Data security access system and method and electronic device

Abstract

The invention discloses a data security access system and method and an electronic device, and relates to the technical field of smart home, the system comprises a server side and a client, the server side adopts an encryption algorithm to encrypt service data to obtain target data, and sends the target data and a decryption algorithm to the client; the client comprises a data interaction module used for obtaining target data and a decryption algorithm; and the container module is provided with at least one container, the container is provided with a decryption plug-in, and the decryption plug-in is arranged in the container and adopts a decryption algorithm to decrypt the target data to obtain the business data. Therefore, on one hand, the target data is decrypted in the container to obtain the service data, the container isolates the service data from the client, and the safety of the service data is guaranteed; and on the other hand, the decryption plug-in is arranged, the decryption plug-in can execute decryption operation according to the requirement of the client, a decryption algorithm does not need to be cached in the client, and the safety of the service data is further guaranteed.

Description

Technical Field

[0001] The present application relates to the field of smart home technology, and more specifically, to a data security access system, method and electronic device. Background Art

[0002] In the process of information interaction between the client and the server, in order to ensure a good experience for the client user, the business data obtained from the server is often cached locally before use, for example, the design drawings of smart home devices are cached locally before display.

[0003] The server stores one or more types of business data. To ensure the security of the business data, when the client accesses the server, the server not only returns the encrypted business data, but also sends the private key to the client, so that the client can use the private key to decrypt the business data before using it. The confidentiality of caching the private key to the client can easily lead to the leakage of the private key. For example, if there is a security vulnerability in the client software, the private key can be stolen when the vulnerability is exploited by hackers. For example, if the user stores the private key in a networked device or electronic device, when the electronic device is attacked by hackers, the private key will be leaked. When the private key is leaked, the security of the business data will be difficult to guarantee.

[0004] The private key cache on the client brings security risks to the business data. When the business data is cached on the client and executed by the client, if the business data is in transmission or carries an attack program, the attack program will attack the client during execution, causing losses to the client.

[0005] Therefore, there are security risks when the current client and server interact with each other. Summary of the invention

[0006] In order to improve the security of data when a client accesses data, the present application proposes a data security access system, method and electronic device.

[0007] In a first aspect of the present application, a data security access system is provided, the system comprising a client, the client comprising: A data interaction module is used to obtain target data and a decryption algorithm, wherein the target data is encrypted business data; The container module is provided with at least one container, the container is configured with a decryption plug-in, the decryption plug-in uses the decryption algorithm in the container to decrypt the target data to obtain business data, and outputs the business data.

[0008] By adopting the above technical solution, the data interaction module obtains the target data and the decryption algorithm from the outside world, and the decryption plug-in uses the decryption algorithm to decrypt the target data to obtain the business data. Since the decryption process is carried out in the container, the container isolates the business data and the client, and the container plays a role in protecting the business data, reducing the possibility of the business data being attacked. Also because this application will first obtain the decryption algorithm when there is a need to use the business data, and then the decryption plug-in will use the decryption algorithm to decrypt the target data, that is, the interactive mode of using the decryption algorithm as needed, avoiding the storage of the decryption algorithm on the client, thereby solving the problem of security risks in the business data caused by the leakage of the decryption algorithm, and further improving the security of the business data. In addition, the business data received by the client is encrypted, and the encrypted business data can ensure its security during the transmission process. Therefore, this application can ensure the security of business data from multiple dimensions when the client accesses data.

[0009] In a possible implementation, the business data is in a custom bytecode format, and the target data is decrypted in the container into business data in the custom bytecode format.

[0010] By adopting the above technical solution, the business data is in a custom bytecode format. After the target data is decrypted in the container, it is restored to the custom bytecode format. The bytecode format can be agreed upon by the client and the device interacting with the client. The agreed bytecode format is a ciphertext for the attacker, which makes it more difficult for the attacker to correctly identify the content contained in the business data, whether the business data is in the transmission process or in the client, thereby achieving the purpose of improving the security of the business data.

[0011] In a possible implementation, the data security access system further includes a server side, which includes: at least one database, the database is configured with an encryption plug-in, and the encryption plug-in uses an encryption algorithm to encrypt the business data to obtain the target data.

[0012] By adopting the above technical solution, the encryption plug-in uses an encryption algorithm to encrypt business data, and the business data itself is in a bytecode format agreed upon by both the client and the server, which is a ciphertext. Therefore, the business data of this application is doubly encrypted during the transmission process, thereby providing technical guarantee for the secure transmission of business data.

[0013] In a possible implementation, the data interaction module is used to send a request instruction to the server, where the request instruction includes a data request instruction, and the data request instruction is used to request the target data and the decryption algorithm.

[0014] In a possible implementation, the client further includes a data cache module, and the data cache module is connected to the data interaction module; When the server receives the data request instruction, it returns response data, wherein the response data includes the target data and the decryption algorithm; The data interaction module inputs the target data into the data cache module, and the data interaction module inputs the decryption algorithm into the decryption plug-in.

[0015] By adopting the above technical solution, when the data interaction module requests the target data from the server, the server will return the decryption algorithm at the same time. The data interaction module then inputs the decryption algorithm into the decryption plug-in, and the decryption plug-in uses the decryption algorithm to decrypt the target data. This interactive mode of using the decryption algorithm as needed avoids storing the decryption algorithm on the client, thereby solving the problem of potential security risks in business data caused by the leakage of the decryption algorithm, and further improving the security of business data.

[0016] In a possible implementation, the data interaction module is used to send a request instruction to the server, where the request instruction includes a drive request instruction, and the drive request instruction is used to periodically request to obtain the decryption algorithm.

[0017] In a possible implementation, the server returns response data upon receiving the drive request instruction, wherein the response data includes a decryption algorithm; The data interaction module inputs the decryption algorithm into the decryption plug-in.

[0018] By adopting the above technical solution, the data interaction module periodically requests the decryption algorithm from the server, and inputs the decryption algorithm obtained from the request into the decryption plug-in, so that the decryption plug-in periodically updates its internal decryption algorithm, thereby increasing the difficulty for the attacker to obtain the correct decryption algorithm, thereby achieving the purpose of improving the security of business data.

[0019] A second aspect of the present application provides a data security access method, which is applied to the above-mentioned data security access system, and the method includes: The data interaction module outputs a request instruction; After receiving the request instruction, the server returns response data, wherein the response data includes a decryption algorithm; The data interaction module inputs the decryption algorithm into the decryption plug-in.

[0020] In a possible implementation, the method further includes: Determining whether the response data contains target data; If yes, the target data is stored in a data cache module; If not, the decryption plug-in enters a dormant state.

[0021] By adopting the above technical solution, the data interaction module sends a request instruction to the server, the server returns the response data in response to the request instruction, and the decryption plug-in obtains the decryption plug-in in the response data. At the same time, it is determined whether the response data contains the target data. If so, the decryption plug-in uses the decryption algorithm to decrypt in the container, so that the container isolates the business data and the client obtained by decryption to ensure the security of the business data; otherwise, the decryption plug-in enters a dormant state, at which time the decryption plug-in only updates its original decryption algorithm without performing a decryption operation, thereby achieving the purpose of updating the decryption algorithm.

[0022] According to a third aspect of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-mentioned data security access method through the computer program.

[0023] This application has at least one of the following technical effects: 1. The decryption plug-in is in the container and uses the decryption algorithm to decrypt the target data to obtain the business data. The decryption process is performed in the container, which isolates the business data and the client. The container protects the business data and reduces the possibility of business data being attacked. 2. When the client needs to use business data, it will first obtain the decryption algorithm, and then the decryption plug-in will use the decryption algorithm to decrypt the target data. This interactive mode of using the decryption algorithm as needed avoids saving the decryption algorithm on the client, thus solving the problem of business data security risks caused by the leakage of the decryption algorithm; 3. The client and server agree on the bytecode format of the business data, convert the plaintext business data into ciphertext business data, and then use the encryption plug-in to encrypt the business data using an encryption algorithm, so that the business data has double encryption during transmission, thereby providing technical guarantee for the secure transmission of business data. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0025] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0026] Figure 1 It is a structural diagram of a data security access system according to an embodiment of the present application.

[0027] Figure 2 This is a flow chart of a data security access method according to an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products or apparatus.

[0030] According to one aspect of the embodiments of the present application, a data security access system is provided. Figure 1 As shown, the data security access system includes a server and at least one client. The server is connected to the client through a network and can be used to provide services (such as application services, etc.) for the client. A database can be set on the server to provide data storage services for the server. Cloud computing and / or edge computing services can also be configured on the server to provide data computing services for the server.

[0031] It should be noted that the server-side mentioned above refers to a physical server, while the client-side can represent physical electronic devices, such as PCs, mobile phones, tablet computers, smart air conditioners, smart range hoods, smart refrigerators, smart ovens, smart stoves, smart washing machines, smart water heaters, smart washing equipment, smart dishwashers, smart projection equipment, smart TVs, smart clothes drying racks, smart curtains, smart audio and video, smart sockets, smart speakers, smart speakers, smart fresh air equipment, smart kitchen and bathroom equipment, smart bathroom equipment, smart sweeping robots, smart window cleaning robots, smart mopping robots, smart air purification equipment, smart steamers, smart microwave ovens, smart kitchen treasures, smart purifiers, smart water dispensers, smart door locks, etc. The client-side can also represent applications on physical electronic devices, such as intelligent software systems that control the operation of electronic devices.

[0032] In addition, the above network may include but is not limited to at least one of the following: wired network, wireless network. The above wired network may include but is not limited to at least one of the following: wide area network, metropolitan area network, local area network, and the above wireless network may include but is not limited to at least one of the following: WIFI (Wireless Fidelity), Bluetooth.

[0033] Specifically, the server side includes at least one database, and each database stores at least one type of business data. The types of databases on the server side include but are not limited to MySQL databases, Oracle databases, NoSQL databases, and Neo4j databases, and the types of business data stored in the database include but are not limited to sensor data, user behavior data, and audio and video data. Sensor data mainly includes environmental parameters such as temperature, humidity, and light in the environment where smart home devices are located. These data are collected in real time by sensors in the environment or devices. User behavior data mainly records the user's use of smart home devices, such as the number of times the lights are turned on and off, the frequency of device use, etc. Audio and video data is mainly for smart home devices with audio and video functions, and is data collected and stored by smart home devices with audio and video functions. The business data in the database can be entered by the management personnel, or it can be automatically uploaded to the database by the smart home devices. In order to ensure the security of business data, an encryption plug-in is configured for each database or for multiple databases. The encryption plug-in can use the wasm plug-in. The wasm plug-in is a plug-in based on WebAssembly (WASM) technology. It has a compact binary format and runs high-performance binary programs in the server-side or client-side Web browser. It can run at a speed close to the native speed and is suitable for high-performance computing-intensive application scenarios, so that one server can support simultaneous access by multiple clients. The encryption plug-in can also be other types of plug-ins, such as Node.js plug-ins. Node.js plug-ins are usually written in C / C++, and they need to access the server-side system resources when running.

[0034] The wasm plugin is pre-configured with an encryption algorithm. The encryption algorithm used here can be a symmetric encryption algorithm or an asymmetric encryption algorithm. Symmetric encryption algorithms include block cipher algorithms (Advanced Encryption Standard, AES). The AES encryption algorithm mainly divides plaintext data into multiple groups of fixed size, and then uses the same key to encrypt each group of data to convert plaintext groups into ciphertext groups. Asymmetric encryption algorithms include classic asymmetric encryption algorithms RSA and elliptic curve cryptography (ECC). The RSA algorithm uses the difficulty of prime number decomposition to generate public and private keys to achieve encryption and decryption. The ECC algorithm is a public key encryption algorithm based on elliptic curve mathematics. In actual use, you can select an adaptive encryption algorithm according to the actual application scenario.

[0035] It should be noted that there may be multiple clients that interact with the server, and each client may interact with multiple servers, so that the client can obtain different types of business data from different servers.

[0036] In order to explain the process of the client obtaining business data, one of the clients is taken as an example below: the client includes a data interaction module, a container module, a data cache module and a data usage module. Among them, the container module is the core of the device and is connected to the data interaction module, the data cache module and the data usage module respectively.

[0037] The data interaction module is mainly used to interact with the server side and obtain the target data and decryption algorithm from the server side. The target data refers to the business data encrypted by the encryption plug-in using the encryption algorithm. The decryption algorithm corresponds to the encryption algorithm and is mainly used to decrypt the encrypted business data. For example, if the encryption algorithm uses a key in the AES encryption algorithm for encryption, the decryption algorithm also uses the same key in the AES encryption algorithm for decryption. If the encryption algorithm is an asymmetric encryption algorithm, the decryption algorithm is the private key corresponding to the public key used by the encryption algorithm. The data interaction module stores the target data in the data cache module and calls it when the container module needs it. The data interaction module inputs the decryption algorithm into the container module to facilitate the decryption of the target data in the container module.

[0038] At least one container is set in the container module. The container is a wasm container. Unlike traditional operating system-level containers, wasm containers do not require a complete operating system environment, but run directly in the underlying virtual machine. They are flexible to deploy and have higher efficiency and lower resource overhead, which is conducive to deployment on different clients. In order to use encrypted business data on the client side, a decryption plug-in is configured for each container. Specifically, the decryption plug-in is set in the corresponding container. The decryption plug-in also uses a wasm plug-in. The wasm plug-in uses a decryption algorithm to decrypt the target data in the container to obtain business data.

[0039] It should be noted that the decryption plug-in and encryption plug-in in this example both use wasm plug-ins. Since the decryption plug-in and the encryption plug-in support the same language format, there is no need to equip the format conversion device. The business data encrypted by the encryption plug-in can be correctly identified in the decryption plug-in, thereby saving the business data flow nodes from the client to the server and reducing the possibility of business data being attacked.

[0040] The decryption plug-in obtains the decryption algorithm from the data interaction module. It can be considered that the decryption plug-in automatically deletes the decryption algorithm after each decryption operation is completed to avoid the decryption algorithm being cached in the container module. When the client needs to decrypt, it will request the decryption algorithm from the server again. Of course, after the decryption plug-in completes the decryption operation, it can continue to retain the decryption algorithm, but it is necessary to agree with the server on the time to update the encryption algorithm and decryption algorithm. The server updates the encryption algorithm and decryption algorithm at the agreed time, and the client requests the updated decryption algorithm from the server at the agreed time, and uses the updated decryption algorithm to update the decryption algorithm originally retained inside, so as to achieve the purpose of dynamically updating the decryption algorithm in the client, avoiding the attacker from finding patterns to deduce the decryption algorithm during multiple attacks, and increasing the difficulty of cracking the decryption algorithm.

[0041] In a specific example, the decryption algorithm in the decryption plug-in can be updated periodically. At this time, a timer can be built into the data interaction module. The timer is an embedded timing program. When the data interaction module obtains the latest decryption algorithm from the server, the timer is reset and counts. During the period when the timing reaches the preset time, if the data interaction module obtains business data from the server, the decryption algorithm will also be obtained synchronously. At this time, the timer is reset and counts again. Otherwise, when the timing reaches the preset time, the data interaction module automatically requests the latest decryption algorithm from the server. After obtaining the latest decryption algorithm, the timer is reset and counts again. This cycle is repeated to dynamically update the decryption algorithm. In other examples, it is also possible to update the original decryption algorithm according to the latest decryption algorithm only when the target data is obtained, because a new decryption algorithm is obtained at the same time. The original decryption algorithm refers to the decryption algorithm originally retained in the decryption plug-in.

[0042] In addition, the business data used in this example adopts a custom bytecode format, that is, the client and the server agree on the bytecode format of the business data, and both parties transmit the encrypted business data in accordance with the agreed bytecode format. This agreed bytecode format is a ciphertext for the attacker, which increases the difficulty for the attacker to correctly identify the content contained in the business data. On this basis, the encryption plug-in also uses an encryption algorithm to encrypt the business data. Until the container calls the target data, the decryption plug-in uses the decryption algorithm to decrypt the target data, thereby obtaining the business data in the custom bytecode format. Therefore, the business data is double encrypted during transmission and when cached in the data cache module. Double encryption can ensure the security of business data during transmission and caching. As for the decrypted business data, due to the isolation effect of the container, the security of the business data is also guaranteed.

[0043] The above-mentioned business data is processed by the container and then output to the data use module for use. The data use module may be a display screen or other software and hardware modules that can facilitate users to use business data.

[0044] The present application also provides a data security access method, which is applied to the above-mentioned data security access system. Figure 2 As shown, the steps of the data security access method are as follows.

[0045] Step S1: The data interaction module outputs a request instruction. There are two types of request instructions: one is that the client needs to obtain business data from the server, and the other is that the client regularly updates the decryption algorithm in the decryption plug-in. In order to distinguish different types of request instructions, the request instruction for obtaining business data is called a data request instruction, and the request instruction for updating the decryption algorithm is called a drive request instruction.

[0046] Step S2: The server returns response data after receiving the request instruction. For different types of request instructions, the server will give different feedback. Specifically, when the request instruction is a data request instruction, the database transmits the business data to the encryption plug-in, the encryption plug-in encrypts the business data to obtain the target data, and packages the target data and the decryption algorithm as response data and returns it to the data interaction module; when the request instruction is a drive request instruction, the database forwards the drive request instruction to the encryption plug-in, and the encryption plug-in returns the decryption algorithm as response data to the data interaction module.

[0047] It should be noted that the above data request instruction can be input into the client through the input device by the user, or can be transmitted to the data interaction module by the container module. The above drive request instruction is automatically generated by the data interaction module, specifically, it is a request instruction automatically generated when the built-in timer reaches the preset time.

[0048] Step S3: The decryption plug-in updates the original decryption algorithm according to the decryption algorithm. Regardless of the type of request instruction sent by the client, the response data contains the decryption algorithm, so the decryption plug-in will replace the original decryption algorithm with the decryption algorithm in the response data.

[0049] Step S4: Determine whether the response data contains the target data.

[0050] Step S5: If yes, the target data is stored in the data cache module, and when the container calls the target data, the decryption plug-in decrypts the target data to obtain the business data, and the business data is transmitted to the container, and the container processes and outputs it to the data usage module.

[0051] Step S6: If not, the decryption plug-in enters a dormant state, where the dormant state means that the decryption plug-in does not perform a decryption operation.

[0052] In summary, the implementation principle of a data security access system in the embodiment of the present application is as follows: First, the data interaction module sends a request instruction to the server side, and the server side returns a decryption algorithm or a decryption algorithm and target data according to the type of the request instruction. The decryption plug-in uses the decryption algorithm to decrypt the target data to obtain the business data. Since the decryption process is carried out in the container, the container isolates the business data and the client, and the container plays a role in protecting the business data, reducing the possibility of the business data being attacked. Also, because this application will first obtain the decryption algorithm when there is a need to use business data, and then the decryption plug-in will use the decryption algorithm to decrypt the target data, that is, the interactive mode of using the decryption algorithm as needed avoids storing the decryption algorithm on the client, thereby solving the problem of security risks in business data caused by the leakage of the decryption algorithm, and further improving the security of business data.

[0053] It should be noted that the data security access method of the present application is widely used in smart home (Smart Home), smart home, smart home equipment ecology, smart residential (Intelligence House) ecology and other whole-house intelligent digital control application scenarios. The client using this method may not be limited to PC, mobile phone, tablet computer, smart air conditioner, smart range hood, smart refrigerator, smart oven, smart stove, smart washing machine, smart water heater, smart washing equipment, smart dishwasher, smart projection equipment, smart TV, smart clothes drying rack, smart curtain, smart audio and video, smart socket, smart audio, smart speaker, smart fresh air equipment, smart kitchen and bathroom equipment, smart bathroom equipment, smart sweeping robot, smart window cleaning robot, smart mopping robot, smart air purification equipment, smart steamer, smart microwave oven, smart kitchen treasure, smart purifier, smart water dispenser, smart door lock, etc.

[0054] In order to better execute the program of the above method, the present application also provides a data security access device, which includes a memory and a processor.

[0055] The memory may be used to store instructions, programs, codes, code sets or instruction sets. The memory may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function, and instructions for implementing the above-mentioned data security access method, etc.; the data storage area may store data involved in the above-mentioned data security access method, etc.

[0056] The processor may include one or more processing cores. The processor calls the data stored in the memory by running or executing the instructions, programs, code sets or instruction sets stored in the memory, performs various functions of the present application and processes data. The processor may be at least one of a special purpose integrated circuit, a digital signal processor, a digital signal processing device, a programmable logic device, a field programmable gate array, a central processing unit, a controller, a microcontroller and a microprocessor. It is understandable that for different devices, the electronic device used to implement the above-mentioned processor function can also be other, and the embodiments of the present application are not specifically limited.

[0057] The present application also provides a computer-readable storage medium, for example, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes. The computer-readable storage medium stores a computer program that can be loaded by a processor and execute the above-mentioned data security access method.

[0058] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data security access system, comprising a client, characterized in that: The client comprises: A data interaction module is used to obtain target data and a decryption algorithm, wherein the target data is encrypted business data; The container module is provided with at least one container, the container is configured with a decryption plug-in, the decryption plug-in uses the decryption algorithm in the container to decrypt the target data to obtain business data, and outputs the business data.

2. The data security access system according to claim 1, characterized in that: The business data is in a custom bytecode format, and the target data is decrypted in the container into business data in the custom bytecode format.

3. The data security access system according to any one of claims 1-2, further comprising a server, characterized in that: The server side includes: at least one database, the database is configured with an encryption plug-in, and the encryption plug-in uses an encryption algorithm to encrypt the business data to obtain the target data.

4. The data security access system according to any one of claims 1 to 3, characterized in that: The data interaction module is used to send a request instruction to the server side, wherein the request instruction includes a data request instruction, and the data request instruction is used to request the target data and the decryption algorithm.

5. The data security access system according to claim 4, characterized in that: The client further includes a data cache module, and the data cache module is connected to the data interaction module; When the server receives the data request instruction, it returns response data, wherein the response data includes the target data and the decryption algorithm; The data interaction module inputs the target data into the data cache module, and the data interaction module inputs the decryption algorithm into the decryption plug-in.

6. The data security access system according to any one of claims 1 to 3, characterized in that: The data interaction module is used to send a request instruction to the server, wherein the request instruction includes a drive request instruction, and the drive request instruction is used to periodically request to obtain the decryption algorithm.

7. The data security access system according to claim 6, characterized in that: The server returns response data when receiving the drive request instruction, and the response data includes a decryption algorithm; The data interaction module inputs the decryption algorithm into the decryption plug-in.

8. A data security access method, applied to the system according to any one of claims 1 to 7, characterized in that: include: The data interaction module outputs a request instruction; After receiving the request instruction, the server returns response data, wherein the response data includes a decryption algorithm; The data interaction module inputs the decryption algorithm into the decryption plug-in.

9. The data security access method according to claim 8, characterized in that: The method further comprises: Determining whether the response data contains target data; If yes, the target data is stored in a data cache module; If not, the decryption plug-in enters a dormant state.

10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the data security access method according to any one of claims 8 to 9 through the computer program.

Images