerical matching, etc.), which is not limited here. If the verification fails, the establishment of this communication connection is suspended or stopped, and the server returns the two-way authentication result to the data sender (indicating the failure of the two-way authentication); if the verification passes, the server generates a second signature information and returns it (digital signature S2, which can be generated using the server's private key). Similarly, the server can return a second verification token TokenSC to the data sender. TokenSC can be composed of R2, the server certificate ID and S2. The server certificate is also pre-set, and the composition method can refer to the above description, which will not be repeated here.

[0069] Correspondingly, after receiving TokenSC, the data sender will also verify the digital signature S2. If the verification fails, the establishment of this communication connection will be suspended or stopped, and the server will return the two-way authentication result to the data sender (indicating the failure of the two-way authentication); if the verification passes, the data sender will generate a third random number R3, and the identification information in the data sender (such as user name information, password information and / or other unique identification information, etc.) and the random number R3 will be used to form the device information of the data sender, and then the device information will be encrypted using the server's public key to obtain the encrypted device information in the ciphertext state. The data sender sends the encrypted device information to the server, and the server can use its own private key to decrypt it, obtain information such as user name and key, and verify the legality and compliance of this information, as well as the validity of R3. If at least one of the information fails to pass the verification, the establishment of this communication connection is suspended or stopped, and the server returns the two-way authentication result to the data sender (indicating that the two-way authentication failed); if all the verifications pass, the server can return the two-way authentication result to the data sender (indicating that the two-way authentication is successful, and it can also carry the server's access token) and establish a communication connection between the two ends.

[0070] It should be noted that each data sender can have two certificates (which can be used for encryption and signing respectively) or multiple certificates. The certificates of the data sender can be pre-set in the server, so that in the two-way verification process between the data sender and the server, the server can directly find the certificate corresponding to the data sender locally. However, in video application scenarios, the video cloud server (server) may be connected to tens of thousands of IPC devices (data senders), and it is difficult to build so many certificates in advance in the cloud storage node of the server. Therefore, in the actual application process, it is also possible to choose to exchange certificates based on the protocol of the communication process (such as the transport layer security protocol TLS) during the process of establishing a communication connection between the data sender and the server, so that the server can flexibly deal with the certificate management of large-scale data senders.

[0071] In summary, in the above embodiment, a two-way verification process is implemented when the data sender accesses the server. The two-way verification protects the process of the data sender accessing the server, which can prevent the data sender from accessing an unauthorized server, and also prevent the server from accessing an unauthorized data sender.

[0072] In addition to being applied to the data sending end, the data protection method of the present application can also be applied to the server end. When the data protection method of the present application is applied to the server end, the method of the present application can at least include the following steps: In response to the existence of a communication connection between the server and the data sending end, the data encryption key and encrypted data sent by the data sending end are received; the data encryption key is encrypted using the acquired key encryption key to obtain a storage encryption frame; the encrypted data is obtained by the data sending end encrypting the communication data using the data encryption key; the storage encryption frame and the encrypted data are combined to obtain encrypted storage data.

[0073] In conjunction with the above-mentioned embodiment, if the server and the data sender pass two-way authentication and establish a communication connection, the server can receive the data encryption key and encrypted data sent by the data sender. Then the server can encrypt the data encryption key (such as VK) according to the obtained key encryption key (such as VKEK) and generate a storage encrypted frame. Among them, the encrypted data is obtained by the data sender using the obtained data encryption key to encrypt the communication data (such as a video stream).

[0074] The encrypted data may include encrypted communication data and transmission encryption frames. After receiving the encrypted data, the server may merge the storage encryption frame and the transmission encryption frame to obtain a merged encryption frame, and store the encrypted communication data and the merged encryption frame as encrypted storage data (which may be stored together or separately, which is not limited here). Alternatively, the storage encryption frame, the transmission encryption frame and the encrypted communication data may be merged to obtain encrypted storage data for storage.

[0075] Based on the above embodiment, the embodiment of the present application describes the steps of combining the stored encrypted frame and the encrypted data to obtain the encrypted stored data. The encrypted data includes video data. Specifically, the method of this embodiment includes the following steps: Identify key frame data in the video data; add a storage encryption frame to each key frame data to obtain encrypted storage data.

[0076] With reference to the foregoing embodiments, the type of communication data in the present application may be video data (eg, video code stream), and therefore, the encrypted data (encrypted data) may also be video data.

[0077] It is understandable that a video bitstream usually contains a key frame (also called an I frame, Intra-coded Frame), which is a complete image frame that can be decoded independently without relying on information from other frames. A video bitstream can also include non-key frames, such as P frames, B frames, etc., which are not detailed here.

[0078] Specifically, during the implementation of the data protection method of the present application, key frame data in the video data can be identified, that is, the I frame in the video data can be determined, and a corresponding storage encryption frame can be generated for each I frame in the video file and added to obtain encrypted storage data, thereby achieving data protection for the key frames of the video.

[0079] Among them, the method of adding storage encrypted frames can refer to the process in which the server uses VKEK to encrypt the VK of the data sender in the aforementioned embodiment, which will not be repeated here. For example, the server can obtain the key ciphertext containing VKEK from KMS, and then the server can decrypt the key ciphertext by calling encryption hardware such as an encryption machine with a communication connection to obtain the VKEK (key plaintext) in plaintext state. The server then encrypts the key plaintext to obtain the form of storing encrypted frames and writes it into the streaming file of the video. Among them, the encryption machine refers to an encryption device that has passed the national encryption appraisal and approved for use. The encryption machine and the host can communicate using the TCP / IP protocol, so the encryption machine has no special requirements for the type of host and the host operating system.

[0080] Based on the above embodiments, the present embodiment of the application describes the steps before receiving the data encryption key and encrypted data sent by the data sending end in response to the existence of a communication connection between the service end and the data sending end. Specifically, the method of this embodiment includes the following steps: In response to the received authentication request from the data sender, authentication information is exchanged with the data sender and two-way authentication processing is performed to obtain a two-way authentication result; in response to the two-way authentication result indicating that the data sender and the server have passed the two-way authentication, an access token is sent to the server and a communication connection is established.

[0081] In combination with the above-mentioned embodiment, this embodiment mainly describes that before the server and the data sender formally transmit data, a two-way authentication process is also included between the server and the data sender.

[0082] Exemplarily, if the server receives an authentication request from the data sender, it exchanges authentication information (such as certificates, signatures and / or keys, etc.) with the data sender and performs a two-way authentication process to obtain a two-way authentication result. If the two-way authentication result indicates that the data sender and the server have passed the two-way authentication, the server can send an access token to the server and establish a communication connection, and then the server can receive the communication data transmitted by the data sender. If the two-way authentication result indicates that the data sender and the server have not passed the two-way authentication, the server suspends or stops the connection establishment process.

[0083] It should also be noted that the certificates involved in the two-way authentication process between the data sender and the server may include: 1. CA root certificate (used to verify the other party's certificate in the two-way authentication process based on the national secret Transport Layer Security (TLS) protocol).

[0084] 2. Signature certificate and encryption certificate. Among them, the signature certificate is used for two-way identity authentication in the national secret TLS. The data sender and / or the server can generate a signature certificate request file CSR (Certificate Signing Request). After the CA center issues the corresponding signature certificate based on the CSR file, the signature certificate can be imported locally. The encryption certificate can also be generated by the CA center. The public and private key pair and encryption certificate are imported into the data sender and / or the server in a digital envelope (encrypted using the signature public key), and the data sender and / or the server use their respective signature private keys to decrypt them, and then the encryption certificate is securely stored locally.

[0085] In addition, you can also refer to Figure 3 As shown, Figure 3This is an exemplary video cloud storage system architecture diagram in the data protection method of the present application. Among them, the business platform is a platform interface for realizing the visualization of video cloud storage services, the video cloud storage cluster is a server mainly used to provide storage services, and the network camera IPC is the data sending end. In addition, a cryptographic infrastructure may also be provided in this system, which may include a certificate management module (mainly responsible for issuing digital certificates to various devices and users in the cloud storage system, such as a national secret CA certificate); it may also include a KMS key management system (mainly responsible for managing the keys used in the cloud storage system, such as key encryption keys (VKEK) and / or other symmetric keys for images and audio and video data, etc. KMS can ensure the security of key data; it is independent of the cluster size and can manage keys for periodic updates (for example, once every 4 hours)), which may include a main KMS system and a backup KMS system; it may also include an encryption machine (also called a cryptographic machine, which is mainly responsible for generating asymmetric keys and storing private keys, etc., and can provide computing power for storing encrypted frames), which may include one or more encryption machines.

[0086] In addition to being applied to the data sending end and the service end, the data protection method of the present application can also be applied to the data receiving end. The data receiving end of the present application can be a terminal device (also referred to as a client) such as a mobile phone, a computer, a tablet computer, a smart watch, and smart glasses. When the data protection method of the present application is applied to the data receiving end, the implementation process of the present application may at least include: The data receiving end needs to pass the verification of the server, establish a communication connection with the server, and access the server; the data receiving end that successfully establishes a communication connection with the server can obtain the encrypted storage data from the server (whose type can be the video data in the aforementioned embodiment); the data receiving end uses the obtained key to decrypt the encrypted storage data, and then the communication data therein (such as a video code stream in plain text) can be obtained.

[0087] Exemplarily, the overall encryption principle of this application follows the principle that whoever generates the data is responsible for encryption, and whoever uses the data is responsible for decryption. For example, the front-end device (data sending end) encrypts and transmits the collected audio and video data, that is, transmission encryption at the source end; the storage device or platform stores the encrypted audio and video data, that is, storage encryption; the storage device and business platform support users (data receiving end) to play, download and / or export the encrypted audio and video data within the scope of their authority.

[0088] Specifically, after the data receiving end obtains the encrypted storage data, its main implementation steps may include but are not limited to: first use the corresponding key to decrypt the storage encryption frame in the encrypted storage data to obtain the VKEK ID in the storage encryption frame; search for the VKEK corresponding to the VKEK ID, use the VKEK to decrypt the transmission encryption frame, and then obtain the VK ID in the transmission encryption frame; search for the corresponding VK according to the VK ID, and then use the VK to decrypt the encrypted data (such as the encrypted video code stream) to obtain the original raw code stream. In the decryption process, other information carried in the storage encryption frame and the transmission encryption frame can also be used as a reference. For example, when the data receiving end decodes the data, it can also be verified by CRC16, which will not be described in detail here.

[0089] As another example, for the authentication process between the data receiving end and the server, the authentication process between the data sending end and the server in the above embodiment can be referred to in the same way. The authentication process between the data receiving end and the server can be a one-way authentication process, that is, the server authenticates the data receiving end. For example, Figure 4 As shown, Figure 4 It is a timing diagram of an exemplary one-way authentication process in the data protection method of the present application. The data receiving end can initiate a connection request and carry its own security information (such as the security algorithm set in the aforementioned embodiment, etc.); the server determines the security capability of the data receiving end based on its security information; if the data receiving end passes the security verification of the server, the server generates a random number R1 and selects a target security algorithm from the security algorithm set and returns it to the data receiving end; after the data receiving end knows that it has passed the security verification, it can generate a digital signature and combine it with the random number R4 and its own certificate ID to form a verification token Token and send it to the server for signature verification; after receiving the Token, the server can verify the digital signature therein; if the verification is passed, the server returns the public key of the server to the data receiving end; then the data receiving end can generate a random number R5, and use the public key of the server to encrypt the identification information (user name, password) of the data receiving end and R5, obtain the identification information in the ciphertext state and send it to the server; thereafter, the server can use its own private key to decrypt it, verify the legitimacy of the user name and password, and verify the validity of R5; after passing the verification, the server sends an access token to the data receiving end, thereby establishing a communication connection between the data receiving end and the server. For the specific implementation process of the one-way authentication process of this embodiment, reference can also be made to the description of some steps in the two-way authentication process in the aforementioned embodiment, which will not be repeated here.

[0090] Among them, the certificates involved in the process of the data receiving end logging into the server can also be arranged and set in advance. The certificates of the data receiving end and the server can be imported into the U shield used by the data receiving end and the platform of the server to verify the login process of the data receiving end. Among them, the U shield (USBKey) is a security tool that combines physical devices and PKI (public key infrastructure) technology. It provides an additional layer of security for the communication process by storing digital certificates and user private keys. In the scenario of the certificate application and import process, the U shield can communicate with the data receiving end. The data receiving end generates a user certificate request file CSR based on the currently connected U shield. After being issued by the CA center, the user certificate is imported into the U shield for subsequent user login to the server. The server can use a cryptographic machine with a communication connection to generate an operation and maintenance certificate request CSR file. After being issued by the CA center, the platform certificate is imported into the server cryptographic machine for use when the user (data receiving end) and the front-end device (data sending end) log in to the server platform in the subsequent process.

[0091] For ease of understanding, taking the video cloud storage system as an example, the certificate management process of the video cloud storage system can also be referred to as follows Figure 5 As shown, Figure 5 This is a simplified schematic diagram of the certificate management process in the data protection method of this application. Figure 5 The main process shown can realize the application and issuance of the national secret CA certificate, and is used to realize the encryption and signature verification of the subsequent national secret certification. In some application scenarios (the video cloud storage system and its business platform can provide operation and maintenance services and storage services), the certificates involved in the entire solution may mainly include but are not limited to: cloud storage operation and maintenance user certificate, cloud storage operation and maintenance platform certificate, video cloud PaaS signature certificate, video cloud PaaS encryption certificate, device signature certificate, device encryption certificate, etc.; in the national secret encryption scenario of this application, the certificate is used in pairs with the private key.

[0092] In summary, the data protection method of this application can be designed through the issuance and management of CA national secret certificates, such as the client (data receiving end) logging into the server and the device (data sending end) logging into the server, and finally realize the access of national secret devices. Based on the principle that whoever generates the data encrypts it and whoever uses the data decrypts it, the transmission encryption of communication data is finally realized, the national secret security of the transmission link is realized through the design of the transmission encryption frame, and the encrypted storage security of the data stream is realized through the design of the storage encryption frame. The key management system in the system of this application can also introduce the KMS key management system: it is mainly used for the life cycle management of keys (such as VKEK, etc.) and is responsible for the issuance of keys in the system. In order to solve the problems of network isolation between subsystems in the video cloud storage system and differences in KMS docking methods of different manufacturers, KMS proxy services can be introduced in storage devices and storage systems. The KMS proxy service can be directly connected to KMS, or it can be cascaded with the upper-level KMS agent, which will not be repeated here.

[0093] Therefore, the data protection method of the present application can realize digital certificate authentication for user login and data encryption transmission through the application, issuance and cluster allocation process of the national secret CA digital certificate provided in the aforementioned embodiments. The national secret security of user login to the cloud storage system is realized through the design of the one-way national secret authentication of the client login in the cloud storage system; and the national secret security of the authentication interaction between the device and the cloud storage system is realized through the design of the national secret two-way authentication process between the front-end device and the cloud storage system. In addition, through the method of generating transmission encryption frames and storage encryption frames in this application, secondary encryption transmission and encrypted storage of the full-link data stream are realized, which improves the protection effect of the data.

[0094] It should be further explained that the execution subject of the data protection method may be a data protection device, for example, the data protection method may be executed by a terminal device or a server or other processing device, wherein the terminal device may be a user equipment (UE), a computer, a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc. In some possible implementations, the data protection method may be implemented by a processor calling a computer-readable instruction stored in a memory.

[0095] Figure 6 FIG. 1 is a block diagram of a data protection device shown in an exemplary embodiment of the present application. The data protection device can be applied to a data sending end. Figure 6 As shown, the exemplary data protection device 600 includes: a data encryption module 610 and a data sending module 620. Specifically: The data encryption module 610 is used to encrypt the communication data using the acquired data encryption key in response to the communication connection between the data sending end and the server end to obtain encrypted data.

[0096] The data sending module 620 is used to send the data encryption key and the encrypted data to the server, so that the server encrypts the data encryption key according to the acquired key encryption key to obtain a storage encryption frame, and merges the storage encryption frame and the encrypted data to obtain encrypted storage data.

[0097] In this exemplary data protection device, if there is a communication connection between the data sending end and the server end, the data sending end can use the acquired data encryption key to encrypt the communication data to obtain encrypted data; and send the data encryption key and the encrypted data to the server end; the server end can encrypt the data encryption key of the data sending end according to the acquired key encryption key to obtain a storage encryption frame, and then merge the storage encryption frame and the encrypted data to obtain the encrypted storage data and store it, thereby realizing transmission protection and storage protection of the communication data during the communication process, thereby improving data security.

[0098] In addition, the present application may also provide a data protection device, which may be applied to a data receiving end, including: The data receiving module is used to receive the data encryption key and encrypted data sent by the data sending end in response to the existence of a communication connection between the service end and the data sending end.

[0099] The key encryption module is used to encrypt the data encryption key using the acquired key encryption key to obtain a storage encryption frame; the encrypted data is obtained by the data transmitter encrypting the communication data using the data encryption key.

[0100] The data storage module is used to merge the stored encrypted frame and the encrypted data to obtain encrypted stored data.

[0101] It should be noted that the device provided in the above embodiment and the method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment, and will not be repeated here. In practical applications, the device provided in the above embodiment can distribute the above functions to different functional modules as needed, that is, divide the internal structure of the device into different functional modules to complete all or part of the functions described above, and this is not limited here.

[0102] Among them, the functions of each module can be found in the data protection method embodiment, and will not be repeated here.

[0103] See also Figure 7 , Figure 7 1 is a schematic diagram of the structure of an embodiment of an electronic device of the present application. The electronic device 100 includes a memory 101 and a processor 102, and the processor 102 is used to execute program instructions stored in the memory 101 to implement the steps in any of the above data protection method embodiments. In a specific implementation scenario, the electronic device 100 may include but is not limited to: a microcomputer, a server, and in addition, the electronic device 100 may also include a mobile device such as a laptop computer and a tablet computer, which is not limited here.

[0104] Specifically, the processor 102 is used to control itself and the memory 101 to implement the steps in any of the above data protection method embodiments. The processor 102 can also be called a CPU (Central Processing Unit). The processor 102 may be an integrated circuit chip with signal processing capabilities. The processor 102 can also be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field-programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. In addition, the processor 102 can be implemented by an integrated circuit chip.

[0105] In this exemplary electronic device, if there is a communication connection between the data sending end and the server end, the data sending end can use the acquired data encryption key to encrypt the communication data to obtain encrypted data; and send the data encryption key and the encrypted data to the server end; the server end can encrypt the data encryption key of the data sending end according to the acquired key encryption key to obtain a storage encryption frame, and then merge the storage encryption frame and the encrypted data to obtain the encrypted storage data and store it, thereby realizing transmission protection and storage protection of the communication data during the communication process, thereby improving data security.

[0106] See also Figure 8 , Figure 8 The computer-readable storage medium 110 stores program instructions 111 that can be executed by a processor, and the program instructions 111 are used to implement the steps in any of the above data protection method embodiments.

[0107] In this exemplary storage medium, by running the program instructions in the storage medium, if there is a communication connection between the data sender and the server, the data sender can use the acquired data encryption key to encrypt the communication data to obtain encrypted data; send the data encryption key and the encrypted data to the server; the server can encrypt the data encryption key of the data sender according to the acquired key encryption key to obtain a storage encryption frame, and then merge the storage encryption frame and the encrypted data to obtain encrypted storage data and store it, thereby realizing transmission protection and storage protection of the communication data during the communication process, thereby improving data security.

[0108] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0109] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0110] In the several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation, such as units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0111] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform all or part of the steps of each implementation method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

Claims

1. A data protection method, characterized in that: The method is applied to a data sending end, and the method comprises: In response to a communication connection between the data sending end and the server end, encrypting the communication data using the acquired data encryption key to obtain encrypted data; The data encryption key and the encrypted data are sent to the server, so that the server encrypts the data encryption key according to the acquired key encryption key to obtain a storage encryption frame, and combines the storage encryption frame and the encrypted data to obtain encrypted storage data.

2. The method according to claim 1, characterized in that: The method of encrypting the communication data using the acquired data encryption key to obtain encrypted data includes: Encrypting the communication data according to the acquired encryption algorithm and the data encryption key to obtain encrypted data; Generate a transmission encryption frame according to the data encryption key and the encrypted data; The transmission encryption frame and the encrypted data are combined and processed to obtain the encrypted data.

3. The method according to claim 2, characterized in that After combining the transmission encryption frame and the encrypted data to obtain the encrypted data, the method further includes: The data encryption key and the encrypted data are sent to the server, so that the server combines and stores the storage encryption frame and the transmission encryption frame to obtain the encrypted storage data.

4. The method according to claim 1, characterized in that: In response to the existence of a communication connection between the data sending end and the server, before encrypting the communication data using the acquired data encryption key to obtain the encrypted data, the method further includes: Exchanging authentication information with the server and performing two-way authentication processing to obtain a two-way authentication result; In response to the two-way authentication result indicating that the data sending end and the server have passed the two-way authentication, the communication connection is established according to the received access token sent by the server.

5. The method according to claim 4, characterized in that The exchanging authentication information with the server and performing two-way authentication processing to obtain a two-way authentication result includes: Sending the security information supported by the data sending end to the service end for security verification to obtain a security verification result; In response to the security verification result indicating that the verification is passed, generating first signature information and sending it to the server, so that the server generates second signature information and sends it to the data sending end after verifying the first signature information; In response to the second signature information being verified, encrypting the device information of the data sending end using the key of the server to obtain encrypted device information; The encrypted device information is sent to the server, so that the server uses the key to decrypt the encrypted device information to obtain the device information, and verifies the device information to obtain the two-way authentication result.

6. A data protection method, characterized in that: The method is applied to the server, and the method includes: In response to the existence of a communication connection between the service end and the data sending end, receiving a data encryption key and encrypted data sent by the data sending end; The data encryption key is encrypted using the acquired key encryption key to obtain a storage encryption frame; the encrypted data is obtained by the data sending end encrypting the communication data using the data encryption key; The stored encrypted frame and the encrypted data are combined and processed to obtain encrypted stored data.

7. The method according to claim 6, characterized in that The encrypted data includes video data, and the storing encrypted frame and the encrypted data are combined to obtain the encrypted storage data, including: Identifying key frame data in the video data; A storage encryption frame is added to each key frame data to obtain the encrypted storage data.

8. The method according to claim 6, characterized in that Before receiving the data encryption key and the encrypted data sent by the data sending end in response to the existence of a communication connection between the service end and the data sending end, the method further includes: In response to the received authentication request from the data sending end, exchanging authentication information with the data sending end and performing a two-way authentication process to obtain a two-way authentication result; In response to the two-way authentication result indicating that the data sending end and the server have passed the two-way authentication, an access token is sent to the server and the communication connection is established.

9. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the processor is used to execute program instructions stored in the memory to implement the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having program instructions stored thereon, characterized in that: When the program instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images