Data processing method, service side, client, storage medium and computer program product

Abstract

The invention provides a data processing method, a service side, a client, a storage medium and a computer program product, and the data processing method applied to the service side comprises the steps: dispersing first plaintext data into a first number of sub-plaintext data, the first plaintext data can be recovered through any second quantity of sub-plaintext data smaller than or equal to the first quantity; generating a plurality of first verification codes respectively corresponding to each piece of sub-plaintext data for each piece of sub-plaintext data; generating a plurality of first keys; encrypting the multiple pieces of sub-plaintext data corresponding to the first keys by using the multiple first keys to obtain multiple pieces of sub-ciphertext data; the multiple index numbers are embedded into the multiple corresponding first verification codes respectively to obtain multiple second verification codes, and the multiple index numbers are used for determining the corresponding relation between the second secret key and the multiple pieces of sub-ciphertext data when the client conducts data recovery; and sending the multiple pieces of sub-ciphertext data and the multiple second verification codes to the client. The security of the data is improved, and the operation of the client is simplified.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data processing method, a service side, a client, a storage medium and a computer program product. Background Art

[0002] In cloud storage, finance, and distributed data management systems, secure data transmission and recovery are key to ensuring system security, especially for sensitive data. Existing data processing methods rely on fixed passwords or verification codes to generate keys, which are easily cracked or intercepted by attackers through brute force attacks, and data security cannot be guaranteed. In addition, the client needs to maintain the correspondence between the verification code and the data, which is complex to maintain and may cause errors in the correspondence between the verification code and the data, affecting data security. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a data processing method, a service side, a client, a storage medium and a computer program product.

[0004] The embodiment of the present application adopts the following technical solution: a data processing method, applied to the service side, comprising:

[0005] Dispersing the first plaintext data into a first number of multiple sub-plaintext data, wherein the first plaintext data can be restored by any second number of sub-plaintext data, and the second number is less than or equal to the first number;

[0006] Generate a plurality of first verification codes respectively corresponding to each sub-plaintext data;

[0007] Generate a plurality of first keys based on the plurality of first verification codes respectively;

[0008] Using the multiple first keys, encrypt the multiple sub-plaintext data corresponding to the respective first keys to obtain multiple sub-ciphertext data;

[0009] Embedding a plurality of index numbers corresponding to the plurality of sub-plaintext data into the corresponding plurality of first verification codes respectively to obtain a plurality of second verification codes, wherein the plurality of index numbers are used by the client to determine the correspondence between the second key and the plurality of sub-ciphertext data when performing data recovery, and the second key is used to decrypt the sub-ciphertext data corresponding to the second key;

[0010] The plurality of sub-ciphertext data and the plurality of second verification codes are sent to the client.

[0011] In some embodiments, the first verification code corresponding to any sub-plaintext data is unique and is a randomly generated dynamic value.

[0012] In some embodiments, generating a plurality of first keys based on the plurality of first verification codes respectively includes:

[0013] Based on the plurality of first verification codes and the respective corresponding salt values, a plurality of first keys are generated respectively;

[0014] The salt values ​​corresponding to the multiple first verification codes are the same single salt value, or are independent salt values ​​corresponding to the multiple first verification codes;

[0015] Sending the plurality of sub-ciphertext data and the plurality of second verification codes to the client includes: sending the plurality of sub-ciphertext data, the plurality of second verification codes, and respective corresponding salt values ​​to the client.

[0016] In some embodiments, the method further comprises:

[0017] receiving data transfer requests from one or more clients;

[0018] When the number of clients is the third number:

[0019] Dividing the plurality of sub-ciphertext data into a third number of sub-ciphertext data packets, each of the sub-ciphertext data packets including one or more of the sub-ciphertext data; wherein the third number is a plurality;

[0020] Divide the plurality of second verification codes into a third number of verification code data packets, each of the verification code data packets including one or more of the second verification codes;

[0021] Sending each sub-ciphertext data packet and each verification code data packet corresponding to each sub-ciphertext data packet to a third number of the clients respectively;

[0022] The first sub-plaintext data obtained by each of the clients are concentrated to a target client; wherein the third number of clients can communicate with each other, or

[0023] The target client among the clients can communicate with each of the other clients.

[0024] In some embodiments, the method further comprises:

[0025] Receiving a data transmission request from a client, wherein the data transmission request is used to request transmission of second plaintext data;

[0026] Sending second ciphertext data to the client, wherein the second ciphertext data is data obtained by encrypting second plaintext data based on the first plaintext data.

[0027] In some embodiments, the second plaintext data can be used by the client to decrypt the backed-up third ciphertext data to restore the third plaintext data, and the third ciphertext data is stored on the service side or the client.

[0028] The present application also provides a data processing method, which is applied to a client, and the method includes:

[0029] Receiving at least a second number of second verification codes and sub-ciphertext data from the service side; wherein the service side sends a first number of sub-ciphertext data and second verification codes to the client, and the second number is less than or equal to the first number;

[0030] Parsing each of the second verification codes to separate at least a second number of index numbers and associated first verification codes; wherein the index numbers are used to determine a corresponding relationship between the second key and the sub-ciphertext data;

[0031] generating at least a second number of corresponding second keys according to at least a second number of the first verification codes;

[0032] decrypting the sub-ciphertext data corresponding to the index number associated with the first verification code using at least a second number of the second keys to obtain at least a second number of corresponding first sub-plaintext data;

[0033] The first plaintext data is restored by using at least a second amount of the first sub-plaintext data.

[0034] In some embodiments, one or more of the clients sends a data transmission request to the service side;

[0035] When the number of clients is the third number:

[0036] Each of the clients receives a sub-ciphertext data packet, wherein each of the sub-ciphertext data packets includes one or more sub-ciphertext data;

[0037] Each of the clients receives a verification code data packet, wherein each of the verification code data packets includes one or more of the second verification codes corresponding to the sub-ciphertext data in the sub-ciphertext data packet;

[0038] Each of the clients collects the first plaintext sub-data obtained by each client to a target client;

[0039] The target client restores the second amount of the first sub-plaintext data to obtain the first plaintext data.

[0040] In some embodiments, when the third number of clients are able to communicate with each other, the clients other than the target client can send the first sub-plaintext data recovered by them to the target client through other clients;

[0041] or,

[0042] In the case where the target client can communicate with other clients, other clients can send the first sub-plaintext data they have restored to the target client.

[0043] In some embodiments, the method further comprises:

[0044] Sending a data transmission request to the service side, where the data transmission request is used to request transmission of the second plaintext data;

[0045] Receiving second ciphertext data from the service side;

[0046] Decrypt the second ciphertext data using the restored first plaintext data to obtain second plaintext data;

[0047] The at least second number of second verification codes and sub-ciphertext data are sent by the service side to the client in response to the data transmission request.

[0048] In some embodiments, the method further comprises:

[0049] Obtaining the backed-up third ciphertext data from the service side or the client;

[0050] The third ciphertext data is decrypted using the second plaintext data to obtain restored third plaintext data.

[0051] The embodiment of the present application also provides a service side, including:

[0052] At least one first processor disperses first plaintext data into a first number of multiple sub-plaintext data, wherein the first plaintext data can be recovered by any second number of sub-plaintext data, and the second number is less than or equal to the first number; generates multiple first verification codes corresponding to each sub-plaintext data; generates multiple first keys based on the multiple first verification codes; uses the multiple first keys to encrypt the multiple sub-plaintext data corresponding to each first key to obtain multiple sub-ciphertext data; embeds multiple index numbers corresponding to each of the multiple sub-plaintext data into the corresponding multiple first verification codes to obtain multiple second verification codes; wherein the multiple index numbers are used by the client to determine the correspondence between the second key and the multiple sub-ciphertext data when recovering data, and the second key is used to decrypt the sub-ciphertext data corresponding to the second key; sends the multiple sub-ciphertext data and the multiple second verification codes to the client.

[0053] The present application also provides a client, including:

[0054] At least one second processor receives at least a second number of second verification codes and sub-ciphertext data from a service side; wherein the service side sends a first number of sub-ciphertext data and second verification codes to a client, and the second number is less than or equal to the first number; parses each of the second verification codes to separate at least a second number of index numbers and associated first verification codes; wherein the index number is used to determine the correspondence between a second key and the sub-ciphertext data; generates at least a second number of responses of the second key based on at least a second number of the first verification codes; uses at least a second number of the second keys to decrypt the sub-ciphertext data corresponding to the index number associated with the first verification code to obtain at least a second number of responses of the first sub-plaintext data; and recovers the first plaintext data through at least a second number of the first sub-plaintext data.

[0055] An embodiment of the present application also provides a storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, a method as described in any one of the above embodiments is implemented.

[0056] An embodiment of the present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the method described in any one of the above embodiments.

[0057] The beneficial effects of the embodiments of the present application are:

[0058] By dispersing the first plaintext data into multiple sub-plaintext data, combining threshold passwords and verification code verification, generating multiple verification codes corresponding to the multiple sub-plaintext data, and then generating multiple corresponding keys through the multiple verification codes, and then encrypting and protecting the multiple sub-plaintext data respectively through the multiple keys, even if part of the verification code or data is intercepted, the interceptor still cannot restore the first plaintext data, thereby improving the security of the data. By embedding multiple index numbers corresponding to the multiple sub-plaintext data into the corresponding multiple verification codes, the client can determine which corresponding sub-ciphertext data can be decrypted by the second key of the client through the index number, and the client does not need to maintain the corresponding relationship between the verification code and the data, which simplifies the client's operation process, avoids the deviation of the corresponding relationship between the verification code and the data, and further improves the security of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0060] Figure 1 This is a schematic diagram of the architecture of the service side and the client side of this application;

[0061] Figure 2 A flowchart of a data processing method shown as an exemplary embodiment of the present application;

[0062] Figure 3 This is the structural diagram of the service side of this application;

[0063] Figure 4 This is the structural block diagram of the client of this application. DETAILED DESCRIPTION

[0064] Various aspects and features of the present application are described herein with reference to the accompanying drawings.

[0065] It should be understood that various modifications may be made to the embodiments of the present application. Therefore, the above description should not be considered as limiting, but only as an example of an embodiment. Other modifications within the scope and spirit of the present application will occur to those skilled in the art.

[0066] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present application and, together with the general description of the present application given above and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0067] These and other characteristics of the present application will become apparent from the following description of a preferred form of embodiment given as a non-limiting example with reference to the accompanying drawings.

[0068] It should also be understood that although the present application has been described with reference to some specific examples, those skilled in the art will be able to readily implement many other equivalent forms of the present application.

[0069] The above and other aspects, features and advantages of the present application will become more apparent in view of the following detailed description when taken in conjunction with the accompanying drawings.

[0070] Specific embodiments of the present application are described hereinafter with reference to the accompanying drawings; however, it should be understood that the embodiments applied for are merely examples of the present application, which may be implemented in a variety of ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that obscure the present application. Therefore, the specific structural and functional details applied for herein are not intended to be limiting, but merely serve as a basis and representative basis for the claims to teach those skilled in the art to use the present application in a variety of ways with substantially any suitable detailed structure.

[0071] This specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," all of which may refer to one or more of the same or different embodiments according to the present application.

[0072] like Figure 1 As shown, the client and the service side can communicate and exchange data, the service side may include a server, and the client may be one or more. The client may be an application, software, or a combination of software and hardware set on a network terminal.

[0073] It is understandable that in some cases, when there are multiple clients, the clients may include a target client and other clients, and data can be exchanged between the clients. The clients other than the target client can collect data to the target client through data transmission between the clients, or the other clients cannot exchange data, while the other clients can exchange data with the target client, and the other clients can directly transmit data to the target client. Of course, it is understandable that the client may also include other settings.

[0074] Some or all of the data transmitted between the client and the server may have high security requirements. For example, in cloud storage, financial or medical systems, the system has high requirements for data security, especially sensitive data. The data processing method that relies on fixed passwords or verification codes to generate keys during data processing cannot meet the high data security requirements.

[0075] Based on the above application scenarios, based on threshold cryptography, verification code verification and encryption protection mechanism, the security and reliability of data are improved. At the same time, the index number is embedded in the verification code during data processing, so that the client does not need to maintain the corresponding relationship between the verification code and the data, simplifying the client's operation process. Among them, threshold cryptography refers to sharing the key with multiple participants (or entities) and setting a threshold value. Only when the participants who reach or exceed this threshold value gather together can they decrypt information or perform cryptographic operations such as signing.

[0076] The following specifically explains the data processing method applied to the service side provided by the embodiment of the present application. Figure 2 , methods include:

[0077] S110: The service side disperses the first plaintext data into a first number of multiple sub-plaintext data, wherein the first plaintext data can be restored by any second number of sub-plaintext data, and the second number is less than or equal to the first number.

[0078] Exemplarily, the service side can disperse the data. The service side disperses the first plaintext data S into n sub-plaintext data Si by threshold cryptography. Specifically, S1, S2, ..., Sn. Where n is the first number, and n is a positive integer greater than or equal to 3. The threshold value is set to m, that is, the first plaintext data can be restored by any second number of sub-plaintext data, and the second number is m, which is a positive integer less than or equal to n.

[0079] For example, threshold cryptography can be implemented as follows:

[0080] The Shamir secret sharing algorithm can be used:

[0081] The first plaintext data S is represented as a polynomial P(x) to generate n fragmented sub-plaintext data:

[0082] 0S(i)=P(i);

[0083] The sub-plaintext data of any m fragments can be reconstructed into a polynomial P(x) through the Lagrange interpolation method to restore the first plaintext data S.

[0084] Of course, threshold cryptography can also use a secret sharing algorithm based on multidimensional vectors or a secret sharing based on laws. This is only used as an example and does not constitute a limitation on the scope of protection of the claims.

[0085] For example, the service side disperses the first plaintext data S into 10 sub-plaintext data by threshold cryptography, and the sub-plaintext data are S1, S2, ..., Sn10. The threshold value is set to 5, and the first plaintext data S can be recovered by any 5, or any 6, or any 7, or any 8, or any 9, or any 10 sub-plaintext data.

[0086] The first plaintext data may correspond to the backed-up data that the client needs to restore, or may be other data. In the case where the first plaintext data may correspond to the backed-up data that the client needs to restore, the service side may perform the operation of step S100 in response to the data restoration request from the client.

[0087] S120: The service side generates a plurality of first verification codes corresponding to each sub-plaintext data.

[0088] Exemplarily, the service side may generate a verification code, and the service side generates a plurality of first verification codes VC(i) corresponding to each sub-plaintext data.

[0089] In some feasible embodiments, the first verification code VC(i) corresponding to any sub-plaintext data is unique and is a randomly generated dynamic value, thereby preventing the interceptor of the sub-plaintext data from generating a verification code corresponding to the sub-plaintext data in the same manner to verify the sub-plaintext data, thereby ensuring the security of the first verification code.

[0090] S130: The service side generates a plurality of first keys based on the plurality of first verification codes respectively.

[0091] Exemplarily, the service side can generate a key. For example, the service side can use the PBKDF algorithm to generate the first key Ki with the first verification code VC(i) as input:

[0092] 0The first key Ki can be expressed as:

[0093] Ki = PBKDF(VC(i)).

[0094] Among them, the PBKDF algorithm is a password-based key derivation function used to derive cryptographic key material from a secret value (such as a password). The PBKDF algorithm is a deterministic algorithm that generates a key from a password by applying a pseudo-random function (PRF) and a fixed number of iterations. The input to perform PBKDF can include a password (denoted as P), a salt (denoted as S), and the bit length required for the key (denoted as kLen). The main purpose of the PBKDF algorithm is to increase the computational overhead of guessing a password through a brute force attack, thereby improving the security of the password.

[0095] For example, the service side may generate a first key K1 based on the first verification code VC(1), generate a first key K2 based on the first verification code VC(2), ..., until first keys corresponding to all first verification codes are generated.

[0096] Of course, it is understandable that the first key can also be generated by other algorithms or methods. This is only used as an example and does not constitute a limitation on the scope of protection of the claims.

[0097] S140: The service side uses the multiple first keys to encrypt the multiple sub-plaintext data corresponding to the respective first keys to obtain multiple sub-ciphertext data.

[0098] Exemplarily, the service side may also encrypt the data. The service side uses the first key Ki to encrypt the corresponding sub-plaintext data Si to obtain the sub-ciphertext data Ci, where the sub-ciphertext data Ci can be expressed as:

[0099] Ci=Encrypt(Ki,Si).

[0100] S150: The service side embeds multiple index numbers corresponding to the multiple sub-plaintext data into the corresponding multiple first verification codes to obtain multiple second verification codes. The multiple index numbers are used by the client to determine the corresponding relationship between the second key and the multiple sub-ciphertext data when recovering data, and the second key is used to decrypt the sub-ciphertext data corresponding to the second key.

[0101] Exemplarily, the service side can embed the index number. For example, the slice index number i is embedded in the first verification code VC(i) to generate multiple second verification codes VC2(1), and the second verification code can be used as the final verification code. Exemplarily, the format of the second verification code is: "{index number}-{first verification code}", which can be expressed as:

[0102] VC2(1) = "1-ABC123", indicating the second verification code with index 1;

[0103] VC2(2)="2-XYZ789", indicating the second verification code with index 2.

[0104] Among them, the index number can be a number or a string used to uniquely identify the first verification code. During the data transmission process, the first verification code can be used to verify the integrity and authenticity of the data. By embedding the index number in the first verification code, the uniqueness and traceability of the data can be further ensured. The index number is unique to ensure that each first verification code can be accurately identified and distinguished. In order to maintain the consistency of the verification code and facilitate processing, the index number can have a fixed length. The index number has a certain degree of randomness to increase the difficulty of cracking and improve the security of data transmission. The index number is directly associated with the identified first verification code so that it can be accurately matched during the verification process. The specific form of the index number can be a combination of numbers, letters, special characters, or a string after encryption or hashing. The selection of the index number can be determined according to the user's transmission needs and security requirements.

[0105] For example, a 64-bit integer may be used as the index number, and the integer is associated with the first verification code through an encryption algorithm. On the client side, the integrity and authenticity of the data may be ensured by decrypting and verifying the index number.

[0106] In addition, the index number may also be combined with information such as the sequence number and time stamp of the data packet including the first verification code to form a more complex verification code structure to further improve the security of data transmission.

[0107] S160: The service side sends a plurality of sub-ciphertext data and a plurality of second verification codes to the client.

[0108] Exemplarily, the service side may send multiple sub-ciphertext data and multiple second verification codes to the client through a secure channel. The multiple sub-ciphertext data and multiple second verification codes may be placed in a data packet and sent to the client in the form of a data packet. For example, the service side may construct a data packet, and the data packet includes:

[0109] Multiple sub-ciphertext data: C1, C2, ..., Cn;

[0110] Multiple second verification codes: VC2(1), VC2(2), ..., VC2(n).

[0111] Of course, the service side can also send multiple sub-ciphertext data and multiple second verification codes to the client through other transmission methods other than the secure channel. This is only used as an example and does not constitute a limitation on the protection scope of the claims.

[0112] In some embodiments, the service side generates multiple first keys based on multiple first verification codes, including:

[0113] The service side generates multiple first keys based on multiple first verification codes and their corresponding salt values. In order to enhance the dynamics and security of the first key generation, a random salt value is introduced into the PBKDF algorithm.

[0114] The salt values ​​corresponding to the multiple first verification codes are the same single salt value, or are independent salt values ​​corresponding to the multiple first verification codes.

[0115] Single salt value mode:

[0116] Using a single random salt value, all first verification codes share:

[0117] 0Ki=PBKDF(VC(i),salt);

[0118] The single salt value mode is more suitable for scenarios with relatively low security requirements.

[0119] Independent salt value mode:

[0120] Generate an independent random salt value salt(i) for each first verification code:

[0121] 0Ki=PBKDF(VC(i),salt(i));

[0122] The independent salt value mode is more suitable for high-security scenarios.

[0123] Of course, it should be noted that these independent salt values ​​may be different, or some independent salt values ​​may be the same, and other independent salt values ​​may be different.

[0124] The introduction of random salt value is dynamic, making key generation more secure and preventing brute force cracking. The implementation degree of single salt value mode and independent salt value mode can be different. Single salt value and independent salt value mode are supported, and the choice of salt value mode complexity can be adjusted according to security requirements, which is more flexible.

[0125] The service side sends a plurality of sub-ciphertext data and a plurality of second verification codes to the client, including: sending a plurality of sub-ciphertext data, a plurality of second verification codes and respective corresponding salt values ​​to the client.

[0126] Based on the above method steps, the data processing method on the service side also includes:

[0127] S111: The service side receives a data transmission request from one or more clients.

[0128] In the case of one client, the service side can send multiple sub-ciphertext data and multiple second verification codes to the client. The client may receive multiple sub-ciphertext data and second verification codes at the same time, or may receive multiple sub-ciphertext data and second verification codes in different time periods. The number of multiple sub-ciphertext data and the number of second verification codes received by the client may be less than or equal to the number of corresponding sub-ciphertext data and second verification codes sent by the service side.

[0129] The number of clients may be multiple, and the following takes three clients, that is, the third number is 3, as an example for explanation:

[0130] S112: The service side divides the plurality of sub-ciphertext data into a third number of sub-ciphertext data packets, each of which includes one or more sub-ciphertext data; wherein the third number is multiple. For example, the third number is 3, and the service side divides the plurality of sub-ciphertext data into 3 sub-ciphertext data packets, each of which includes at least one sub-ciphertext data.

[0131] S113: The service side divides the multiple second verification codes into a third number of verification code data packets, each of which includes one or more second verification codes.

[0132] As mentioned above, the third number is 3, and the service side divides the multiple second verification codes into 3 verification code data packets, each of which includes at least one second verification code. It should be noted that if a sub-ciphertext data packet includes two sub-ciphertext data S1 and S2, then the verification code in at least one verification code data packet includes at least two second verification codes corresponding to S1 and S2, respectively.

[0133] S114: The service side sends each sub-ciphertext data packet and each verification code data packet corresponding to each sub-ciphertext data packet to a third number of clients respectively.

[0134] For example, the service side sends the first sub-ciphertext data packet and the first verification code data packet corresponding to the first sub-ciphertext reception packet to the first client, sends the second sub-ciphertext data packet and the second verification code data packet corresponding to the second sub-ciphertext reception packet to the second client, and sends the third sub-ciphertext data packet and the third verification code data packet corresponding to the third sub-ciphertext reception packet to the third client.

[0135] If one of the three clients is a target client, the first sub-plaintext data obtained by the other two clients can be concentrated on the target client, wherein the three clients can communicate with each other, or the target client among the clients can communicate with the other two clients.

[0136] For example, the three clients are the target client (the first client), the second client, and the third client. The third client can send the first sub-plaintext data it obtains to the second client, and then the second client sends the first sub-plaintext data it obtains and the first sub-plaintext data received from the third client to the target client. Alternatively, the third client can directly send the first sub-plaintext data it obtains to the target client, and the second client can also directly send the first sub-plaintext data it obtains to the target client.

[0137] The above implementation method has also realized the distributed collaboration of various clients and can be better applied to distributed systems.

[0138] In some possible exemplary embodiments, the method further includes:

[0139] The service side receives a data transmission request from the client, where the data transmission request is used to request transmission of the second plaintext data.

[0140] The service side sends the second ciphertext data to the client, wherein the second ciphertext data is data obtained by encrypting the second plaintext data based on the first plaintext data. The first plaintext data is the plaintext of the data encryption key, and the service side sends the second ciphertext data to the client, so that the client can decrypt the second ciphertext data to obtain the second plaintext after receiving the second ciphertext data.

[0141] In some embodiments, the second plaintext data can be used by the client to decrypt the backed-up third ciphertext data to restore the third plaintext data, and the third ciphertext data is stored on the service side or the client.

[0142] For example, the third plaintext data is the backup data, the second plaintext data is the first temporary key, the first temporary key is used to encrypt the backup data, the first plaintext data is the second temporary key, and the second plaintext data is the key encrypted by the first plaintext data. That is, the service side can encrypt the first temporary key by the second temporary key, and the service side can disperse the second temporary key into a first number of multiple subkeys, and the second temporary key can be restored by any second number of multiple subkeys. So that the client can decrypt the second ciphertext data by the restored second temporary key to obtain the first temporary key, and then decrypt the third ciphertext data by the first temporary key to restore the third plaintext data, that is, restore the backup data.

[0143] The third ciphertext data may be stored on the service side or the client. When the third ciphertext data is stored on the service side, the service side may send the third ciphertext data to the client for decryption by the client. When the third ciphertext data is stored on the client, the client may obtain the third ciphertext data by calling to decrypt the third ciphertext data.

[0144] The present application also discloses a data processing method applied to a client. Figure 2 , methods include:

[0145] S210: The client receives at least a second number of second verification codes and sub-ciphertext data from the service side; wherein the service side sends a first number of sub-ciphertext data and second verification codes to the client, and the second number is less than or equal to the first number.

[0146] Exemplarily, the client can collect the second verification code and the sub-ciphertext data. The client can receive at least a second number of second verification codes from the service side. As mentioned above, the first number can be n, and the second number can be m less than n, where m is a threshold value. That is, the client can recover the complete first plaintext data through the m second verification codes and the m sub-ciphertext data corresponding to each of them.

[0147] S220: The client parses each of the second verification codes to separate at least a second number of index numbers and associated first verification codes; wherein the index numbers are used to determine a corresponding relationship between the second key and the sub-ciphertext data.

[0148] Exemplarily, the client can separate the index number and the first verification code. The client can separate the index number i corresponding to the second verification code and the content of the first verification code corresponding to the index number by parsing each second verification code received by the client. The index number is used to determine the correspondence between the second key and the sub-ciphertext data.

[0149] For example, the index number 1 and the verification code ABC123 are extracted from VC(1)="1-ABC123".

[0150] The advantage is that the service side has embedded the index number in the first verification code to obtain the second verification code. Therefore, the client does not need to maintain a complex mapping relationship, which simplifies the client operation.

[0151] S230: The client generates at least a second number of corresponding second keys according to at least a second number of the first verification codes.

[0152] Exemplarily, the client may generate a key. For example, the client may generate at least a second number of responsive second keys K2i according to at least a second number of first verification codes according to the PBKDF algorithm, and the second key K2i may be expressed as:

[0153] K2i=PBKDF(VC(i)).

[0154] The specific generation principle of the second key is the same as the principle of generating the first key on the service side, which will not be repeated here.

[0155] S240: The client uses at least a second number of second keys to decrypt the sub-ciphertext data corresponding to the index number associated with the first verification code to obtain at least a second number of corresponding first sub-plaintext data.

[0156] Exemplarily, the client can decrypt the sub-ciphertext data. For example, the client uses the generated second key to decrypt the sub-ciphertext data corresponding to the index number associated with the first verification code to obtain at least a second amount of corresponding first sub-plaintext data Si, Si=Decrypt(K2i,Ci).

[0157] S250: The client recovers the first plaintext data using at least the second amount of the first sub-plaintext data.

[0158] The client can recover the first plaintext data. The client uses a threshold cryptography algorithm to recover the first plaintext data S by decrypting at least m first sub-plaintext data:

[0159] S=Combine(S1,S2,...,Sm).

[0160] The client only needs to collect part of the second verification code and sub-ciphertext data to recover the complete first plaintext data, which improves the fault tolerance of the system.

[0161] In some embodiments, the data processing method of the client further includes:

[0162] S211: One or more clients send a data transmission request to the service side. The data transmission request may be a request to restore the backed-up data or a request to transmit other data.

[0163] In case of the third number of clients:

[0164] S212: Each client receives a sub-ciphertext data packet, wherein each sub-ciphertext data packet includes one or more sub-ciphertext data, that is, each sub-ciphertext data packet includes at least one sub-ciphertext data.

[0165] S213: Each client receives a verification code data packet, wherein each verification code data packet includes one or more second verification codes corresponding to the sub-ciphertext data in the sub-ciphertext data packet.

[0166] As mentioned above, the third number is 3, and the three clients receive a sub-ciphertext data packet and a verification code data packet respectively. If a client receives a sub-ciphertext data packet including two sub-ciphertext data S1 and S2, the client may also receive a verification code data packet including at least two second verification codes corresponding to S1 and S2 respectively.

[0167] S214: Each client collects the first sub-plaintext data obtained by each client to a target client.

[0168] For example, the first client receives the first sub-ciphertext data packet and the first verification code data packet corresponding to the first sub-ciphertext reception packet, the second client receives the second sub-ciphertext data packet and the second verification code data packet corresponding to the second sub-ciphertext reception packet, and the third client receives the third sub-ciphertext data packet and the third verification code data packet corresponding to the third sub-ciphertext reception packet.

[0169] One of the three clients is a target client, and the other two clients can concentrate their respective first sub-plaintext data to the target client, wherein the three clients can communicate with each other, or the target client among the clients can communicate with the other two clients.

[0170] S215: The target client restores the second amount of first sub-plaintext data to obtain first plaintext data.

[0171] The target client may collect at least a second amount of the first sub-plaintext data, and then based on threshold cryptography, recover the first plaintext data using at least the second amount of the first sub-plaintext data.

[0172] In some embodiments, when the third number of clients are able to communicate with each other, the clients other than the target client can send the first sub-plaintext data they have recovered to the target client through other clients. For example, the three clients are the target client (the first client), the second client, and the third client. The third client can send the first sub-plaintext data it has obtained to the second client, and then the second client sends the first sub-plaintext data it has obtained and the first sub-plaintext data received from the third client to the target client.

[0173] Alternatively, when the target client can communicate with other clients, other clients can send the first sub-plaintext data they have recovered to the target client. For example, the third client can directly send the first sub-plaintext data it has obtained to the target client, and the second client can also directly send the first sub-plaintext data it has obtained to the target client.

[0174] In some embodiments, the data processing method applied to the client further includes:

[0175] The client sends a data transmission request to the service side, and the data transmission request is used to request the transmission of the second plaintext data. After receiving the above data transmission request, the service side can send the second ciphertext data to the client, wherein the second ciphertext data is the encrypted data of the second plaintext data. In addition, the service side can also send at least a second number of second verification codes and sub-ciphertext data to the client in response to the data transmission request.

[0176] The client receives the second ciphertext data from the service side, and uses the recovered first plaintext data to decrypt the second ciphertext data to obtain the second plaintext data. Here, the first plaintext data can be understood as an encrypted key. The client first recovers the key to obtain the second ciphertext data, and then decrypts the second ciphertext data using the key to obtain the second plaintext data.

[0177] In some embodiments, the data processing method applied to the client further includes:

[0178] The client obtains the backed-up third ciphertext data from the service side or the client.

[0179] That is, the third ciphertext data can be stored on the service side or on the client side. In the case where the third ciphertext is stored on the service side, the client can obtain the backed-up third ciphertext data from the service side. In the case where the third ciphertext is stored on the client side, the client can obtain the backed-up third ciphertext data from the client side. Here, if there is only one client, the client can obtain the third ciphertext data from its own location where the third ciphertext data is stored. In the case where there are multiple clients and the third ciphertext data is stored on other clients, data can be exchanged between the clients, the third ciphertext can be stored on other clients, and the client that wants to decrypt the third ciphertext data can obtain the third ciphertext data from other clients.

[0180] The client uses the second plaintext data to decrypt the third ciphertext data to obtain restored third plaintext data.

[0181] For example, the third plaintext data is the backup data, the second plaintext data is the first temporary key, the first temporary key is used to encrypt the backup data, the first plaintext data is the second temporary key, and the second plaintext data is the key encrypted by the first plaintext data. As mentioned above, the service side can encrypt the first temporary key by the second temporary key, and the service side can disperse the second temporary key into a first number of multiple subkeys, and the second temporary key can be restored by any second number of multiple subkeys. The client can decrypt the second ciphertext data by the restored second temporary key to obtain the first temporary key, and then decrypt the third ciphertext data by the first temporary key to restore the third plaintext data, that is, restore the backup data.

[0182] The present application also provides a service side, combined with Figure 3 , the service side includes:

[0183] At least one first processor disperses first plaintext data into a first number of multiple sub-plaintext data, wherein the first plaintext data can be recovered by any second number of sub-plaintext data, and the second number is less than or equal to the first number; generates multiple first verification codes corresponding to each sub-plaintext data; generates multiple first keys based on the multiple first verification codes; uses the multiple first keys to encrypt the multiple sub-plaintext data corresponding to each first key to obtain multiple sub-ciphertext data; embeds multiple index numbers corresponding to each of the multiple sub-plaintext data into the corresponding multiple first verification codes to obtain multiple second verification codes; wherein the multiple index numbers are used by the client to determine the correspondence between the second key and the multiple sub-ciphertext data when recovering data, and the second key is used to decrypt the sub-ciphertext data corresponding to the second key; sends the multiple sub-ciphertext data and the multiple second verification codes to the client.

[0184] The present application also provides a client, combined with Figure 4 , the client includes:

[0185] At least one second processor receives at least a second number of second verification codes and sub-ciphertext data from a service side; wherein the service side sends a first number of sub-ciphertext data and second verification codes to a client, and the second number is less than or equal to the first number; parses each of the second verification codes to separate at least a second number of index numbers and associated first verification codes; wherein the index number is used to determine the correspondence between a second key and the sub-ciphertext data; generates at least a second number of responses of the second key based on at least a second number of the first verification codes; uses at least a second number of the second keys to decrypt the sub-ciphertext data corresponding to the index number associated with the first verification code to obtain at least a second number of responses of the first sub-plaintext data; and recovers the first plaintext data through at least a second number of the first sub-plaintext data.

[0186] An embodiment of the present application also provides a storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, a method as described in any one of the above embodiments is implemented.

[0187] The embodiments of the present application also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of any one of the methods described in the embodiments of the present application.

[0188] It should be noted that the computer storage medium of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access storage medium (RAM), a read-only storage medium (ROM), an erasable programmable read-only storage medium (EPROM or flash memory), an optical fiber, a portable compact disk read-only storage medium (CD-ROM), an optical storage medium, a magnetic storage medium, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program configured to be used by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, antenna, optical cable, RF, etc., or any suitable combination of the above.

[0189] Multiple embodiments of the present application are described in detail above, but the present application is not limited to these specific embodiments. Those skilled in the art can make various variations and modifications to the embodiments based on the concept of the present application, and these variations and modifications should all fall within the scope of protection required by the present application.

Claims

1. A data processing method, characterized in that: Applied to the service side, including: Dispersing the first plaintext data into a first number of multiple sub-plaintext data, wherein the first plaintext data can be restored by any second number of sub-plaintext data, and the second number is less than or equal to the first number; Generate a plurality of first verification codes respectively corresponding to each sub-plaintext data; Generate a plurality of first keys based on the plurality of first verification codes respectively; Using the multiple first keys, encrypt the multiple sub-plaintext data corresponding to the respective first keys to obtain multiple sub-ciphertext data; Embedding a plurality of index numbers corresponding to the plurality of sub-plaintext data into the corresponding plurality of first verification codes respectively to obtain a plurality of second verification codes, wherein the plurality of index numbers are used by the client to determine the correspondence between the second key and the plurality of sub-ciphertext data when performing data recovery, and the second key is used to decrypt the sub-ciphertext data corresponding to the second key; The plurality of sub-ciphertext data and the plurality of second verification codes are sent to the client.

2. The method according to claim 1, characterized in that: The first verification code corresponding to any sub-plaintext data is unique and is a randomly generated dynamic value.

3. The method according to any one of claims 1 to 2, characterized in that: Generating a plurality of first keys based on the plurality of first verification codes respectively includes: Based on the plurality of first verification codes and the respective corresponding salt values, a plurality of first keys are generated respectively; The salt values ​​corresponding to the plurality of first verification codes are the same single salt value, or are independent salt values ​​corresponding to the respective first verification codes; Sending the plurality of sub-ciphertext data and the plurality of second verification codes to the client includes: sending the plurality of sub-ciphertext data, the plurality of second verification codes, and respective corresponding salt values ​​to the client.

4. The method according to claim 1, characterized in that: The method further comprises: receiving data transfer requests from one or more clients; When the number of clients is the third number: Dividing the plurality of sub-ciphertext data into a third number of sub-ciphertext data packets, each of the sub-ciphertext data packets including one or more of the sub-ciphertext data; wherein the third number is a plurality; Divide the plurality of second verification codes into a third number of verification code data packets, each of the verification code data packets including one or more of the second verification codes; Sending each sub-ciphertext data packet and each verification code data packet corresponding to each sub-ciphertext data packet to a third number of the clients respectively; Centralize the first sub-plaintext data obtained by each of the clients to a target client; wherein the third number of clients are capable of communicating with each other, or The target client among the clients can communicate with each of the other clients.

5. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Receiving a data transmission request from a client, wherein the data transmission request is used to request transmission of second plaintext data; Sending second ciphertext data to the client, wherein the second ciphertext data is data obtained by encrypting second plaintext data based on the first plaintext data.

6. The method according to claim 5, characterized in that The second plaintext data can be used by the client to decrypt the backed-up third ciphertext data to restore the third plaintext data, and the third ciphertext data is stored on the service side or the client.

7. A data processing method, characterized in that: Applied to a client, the method comprises: Receiving at least a second number of second verification codes and sub-ciphertext data from the service side; wherein the service side sends a first number of sub-ciphertext data and second verification codes to the client, and the second number is less than or equal to the first number; Parsing each of the second verification codes to separate at least a second number of index numbers and associated first verification codes; wherein the index numbers are used to determine a corresponding relationship between the second key and the sub-ciphertext data; generating at least a second number of corresponding second keys according to at least a second number of the first verification codes; decrypting the sub-ciphertext data corresponding to the index number associated with the first verification code using at least a second number of the second keys to obtain at least a second number of corresponding first sub-plaintext data; The first plaintext data is restored by using at least a second amount of the first sub-plaintext data.

8. The data processing method according to claim 7, characterized in that: One or more of the clients sends a data transmission request to the service side; When the number of clients is the third number: Each of the clients receives a sub-ciphertext data packet, wherein each of the sub-ciphertext data packets includes one or more sub-ciphertext data; Each of the clients receives a verification code data packet, wherein each of the verification code data packets includes one or more of the second verification codes corresponding to the sub-ciphertext data in the sub-ciphertext data packet; Each of the clients collects the first plaintext sub-data obtained by each client to a target client; The target client restores the second amount of the first sub-plaintext data to obtain the first plaintext data.

9. The data processing method according to claim 8, characterized in that: When the third number of clients are able to communicate with each other, the clients other than the target client can send the first sub-plaintext data recovered by them to the target client through other clients; or, In the case where the target client can communicate with other clients, other clients can send the first sub-plaintext data they have restored to the target client.

10. The data processing method according to any one of claims 7 to 9, characterized in that: The method further comprises: Sending a data transmission request to the service side, where the data transmission request is used to request transmission of the second plaintext data; Receiving second ciphertext data from the service side; Decrypt the second ciphertext data using the restored first plaintext data to obtain second plaintext data; The at least second number of second verification codes and sub-ciphertext data are sent by the service side to the client in response to the data transmission request.

11. The method according to claim 10, characterized in that The method further comprises: Obtaining the backed-up third ciphertext data from the service side or the client; The third ciphertext data is decrypted using the second plaintext data to obtain restored third plaintext data.

12. A service side, characterized in that: include: At least one first processor disperses first plaintext data into a first number of multiple sub-plaintext data, wherein the first plaintext data can be recovered by any second number of sub-plaintext data, and the second number is less than or equal to the first number; generates multiple first verification codes corresponding to each sub-plaintext data; generates multiple first keys based on the multiple first verification codes; uses the multiple first keys to encrypt the multiple sub-plaintext data corresponding to each first key to obtain multiple sub-ciphertext data; embeds multiple index numbers corresponding to each of the multiple sub-plaintext data into the corresponding multiple first verification codes to obtain multiple second verification codes; wherein the multiple index numbers are used by the client to determine the correspondence between the second key and the multiple sub-ciphertext data when recovering data, and the second key is used to decrypt the sub-ciphertext data corresponding to the second key; sends the multiple sub-ciphertext data and the multiple second verification codes to the client.

13. A client, characterized in that: include: At least one second processor receives at least a second number of second verification codes and sub-ciphertext data from a service side; wherein the service side sends a first number of sub-ciphertext data and second verification codes to a client, and the second number is less than or equal to the first number; parses each of the second verification codes to separate at least a second number of index numbers and associated first verification codes; wherein the index number is used to determine the correspondence between a second key and the sub-ciphertext data; generates at least a second number of responses of the second key based on at least a second number of the first verification codes; uses at least a second number of the second keys to decrypt the sub-ciphertext data corresponding to the index number associated with the first verification code to obtain at least a second number of responses of the first sub-plaintext data; and recovers the first plaintext data through at least a second number of the first sub-plaintext data.

14. A storage medium, characterized in that: A computer program / instruction is stored thereon, and when the computer program / instruction is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

15. A computer program product, characterized in that The method comprises a computer program / instruction which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 11.

Images