A data security access system, method and electronic device

Abstract

This application discloses a data security access system, method, and electronic device, relating to the field of smart home technology. The system includes a server and a client. The server uses an encryption algorithm to encrypt business data to obtain target data and sends the target data and decryption algorithm to the client. The client includes a data interaction module for acquiring the target data and decryption algorithm, and a container module. At least one container is provided, equipped with a decryption plugin. The decryption plugin, located within the container, uses the decryption algorithm to decrypt the target data to obtain the business data. Therefore, this application, on the one hand, decrypts the target data to obtain business data within a container, isolating the business data from the client and ensuring business data security; on the other hand, it provides a decryption plugin that can perform decryption operations according to the client's needs without caching the decryption algorithm on the client, further ensuring the security of the business data.

Description

Technical Field

[0001] This application relates to the field of smart home technology, and more specifically, to a data security access system, method, and electronic device. Background Technology

[0002] In order to ensure a good user experience, during the information exchange between the client and the server, the business data obtained from the server is often cached locally before being used. For example, the design drawings of smart home devices are cached locally before being displayed.

[0003] The server stores one or more types of business data. To ensure the security of this data, when a client accesses the server, the server returns encrypted business data along with a private key. This allows the client to decrypt the data using the private key before use. However, caching the private key on the client side is prone to leakage. For example, a security vulnerability in the client software could be exploited by hackers, leading to the theft of the private key. Alternatively, if the user stores the private key on a networked or electronic device, it could be compromised if the device is hacked. When the private key is leaked, the security of the business data becomes extremely difficult to guarantee.

[0004] Caching private keys on the client side poses a security risk to business data. When business data is cached on the client side and executed by the client, if the business data carries malicious programs during transmission or is itself loaded with malicious programs, the malicious programs will launch attacks on the client during execution, causing losses to the client.

[0005] Therefore, there are security risks when the current client and server interact with each other. Summary of the Invention

[0006] To enhance data security when clients access data, this application proposes a data security access system, method, and electronic device.

[0007] A first aspect of this application provides a data security access system, the system including a client, the client comprising:

[0008] The data interaction module is used to acquire target data and decryption algorithms, wherein the target data is encrypted business data;

[0009] The container module includes at least one container, which is equipped with a decryption plugin. The decryption plugin is located within the container and uses the decryption algorithm to decrypt the target data to obtain business data, which is then output.

[0010] By adopting the above technical solution, the data interaction module obtains target data and decryption algorithms from the outside world. The decryption plugin uses the decryption algorithm to decrypt the target data to obtain business data. Since this decryption process is performed within a container, the container isolates the business data from the client, thus protecting the business data and reducing the possibility of attacks. Furthermore, because this application obtains the decryption algorithm first when there is a need to use business data, and then the decryption plugin uses the algorithm to decrypt the target data—a "use-as-you-go" approach—it avoids storing the decryption algorithm on the client, thereby solving the problem of security risks to business data caused by decryption algorithm leakage and further improving the security of business data. In addition, the business data received by the client is encrypted, ensuring its security during transmission. Therefore, this application can protect the security of business data from multiple dimensions when the client accesses data.

[0011] In one possible implementation, the business data is a custom bytecode format, and the target data is decrypted into the custom bytecode format business data in the container.

[0012] By adopting the above technical solution, the business data is in a custom bytecode format. After the target data is decrypted in the container, it is restored to the custom bytecode format. The bytecode format can be agreed upon by both the client and the device interacting with the client. The agreed bytecode format is ciphertext to the attacker, which increases the difficulty for the attacker to correctly identify the content contained in the business data, whether the business data is in the process of transmission or in the client, thereby improving the security of the business data.

[0013] In one possible implementation, the data security access system further includes a server side, which includes at least one database configured with an encryption plugin, wherein the encryption plugin uses an encryption algorithm to encrypt the business data to obtain the target data.

[0014] By adopting the above technical solution, the encryption plugin uses an encryption algorithm to encrypt the business data. The business data itself is in bytecode format agreed upon by both the client and the server, which is a kind of ciphertext. Therefore, the business data of this application has double encryption during transmission, thereby providing technical protection for the secure transmission of business data.

[0015] In one possible implementation, the data interaction module is used to send a request instruction to the server, the request instruction including a data request instruction, the data request instruction being used to request the target data and the decryption algorithm.

[0016] In one possible implementation, the client further includes a data caching module, which is connected to the data interaction module;

[0017] When the server receives the data request instruction, it returns response data, which includes the target data and the decryption algorithm.

[0018] The data interaction module inputs the target data into the data cache module, and the data interaction module inputs the decryption algorithm into the decryption plugin.

[0019] By adopting the above technical solution, when the data interaction module requests target data from the server, the server simultaneously returns a decryption algorithm. The data interaction module then inputs the decryption algorithm into the decryption plugin, which uses the algorithm to decrypt the target data. This on-demand decryption algorithm interaction method avoids storing the decryption algorithm on the client, thus solving the problem of security risks to business data caused by decryption algorithm leakage and further improving the security of business data.

[0020] In one possible implementation, the data interaction module is used to send a request instruction to the server, the request instruction including a driver request instruction, which is used to periodically request the decryption algorithm.

[0021] In one possible implementation, when the server receives the driver request instruction, it returns response data, which includes a decryption algorithm.

[0022] The data interaction module inputs the decryption algorithm into the decryption plugin.

[0023] By adopting the above technical solution, the data interaction module periodically requests the decryption algorithm from the server and inputs the obtained decryption algorithm into the decryption plugin, so that the decryption plugin periodically updates its internal decryption algorithm, increasing the difficulty for attackers to obtain the correct decryption algorithm, thereby improving the security of business data.

[0024] A second aspect of this application provides a data security access method, which is applied to the aforementioned data security access system, and the method includes:

[0025] The data interaction module outputs a request command;

[0026] After receiving the request instruction, the server returns response data, which includes a decryption algorithm.

[0027] The data interaction module inputs the decryption algorithm into the decryption plugin.

[0028] In one possible implementation, the method further includes:

[0029] Determine whether the response data contains the target data;

[0030] If so, the target data will be stored in the data cache module;

[0031] If not, the decryption plugin enters a dormant state.

[0032] By adopting the above technical solution, the data interaction module sends a request command to the server. The server responds to the request command by returning response data, and the decryption plugin obtains the decryption plugin from the response data. Simultaneously, it determines whether the response data contains the target data. If so, the decryption plugin uses the decryption algorithm to decrypt the data within the container, thereby isolating the decrypted business data from the client and ensuring the security of the business data. Otherwise, the decryption plugin enters a dormant state, where it only updates its internal decryption algorithm without performing any decryption operations, thus achieving the purpose of updating the decryption algorithm.

[0033] A third aspect of this application provides an electronic device including a memory and a processor, wherein the memory stores a computer program and the processor is configured to execute the above-described data security access method through the computer program.

[0034] This application has at least one of the following technical effects:

[0035] 1. The decryption plugin is located within a container. It uses a decryption algorithm to decrypt the target data to obtain the business data. This decryption process is performed within the container, which isolates the business data from the client. The container plays a role in protecting the business data and reducing the possibility of the business data being attacked.

[0036] 2. When the client needs to use business data, it will first obtain the decryption algorithm, and then the decryption plugin will use the decryption algorithm to decrypt the target data. This interactive method of obtaining the decryption algorithm as needed avoids storing the decryption algorithm on the client, thereby solving the problem of business data security risks caused by decryption algorithm leakage.

[0037] 3. The client and server agree on the bytecode format of the business data, converting plaintext business data into ciphertext business data. On this basis, the encryption plugin uses an encryption algorithm to encrypt the business data, so that the business data has double encryption during transmission, thereby providing technical protection for the secure transmission of business data. Attached Figure Description

[0038] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a schematic diagram of a data security access system structure according to an embodiment of this application.

[0041] Figure 2 This is a flowchart of a data security access method according to an embodiment of this application. Detailed Implementation

[0042] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0043] It should be noted that the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or device.

[0044] According to one aspect of an embodiment of this application, a data security access system is provided. For example... Figure 1 As shown, the data security access system includes a server and at least one client. The server connects to the client via a network and can be used to provide services to the client (such as application services). A database can be set up on the server to provide data storage services. Cloud computing and / or edge computing services can also be configured on the server to provide data processing services.

[0045] It should be noted that the "server side" mentioned above refers to the physical server, while the "client side" can represent physical electronic devices, such as PCs, mobile phones, tablets, smart air conditioners, smart range hoods, smart refrigerators, smart ovens, smart stoves, smart washing machines, smart water heaters, smart washing equipment, smart dishwashers, smart projectors, smart TVs, smart clothes racks, smart curtains, smart audio-visual systems, smart sockets, smart speakers, smart speakers, smart ventilation systems, smart kitchen and bathroom equipment, smart bathroom fixtures, smart robot vacuums, smart window cleaning robots, smart mopping robots, smart air purifiers, smart steam ovens, smart microwave ovens, smart water heaters, smart air purifiers, smart water dispensers, smart door locks, etc. The client side can also represent applications running on physical electronic devices, such as intelligent software systems that control the operation of electronic devices.

[0046] In addition, the aforementioned networks may include, but are not limited to, at least one of the following: wired network, wireless network. The aforementioned wired network may include, but is not limited to, at least one of the following: wide area network, metropolitan area network, local area network. The aforementioned wireless network may include, but is not limited to, at least one of the following: Wi-Fi (Wireless Fidelity), Bluetooth.

[0047] Specifically, the server side includes at least one database, each storing at least one type of business data. The database types on the server side include, but are not limited to, MySQL, Oracle, NoSQL, and Neo4j databases. The types of business data stored in the databases include, but are not limited to, sensor data, user behavior data, and audio / video data. Sensor data mainly includes environmental parameters such as temperature, humidity, and light levels in the environment where smart home devices are located. This data is collected in real time by sensors in the environment or within the devices. User behavior data mainly records user behavior regarding smart home devices, such as the number of times lights are switched on and off, and the frequency of device use. Audio / video data primarily targets smart home devices with audio / video capabilities and is the data collected and stored by these devices. The business data in the database can be entered by administrators or automatically uploaded to the database by smart home devices.

[0048] To ensure the security of business data, an encryption plugin can be configured for each database, or multiple databases can be configured with one encryption plugin. The encryption plugin can use a WebAssembly (WASM) plugin, which is a plugin based on WebAssembly (WASM) technology. It has a compact binary format that runs as a high-performance binary program on the server-side or client-side web browser, and can run at near-native speeds. This makes it suitable for high-performance, compute-intensive applications, allowing a single server to support simultaneous access from multiple clients. Encryption plugins can also be other types of plugins, such as Node.js plugins. Node.js plugins are typically written in C / C++, and their runtime requires access to server-side system resources.

[0049] The wasm plugin comes pre-configured with encryption algorithms. The encryption algorithm used here can be either symmetric or asymmetric. Symmetric encryption algorithms include the Advanced Encryption Standard (AES) block cipher. AES encryption divides plaintext data into fixed-size blocks and then encrypts each block using the same key, converting the plaintext blocks into ciphertext blocks. Asymmetric encryption algorithms include classic asymmetric algorithms like RSA and elliptic curve cryptography (ECC). RSA utilizes the difficulty of prime number factorization to generate public and private keys for encryption and decryption. ECC is a public-key encryption algorithm based on elliptic curve mathematics. In practical use, the appropriate encryption algorithm should be selected based on the specific application scenario.

[0050] It should be noted that there can be multiple clients interacting with the server, and each client can interact with multiple servers, enabling the client to obtain different types of business data from different servers.

[0051] To illustrate the process of a client acquiring business data, we will use one client as an example: The client includes a data interaction module, a container module, a data caching module, and a data usage module. The container module, as the core of the device, connects to the data interaction module, the data caching module, and the data usage module.

[0052] The data interaction module is primarily used for information exchange with the server, retrieving target data and decryption algorithms from the server. Target data refers to business data encrypted by the encryption plugin using an encryption algorithm. The decryption algorithm corresponds to the encryption algorithm and is mainly used to decrypt the encrypted business data. For example, if the encryption algorithm uses a key from the AES encryption algorithm, the decryption algorithm will also use the same key from the AES encryption algorithm. If the encryption algorithm is an asymmetric encryption algorithm, the decryption algorithm will use the private key corresponding to the public key used in the encryption algorithm. The data interaction module stores the target data in the data cache module, which then calls it when needed by the container module. The data interaction module inputs the decryption algorithm into the container module to facilitate decryption of the target data within the container module.

[0053] Each container module contains at least one container, which is a Wasm container. Unlike traditional operating system-level containers, Wasm containers do not require a complete operating system environment; instead, they run directly in the underlying virtual machine. This offers flexible deployment, higher efficiency, and lower resource overhead, making them suitable for deployment on different clients. To enable clients to use encrypted business data, each container is configured with a decryption plugin. Specifically, the decryption plugin is set up within its corresponding container and also uses a Wasm plugin. The Wasm plugin uses a decryption algorithm to decrypt the target data within the container to obtain the business data.

[0054] It should be noted that both the decryption and encryption plugins in this example use the wasm plugin. Since the decryption and encryption plugins support the same language format, there is no need to equip them with a format conversion device. The business data encrypted by the encryption plugin can be correctly recognized in the decryption plugin, thereby saving the number of business data transfer nodes from the client to the server and reducing the possibility of business data being attacked.

[0055] The decryption plugin obtains the decryption algorithm from the data interaction module. Essentially, the plugin automatically deletes the decryption algorithm after each decryption operation to avoid caching it within the container module and having to re-request it from the server when the client needs decryption. Alternatively, the plugin could retain the decryption algorithm after decryption, but this requires an agreement with the server on when to update the encryption and decryption algorithms. The server updates the encryption and decryption algorithms at the agreed time, and the client requests the updated decryption algorithm from the server at the agreed time. This updated algorithm then updates the previously retained decryption algorithm within the client, achieving dynamic updates to the client's decryption algorithm. This prevents attackers from finding patterns and deducing the decryption algorithm through multiple attacks, increasing the difficulty of cracking the decryption algorithm.

[0056] In a specific example, the decryption algorithm in the decryption plugin can be updated periodically. This can be achieved by embedding a timer within the data interaction module. This timer is an embedded timing program. When the data interaction module obtains the latest decryption algorithm from the server, the timer resets and starts counting. If the data interaction module retrieves business data from the server within a preset time period, it will also simultaneously obtain the decryption algorithm, at which point the timer resets and starts counting again. Otherwise, when the preset time period arrives, the data interaction module automatically requests the latest decryption algorithm from the server. After obtaining the latest decryption algorithm, the timer resets and starts counting again, and this cycle repeats to dynamically update the decryption algorithm. In other examples, the original decryption algorithm can be updated only when the target data is retrieved, since a new decryption algorithm is also obtained simultaneously. The original decryption algorithm refers to the decryption algorithm previously retained in the decryption plugin.

[0057] Furthermore, the business data used in this example employs a custom bytecode format. This format is agreed upon by both the client and server, and both parties transmit encrypted business data according to this agreed-upon bytecode format. This agreed-upon bytecode format is ciphertext to the attacker, increasing the difficulty for them to correctly identify the content contained in the business data. On top of this, the encryption plugin further encrypts the business data using an encryption algorithm. Only when the container calls the target data does the decryption plugin use a decryption algorithm to decrypt the target data, thus obtaining the business data in the custom bytecode format. Therefore, the business data is doubly encrypted during transmission and while cached in the data caching module, ensuring its security during both processes. As for the decrypted business data, its security is also guaranteed due to the isolation provided by the container.

[0058] The aforementioned business data is processed by the container and then output to the data usage module for use. The data usage module can be a display screen or other software or hardware modules that facilitate user access to the business data.

[0059] This application also provides a data security access method, which is applied to the aforementioned data security access system. For example... Figure 2 As shown, the steps of the data security access method are as follows.

[0060] Step S1: The data interaction module outputs request commands. There are two types of request commands: one is when the client needs to retrieve business data from the server, and the other is when the client periodically updates the decryption algorithm in the decryption plugin. To distinguish between these different types of request commands, the request command for retrieving business data is called a data request command, while the request command for updating the decryption algorithm is called a driver request command.

[0061] Step S2: After receiving the request instruction, the server returns response data. The server provides different responses for different types of request instructions. Specifically, when the request instruction is a data request instruction, the database transmits the business data to the encryption plugin. The encryption plugin encrypts the business data to obtain the target data and packages the target data and decryption algorithm as response data, returning it to the data interaction module. When the request instruction is a driver request instruction, the database forwards the driver request instruction to the encryption plugin, which then returns the decryption algorithm as response data to the data interaction module.

[0062] It should be noted that the aforementioned data request commands can be entered by the user into the client via an input device, or they can be transmitted from the container module to the data interaction module. The aforementioned driver request commands are automatically generated by the data interaction module, specifically, they are automatically generated after the built-in timer reaches a preset time.

[0063] Step S3: The decryption plugin updates the original decryption algorithm based on the decryption algorithm itself. Regardless of the type of request command sent by the client, the response data contains the decryption algorithm, so the decryption plugin will replace the original decryption algorithm with the decryption algorithm in the response data.

[0064] Step S4: Determine whether the response data contains the target data.

[0065] Step S5: If yes, store the target data in the data cache module, and when the container calls the target data, the decryption plugin decrypts the target data to obtain the business data. The business data is then transmitted to the container, processed by the container, and output to the data usage module.

[0066] Step S6: If not, the decryption plugin enters a dormant state, which means that the decryption plugin does not perform decryption operations.

[0067] In summary, the implementation principle of the data security access system according to this application is as follows: First, the data interaction module sends a request command to the server. Depending on the type of request command, the server returns a decryption algorithm or a decryption algorithm and target data. The decryption plugin uses the decryption algorithm to decrypt the target data to obtain the business data. Since this decryption process is performed within a container, the container isolates the business data from the client, protecting the business data and reducing the possibility of attacks. Furthermore, because this application obtains the decryption algorithm first when there is a need to use business data, and then the decryption plugin uses the algorithm to decrypt the target data—a "use-as-you-go" approach—it avoids storing the decryption algorithm on the client, thus solving the problem of security risks to business data caused by decryption algorithm leakage and further improving the security of business data.

[0068] It should be noted that the data security access method of this application is widely used in whole-house intelligent digital control application scenarios such as smart home, smart home appliances ecosystem, and smart house ecosystem. The client using this method is not limited to PCs, mobile phones, tablets, smart air conditioners, smart range hoods, smart refrigerators, smart ovens, smart stoves, smart washing machines, smart water heaters, smart washing equipment, smart dishwashers, smart projectors, smart TVs, smart clothes racks, smart curtains, smart audio-visual systems, smart sockets, smart speakers, smart speakers, smart ventilation systems, smart kitchen and bathroom appliances, smart bathroom appliances, smart robot vacuum cleaners, smart window cleaning robots, smart mopping robots, smart air purifiers, smart steam ovens, smart microwave ovens, smart water heaters, smart air purifiers, smart water dispensers, and smart door locks, etc.

[0069] To better execute the above-described method, this application also provides a data security access device, which includes a memory and a processor.

[0070] The memory can be used to store instructions, programs, code, code sets, or instruction sets. The memory may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for at least one function, and instructions for implementing the aforementioned data security access methods; the data storage area may store data involved in the aforementioned data security access methods.

[0071] A processor may include one or more processing cores. The processor executes instructions, programs, code sets, or instruction sets stored in memory, and calls data stored in memory to perform various functions and process data as described in this application. The processor may be at least one of a specific application-specific integrated circuit, a digital signal processor, a digital signal processing device, a programmable logic device, a field-programmable gate array, a central processing unit, a controller, a microcontroller, and a microprocessor. It is understood that, for different devices, the electronic devices used to implement the above-described processor functions may also be other types, and the embodiments of this application do not specifically limit the specific implementation.

[0072] This application also provides a computer-readable storage medium, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and other media capable of storing program code. This computer-readable storage medium stores a computer program that can be loaded by a processor and executed using the aforementioned data security access method.

[0073] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A data security access system, comprising a client, characterized in that, The client includes: a data interaction module for acquiring target data and a decryption algorithm, wherein the target data is encrypted business data; and a container module, which has at least one container configured with a decryption plugin, wherein the decryption plugin is located within the container and uses the decryption algorithm to decrypt the target data to obtain the business data, and outputs the business data. The data interaction module is used to send request instructions to the server. The request instructions include data request instructions, which are used to request the target data and the decryption algorithm. The client also includes a data caching module, which is connected to the data interaction module; when the server receives the data request instruction, it returns response data, which includes the target data and the decryption algorithm; the data interaction module inputs the target data into the data caching module and the decryption algorithm into the decryption plugin.

2. The data security access system according to claim 1, characterized in that, The business data is in a custom bytecode format, and the target data is decrypted into the custom bytecode format business data in the container.

3. The data security access system according to any one of claims 1-2 further includes a server, characterized in that, The server includes at least one database, which is configured with an encryption plugin. The encryption plugin uses an encryption algorithm to encrypt the business data to obtain the target data.

4. The data security access system according to any one of claims 1-2, characterized in that, The data interaction module is used to send request instructions to the server. The request instructions include driver request instructions, which are used to periodically request the decryption algorithm.

5. The data security access system according to claim 4, characterized in that, When the server receives the driver request instruction, it returns response data, which includes a decryption algorithm. The data interaction module inputs the decryption algorithm into the decryption plugin.

6. A data security access method, applied to the system described in any one of claims 1-5, characterized in that, include: The data interaction module outputs a request command; After receiving the request instruction, the server returns response data, which includes a decryption algorithm; the data interaction module inputs the decryption algorithm into the decryption plugin.

7. The data security access method according to claim 6, characterized in that, The method further includes: determining whether the response data contains target data; if so, storing the target data in the data cache module; if not, the decryption plugin enters a dormant state.

8. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to execute the data security access method of any one of claims 6 to 7 through the computer program.

Images