Front-end storage encryption method and device

Abstract

The embodiment of the invention provides a front-end storage encryption method and device, and the method comprises the steps: carrying out the differential privacy fusion operation of user behavior data and system environment parameters, obtaining initial secret key generation data, training a random forest model through the initial secret key generation data, obtaining a dynamic secret key generation model and a dynamic secret key outputted by the model, and carrying out the encryption of the dynamic secret key. Encrypting initial page data of the front-end application according to the dynamic key; after encryption, the dynamic key is segmented according to a key segmentation algorithm and stored in different nodes respectively, and distributed dynamic key storage nodes are determined; when a specific event occurs, a sub-key obtaining request is sent to a distributed dynamic key storage node to obtain an original dynamic key for decryption, then the original dynamic key is updated according to user behavior data and system environment parameters corresponding to the specific event, and encryption is performed according to the updated dynamic key, so that dynamic encryption is realized. According to the invention, the efficiency and security of front-end data storage can be improved.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a front-end storage encryption method and device. Background Art

[0002] In modern Web (webpage) development, the use of front-end caching technology is becoming more and more common, especially the browser's localStorageAPI (permanent storage interface) and sessionStorageAPI (temporary storage interface). They provide applications with convenient data storage solutions, which can cache the data returned by the backend on the client side to improve user experience and application performance.

[0003] However, these storage mechanisms also bring challenges to data security and privacy protection. Most front-end applications on the market currently store sensitive data in plain text when using localStorageAPI and sessionStorageAPI. This allows attackers to easily access and steal this data through the browser's developer tools. In response to the above problems, the common solution relies on static keys. After receiving the data returned by the backend through the browser development script (JavaScript), the returned data is encrypted through AES (symmetric encryption algorithm) and temporarily stored in the cache. The script is decrypted and retrieved when it is used, so that the data cached by the client browser is encrypted without affecting the use in the code logic.

[0004] However, static encryption relies too much on keys. Once the keys are stolen, attackers can decrypt data without authentication. Therefore, how to enhance the security of data storage in the Web on a user-friendly basis, always protect user privacy and improve user experience is an urgent problem to be solved in web development. Summary of the invention

[0005] In response to the problems in the prior art, the present application provides a front-end storage encryption method and device, which can improve the efficiency and security of front-end data storage.

[0006] In order to solve at least one of the above problems, the present application provides the following technical solutions:

[0007] In a first aspect, the present application provides a front-end storage encryption method, comprising:

[0008] After obtaining the user information access authorization, the front-end application monitors the user, performs a differential privacy fusion operation on the user behavior data and system environment parameters obtained after the monitoring operation, determines the corresponding initial key generation data, inputs the initial key generation data as a model training set into a preset random forest model for model training, obtains a dynamic key generation model, inputs the initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model, obtains the dynamic key output by the dynamic key generation model, performs an encryption operation on the initial page data of the front-end application according to the dynamic key, determines the corresponding initial encrypted data, and stores the decryption information corresponding to the initial encrypted data in the form of a key-value pair to determine the corresponding key name;

[0009] Performing a split operation on the dynamic key according to a preset key splitting algorithm to determine a corresponding plurality of dynamic key fragments, and performing storage operations on the plurality of dynamic key fragments according to preset storage nodes to determine corresponding distributed dynamic key storage nodes;

[0010] The front-end application is listened to according to the preset specific event listener to determine whether a specific event occurs in the front-end application; if so, the initial encrypted data is decrypted according to the distributed dynamic key storage node and the key name to obtain the initial page data; the initial page data is modified according to the page modification data corresponding to the specific event to determine the corresponding updated page data; a dynamic key update operation is performed according to the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key; and the updated page data is encrypted according to the updated dynamic key to determine the corresponding updated encrypted data, wherein the preset specific event includes at least one of the front-end application page startup and the front-end application page refresh.

[0011] Furthermore, performing a differential privacy fusion operation on the user behavior data and system environment parameters obtained after the monitoring operation to determine the corresponding initial key generation data includes:

[0012] Performing a differential privacy protection operation on the user behavior data obtained after the monitoring operation according to a preset utility function to determine corresponding fuzzy user behavior data;

[0013] A data fusion operation is performed on the fuzzy user behavior data and the system environment parameters obtained after the monitoring operation to determine corresponding initial key generation data.

[0014] Furthermore, performing a differential privacy protection operation on the user behavior data obtained after the monitoring operation according to a preset utility function to determine the corresponding fuzzy user behavior data includes:

[0015] Performing a utility evaluation operation on the user behavior data obtained after the monitoring operation according to a preset utility function to determine a corresponding utility evaluation result, wherein the utility evaluation result is used to indicate the degree of influence of the user behavior data on the result;

[0016] A noise adding operation is performed on the user behavior data according to the utility evaluation result and the preset privacy loss to determine the corresponding fuzzy user behavior data, wherein the preset privacy loss is used to evaluate the impact of the introduced noise on the privacy information.

[0017] Furthermore, the splitting operation of the dynamic key according to a preset key splitting algorithm to determine the corresponding multiple dynamic key fragments includes:

[0018] Performing a polynomial construction operation according to the dynamic key, a preset share, and a preset threshold value to determine a corresponding segmentation polynomial, wherein the preset share is used to determine the number of dynamic key fragments, the preset threshold value is used to reconstruct the polynomial, and the preset threshold value is less than the preset share;

[0019] The dynamic key is split according to the split polynomial to determine a corresponding plurality of dynamic key fragments.

[0020] Further, the determining whether a specific event occurs in the front-end application, if so, decrypting the initial encrypted data according to the distributed dynamic key storage node and the key name to obtain the initial page data, includes:

[0021] Determine whether a specific event occurs in the front-end application, and if so, send a subkey provision request to the distributed dynamic key storage node to determine the corresponding multiple subkeys;

[0022] A dynamic key restoration operation is performed according to the multiple subkeys, and the initial encrypted data is decrypted according to the dynamic key and the key name obtained after the restoration operation to obtain the initial page data.

[0023] Furthermore, the initial key generation data is input as a model training set into a preset random forest model for model training to obtain a dynamic key generation model, and the initial real-time user behavior data and real-time system environment parameters are input into the dynamic key generation model to obtain a dynamic key output by the dynamic key generation model, including:

[0024] The initial key generation data is input into a preset random forest model as a model training set, and the model is trained according to a cross-validation algorithm to obtain a corresponding dynamic key generation model;

[0025] Initial real-time user behavior data and real-time system environment parameters are received, and the initial real-time user behavior data and the real-time system environment parameters are input into the dynamic key generation model to obtain a dynamic key output by the dynamic key generation model.

[0026] Furthermore, the monitoring operation of the user by the front-end application includes:

[0027] Perform obfuscation operation on the visualization embedding algorithm according to the preset code obfuscation rules to determine the corresponding obfuscated visualization embedding algorithm;

[0028] The user is monitored according to the obfuscated visualization tracking algorithm.

[0029] In a second aspect, the present application provides a front-end storage encryption device, comprising:

[0030] A dynamic key generation module is used to, after obtaining user information access authorization, perform a monitoring operation on the user in the front-end application, perform a differential privacy fusion operation on the user behavior data and system environment parameters obtained after the monitoring operation, determine the corresponding initial key generation data, input the initial key generation data as a model training set into a preset random forest model for model training, obtain a dynamic key generation model, input the initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model, obtain the dynamic key output by the dynamic key generation model, perform an encryption operation on the initial page data of the front-end application according to the dynamic key, determine the corresponding initial encrypted data, and store the decryption information corresponding to the initial encrypted data in the form of a key-value pair to determine the corresponding key name;

[0031] A dynamic key distribution storage module, used to perform a split operation on the dynamic key according to a preset key splitting algorithm, determine a corresponding plurality of dynamic key fragments, perform storage operations on the plurality of dynamic key fragments respectively according to preset storage nodes, and determine a corresponding distributed dynamic key storage node;

[0032] A dynamic key update module is used to listen to the front-end application according to a preset specific event listener to determine whether a specific event occurs in the front-end application; if so, decrypt the initial encrypted data according to the distributed dynamic key storage node and the key name to obtain the initial page data; modify the initial page data according to the page modification data corresponding to the specific event to determine the corresponding updated page data; perform a dynamic key update operation according to the user behavior data and the environmental parameters corresponding to the specific event to determine the corresponding updated dynamic key; and encrypt the updated page data according to the updated dynamic key to determine the corresponding updated encrypted data, wherein the preset specific event includes at least one of the front-end application page startup and the front-end application page refresh.

[0033] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the front-end storage encryption method when executing the program.

[0034] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the front-end storage encryption method when executed by a processor.

[0035] In a fifth aspect, the present application provides a computer program product, including a computer program / instruction, which implements the steps of the front-end storage encryption method when executed by a processor.

[0036] It can be seen from the above technical scheme that the present application provides a front-end storage encryption method and device, which obtains initial key generation data by performing differential privacy fusion operations on user behavior data and system environment parameters, and uses the initial key generation data to train a random forest model to obtain a dynamic key generation model and a dynamic key output by the model, and encrypts the initial page data of the front-end application according to the dynamic key; after encryption, the dynamic key is split according to the key splitting algorithm and stored in different nodes respectively, and a distributed dynamic key storage node is determined; when a specific event occurs, a subkey acquisition request is sent to the distributed dynamic key storage node to obtain the original dynamic key for decryption, and then the original dynamic key is updated according to the user behavior data and system environment parameters corresponding to the specific event, and encrypted again according to the updated dynamic key, so as to achieve dynamic encryption, thereby improving the efficiency and security of front-end data storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0038] Figure 1 This is one of the flow charts of the front-end storage encryption method in the embodiment of the present application;

[0039] Figure 2 This is the second flow chart of the front-end storage encryption method in the embodiment of the present application;

[0040] Figure 3 This is a third flow chart of the front-end storage encryption method in an embodiment of the present application;

[0041] Figure 4 This is a fourth flow chart of the front-end storage encryption method in an embodiment of the present application;

[0042] Figure 5 This is a fifth flow chart of the front-end storage encryption method in the embodiment of the present application;

[0043] Figure 6 This is a sixth flow chart of the front-end storage encryption method in an embodiment of the present application;

[0044] Figure 7 FIG7 is a flow chart of the front-end storage encryption method in the embodiment of the present application;

[0045] Figure 8 It is a structural diagram of the front-end storage encryption device in the embodiment of the present application;

[0046] Fig. 9 It is a schematic diagram of the structure of an electronic device in an embodiment of the present application.

[0047] Reference numerals:

[0048] Electronic device 9600, central processing unit 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage unit 9142, data storage unit 9143, driver program storage unit 9144, antenna 9111, speaker 9131, microphone 9132. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0050] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0051] Considering that the existing static encryption method is too dependent on keys, once the keys are stolen, the data is at risk of being illegally read. The present application provides a front-end storage encryption method and device, which performs differential privacy fusion operations on user behavior data and system environment parameters to obtain initial key generation data, uses the initial key generation data to train a random forest model, obtains a dynamic key generation model and a dynamic key output by the model, and encrypts the initial page data of the front-end application according to the dynamic key; after encryption, the dynamic key is split according to the key splitting algorithm and stored in different nodes respectively, and a distributed dynamic key storage node is determined; when a specific event occurs, a subkey acquisition request is sent to the distributed dynamic key storage node to obtain the original dynamic key for decryption, and then the original dynamic key is updated according to the user behavior data and system environment parameters corresponding to the specific event, and then encrypted again according to the updated dynamic key, so as to achieve dynamic encryption, thereby improving the efficiency and security of front-end data storage.

[0052] In order to improve the efficiency and security of front-end data storage, the present application provides an embodiment of a front-end storage encryption method, see Figure 1 , the front-end storage encryption method specifically includes the following contents:

[0053] Step S101: After obtaining the user information access authorization, the front-end application performs a monitoring operation on the user, performs a differential privacy fusion operation on the user behavior data and system environment parameters obtained after the monitoring operation, determines the corresponding initial key generation data, inputs the initial key generation data as a model training set into a preset random forest model for model training, obtains a dynamic key generation model, inputs the initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model, obtains the dynamic key output by the dynamic key generation model, performs an encryption operation on the initial page data of the front-end application according to the dynamic key, determines the corresponding initial encrypted data, and stores the decryption information corresponding to the initial encrypted data in the form of a key-value pair to determine the corresponding key name;

[0054] Optionally, in this embodiment, the purpose of this step is to automatically generate a customized dynamic key based on the user behavior data and system environment parameter usage model, and encrypt the user data of the front-end application according to the dynamic key to ensure that the dynamic key is unpredictable.

[0055] Optionally, the information acquisition in this embodiment is based on obtaining user authorization; the methods of obtaining authorization include: pop-up window inquiry, red text reminder, vibration reminder, etc. When the information is acquired, the user will be informed of the information acquisition method and usage scope.

[0056] Optionally, in this embodiment, after obtaining the user's information authorization, the front-end monitoring visualization tracking technology is used to perform the monitoring operation.

[0057] Specifically, the visual tracking technology does not require developers to write code, which greatly reduces the technical burden. Developers only need to define tracking events and add tracking points on the preset visual tracking platform.

[0058] More specifically, in the process of visual tracking, code obfuscation technology is used to obfuscate the visual tracking algorithm so that it is unrecognizable to external attackers. The obfuscated algorithm can still perform the original monitoring function, but it is difficult for attackers to reverse understand and use it. Preferably, code obfuscation makes the code difficult to understand by modifying the structure, naming and logic of the code, for example, renaming variables and flattening the control flow.

[0059] It is understandable that hiding the front-end monitoring operation can improve the security of the system, prevent malicious attackers from discovering the monitoring mechanism, and ensure the concealment of the monitoring process.

[0060] Optionally, the monitoring process collects user behavior data and system environment parameters. User behavior data includes click behavior, input behavior, browsing history, mouse track, interaction frequency, user behavior pattern, etc. System environment parameters include device information, network information, geographic location, time information, environmental noise or physical sensor data, etc. The collection of these data can provide data support for subsequent encryption and key generation.

[0061] Optionally, in this embodiment, a differential privacy fusion operation is performed on the user behavior data and system environment parameters obtained after the monitoring operation to determine the corresponding initial key generation data.

[0062] Because user behavior data is quite private, a differential privacy algorithm is used to protect user behavior data. In terms of effect, differential privacy can effectively prevent the behavior of individual users in the data from being directly identified, and at the same time, the dynamic keys generated based on user behavior data have a high degree of unpredictable security.

[0063] Specifically, differential privacy fusion first performs differential privacy protection on user behavior data. By fuzzifying the data, it ensures that no sensitive information of any individual user is leaked when collecting and analyzing user data. The blurred user behavior data is then fused with system environment parameters to generate appropriate "initial key generation data" for training subsequent key generation models.

[0064] More specifically, differential privacy protection adds noise to the original data so that the analysis results of the data are not affected while minimizing the chance of identifying individual data.

[0065] First, differential privacy protection requires the definition of a utility function, which is used to evaluate the sensitivity of user behavior data. Sensitivity is a measure of the impact of a single data item (such as a user's behavior data) on the query results. The greater the sensitivity, the higher the privacy protection effect of the data. For example, for a query function f, its sensitivity is defined by calculating the difference in the results of the query function on any two adjacent data sets that differ by one data item. Specifically, for data sets D and D' (which differ only in one element), the sensitivity Δf is the maximum output difference of the query function f on adjacent data sets. Once the sensitivity is determined, the purpose of differential privacy protection can be achieved by adding noise to the query results.

[0066] Secondly, after obtaining the sensitivity, add noise to the data with the highest sensitivity. It is necessary to ensure that the noise can protect individual data from being identified, and the results of the original data are not affected by the noise. At this time, privacy loss is introduced to achieve the purpose. Privacy loss means setting a privacy budget to limit the upper limit of privacy leakage. By adjusting the privacy budget, the accuracy of data analysis and the degree of privacy protection can be balanced.

[0067] By setting a privacy budget to control the size of the noise and the strength of privacy protection, we can balance the accuracy of data analysis and the degree of privacy protection. It is understandable that a smaller privacy budget means stronger privacy protection (because the noise is greater), but it also means that the accuracy of the query results may decrease. The noise can be Laplace noise or Gaussian noise, and the choice depends on the nature of the data. For very strict privacy protection requirements, choose Laplace noise because it provides the most stringent privacy protection. For relatively loose privacy protection requirements, choose Gaussian noise because it is smoother and suitable for more complex queries.

[0068] Preferably, for this embodiment, which needs to adapt to complex data analysis or machine learning tasks, it is more appropriate to choose Gaussian noise. Through its lighter tail, it can adapt to the diversity of data, especially in the iterative optimization process. It can better control the privacy budget in multiple queries and provide smoother query results.

[0069] For example, suppose you need to analyze the frequency with which users visit different pages, but directly using these statistics may expose a certain user's access behavior.

[0070] To protect privacy, first, the average access time of all users to the page is calculated; then, the sensitivity of the query result (i.e., the maximum impact of a single user's behavior on the result) is calculated through the utility function; finally, appropriate noise (e.g., Laplace noise) is added to the average to prevent inferring the access behavior of a single user.

[0071] It can be understood that through the above-mentioned differential privacy protection operation, the user behavior data is effectively fuzzy protected to prevent the leakage of sensitive information of individual users. At the same time, it lays the foundation for the subsequent dynamic keys generated based on user behavior data to have higher security. Because specific user behavior cannot be cracked, the dynamic keys generated for specific user behavior are more secure.

[0072] More specifically, the fuzzy user behavior data and system environment parameters that have been protected by differential privacy are fused to form the "initial key generation data", that is, the model training set.

[0073] It is understandable that system environment parameters do not involve personal sensitive information, so privacy protection is not required to increase the uncertainty of the data set, but they are correlated with user behavior and are therefore still very important in model training.

[0074] In order to avoid leaking the privacy information of user behavior through system environment parameters, and at the same time not injecting additional noise and blurring the system environment parameters, the accuracy of the system environment parameters is ensured. In this embodiment, two models are trained independently in the data fusion stage, one based on user behavior data protected by differential privacy, and the other based on system environment parameters. Afterwards, a meta-learner is used to synthesize the prediction results of the two sub-models through a voting mechanism, and the output results of the two models are fused.

[0075] In terms of effect, this method can avoid exposing differentially private data directly to other models and reduce the impact of noise on the results.

[0076] Optionally, after data fusion, the fused data needs to be labeled to form a model training set. The labeling process needs to take into account the correlation between the interactive information between user behavior and system environment. The fused data will provide more contextual information, which can help to label more accurately.

[0077] Optionally, one annotation method is to annotate the data according to the strength of the generated key (such as encryption strength) so that the model can adaptively generate keys of corresponding strength according to user behavior and system environment.

[0078] Alternatively, one annotation method is to directly associate user behavior and environmental data with the generated key, and annotate the category or characteristics of the key generated under these behavior and environmental conditions. In this case, it is necessary to generate keys in advance in the training data set and record the attributes of the generated keys (such as key strength, category, etc.).

[0079] Optionally, one way to label is to label the training data with actual generated keys and user feedback (such as successful / failed authentication). That is, label the key data based on whether the key successfully prevents attacks or meets certain security requirements. At this point, a preliminary key generation system needs to be running, which can be a random generator.

[0080] It is understandable that in the task of generating dynamic keys based on user behavior and environmental parameters, the core of data annotation is to associate different user behavior data and environmental parameters with the characteristics of the key. After annotation, the "initial key generation data" can be obtained, that is, the model training set.

[0081] Optionally, in this embodiment, the initial key generation data is input as a model training set into a preset random forest model for model training to obtain a dynamic key generation model.

[0082] Specifically, the model training set obtained in the above steps is input into the input layer of the random forest model and converted into the corresponding feature vector. During the training process, the model will determine which features contribute more to the dynamic key generation based on the influence of each feature. Through the feature importance scoring algorithm, it is determined which user behavior and environmental features are most critical to the generation of the key.

[0083] During training, the K-fold cross-validation method is used to verify the generalization ability of the model to ensure that it has good adaptability to different types of user behaviors. After training, the model's hyperparameters, such as the number of trees, the maximum depth of the tree, and the minimum number of sample splits per tree, are optimized to improve the accuracy and generalization ability of the model.

[0084] When the random forest model is trained, it can be used to generate dynamic keys, which are generated based on real-time user behavior data and environmental parameters and are different each time. Preferably, in order to improve the adaptability of key generation, the model can be updated regularly to adapt to new user behavior patterns through incremental learning.

[0085] For example, if a user is active late at night and logs in from a specific region, the model might generate a time-sensitive, regional key based on these behaviors.

[0086] If a user frequently performs transactions on a specific device, the model may generate a key associated with that device based on the characteristics of that device.

[0087] If there is a significant change in the user's operating pattern (for example, from normal operation to unusual activity), the model may detect this change and generate a new key based on the change.

[0088] It is understandable that encryption keys are usually generated by some random number generation algorithm (such as a pseudo-random number generator, a hardware random number generator, etc.), which does not depend on any user behavior or system environment parameters. However, if the random number generator itself has a vulnerability or its seed is leaked, then the random key may be predicted or regenerated by an attacker.

[0089] In this embodiment, a customized dynamic key is generated based on user behavior data and system environment parameters, which is closely related to each user's behavior, device, location and other information. In terms of effect, the key can be dynamically adjusted according to the real-time behavior, so that each interaction has a different key. At the same time, the original user behavior is protected according to the differential privacy technology, and the security of the key is further prevented from being affected by the leakage of user behavior, thereby effectively preventing replay attacks and prediction of user behavior.

[0090] Optionally, in this embodiment, the initial page data of the front-end application is encrypted according to the dynamic key to determine the corresponding initial encrypted data, and the decryption information corresponding to the initial encrypted data is stored in a key-value pair to determine the corresponding key name.

[0091] Specifically, this step uses a specific dynamic key obtained through the model to encrypt the user data of the front-end application. The encrypted data will be stored permanently or temporarily based on its characteristics and stored accordingly. The corresponding decryption information is stored in the form of a key-value pair, and the key name is the identifier of the key during decryption.

[0092] Through the above steps, a specific dynamic key is successfully generated. On the basis of ensuring the privacy of user data, the security of user page data is increased, laying the foundation for the subsequent implementation of dynamic encryption.

[0093] Step S102: performing a split operation on the dynamic key according to a preset key splitting algorithm to determine a corresponding plurality of dynamic key fragments, performing storage operations on the plurality of dynamic key fragments respectively according to preset storage nodes to determine corresponding distributed dynamic key storage nodes;

[0094] Optionally, in this embodiment, the purpose of this step is to distribute and store the dynamic key obtained in step S101 to further increase the security of the dynamic key.

[0095] Specifically, Shamir's Secret Sharing algorithm is used to split the data into multiple shares and distribute them to different nodes. This process requires the construction of a split polynomial. In the polynomial, the dynamic key is a constant term, which is the secret we want to keep confidential. The polynomial is used to calculate n key fragments, and each participant will obtain a key fragment, where n is the split share. When at least t participants are united, the constant term of the polynomial, i.e., the dynamic key, can be restored by the Lagrange interpolation method, where t is the threshold value, i.e., the minimum number of fragments required to restore the original key.

[0096] Through the above splitting operation, n key fragments are obtained. Distributing and storing these key fragments in different storage nodes is more conducive to preventing intrusion and destroying the key.

[0097] Optionally, storage operations are performed on the multiple dynamic key fragments respectively according to preset storage nodes to determine corresponding distributed dynamic key storage nodes.

[0098] Specifically, storage nodes are distributed in different geographical locations, data centers or cloud systems, which can improve the security and fault tolerance of keys.

[0099] For example, nodes can be distributed in the following ways:

[0100] Physical nodes: nodes in different data centers or on different cloud platforms.

[0101] Virtual nodes: Distribute storage nodes across multiple virtual machines or containers.

[0102] Preferably, distributed storage is performed in cloud nodes and local nodes to ensure that the process of recovering dynamic keys requires the coordination of cloud and local systems, thereby increasing security.

[0103] Preferably, identical key fragment copies are stored in multiple storage nodes, so that even if some nodes are unavailable or fail, sufficient key fragments can be used to recover the key.

[0104] For example, suppose we have 5 storage nodes, the dynamic key S is divided into 5 fragments, the threshold is set to 3, and the storage nodes are allocated as follows:

[0105] Node 1, key fragment f(1), storage mode, local;

[0106] Node 2, key fragment f(2), storage method, cloud;

[0107] Node 3, key fragment f(3), storage mode, local;

[0108] Node 4, key fragment f(4), storage method, cloud;

[0109] Node 5, key fragment f(5), storage method, cloud.

[0110] Furthermore, when the data processing capability of the system is sufficient, encryption technology and a distributed storage system can be combined to ensure the security of the key fragments and encrypt the key fragments.

[0111] It can be understood that through dynamic key segmentation and distributed storage, the security of the dynamic key is further protected, making the dynamic key not easy to be cracked, thereby protecting the security of user data.

[0112] Step S103: Listen to the front-end application according to the preset specific event listener to determine whether a specific event occurs in the front-end application; if so, decrypt the initial encrypted data according to the distributed dynamic key storage node and the key name to obtain the initial page data; modify the initial page data according to the page modification data corresponding to the specific event to determine the corresponding updated page data; perform a dynamic key update operation according to the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key; encrypt the updated page data according to the updated dynamic key to determine the corresponding updated encrypted data, wherein the preset specific event includes at least one of the front-end application page startup and the front-end application page refresh.

[0113] Optionally, the purpose of this step is to implement the update of the dynamic key through a specific mode of the front-end application page, so that whenever the specific mode occurs, the dynamic key will be updated according to the real-time user behavior data and real-time system environment parameters of the current state. Even if the previous dynamic key is cracked, it cannot be applied to subsequent steps, thereby further protecting the user's data security.

[0114] Optionally, in this embodiment, a monitoring operation is performed on the front-end application according to a preset specific event listener to determine whether a specific event occurs in the front-end application.

[0115] Specifically, in a front-end application, an event listener is needed to listen to specific events, including page startup (such as when a user accesses a page) and page refresh (such as when a user refreshes a page).

[0116] Event listeners use JavaScript to listen for these events.

[0117] Optionally, in this embodiment, if it occurs, the initial encrypted data is decrypted according to the distributed dynamic key storage node and the key name to obtain the initial page data.

[0118] Specifically, when the page is started or refreshed, the system needs to decrypt the initial encrypted data according to the distributed dynamic key storage node and key name. At this time, the system starts to execute the encryption and decryption script first. This script code will try to obtain the corresponding key name from the cache. If the key name corresponds, Shamir's Secret Sharing is used to obtain the required key fragments from the distributed storage node, and these fragments are used to restore the original dynamic key. Then, the dynamic key is used to decrypt the initial encrypted data.

[0119] For example, we have 5 storage nodes, the dynamic key S is divided into 5 segments, the threshold is set to 3, and the storage nodes are allocated as follows:

[0120] Node 1, key fragment f(1), storage mode, local;

[0121] Node 2, key fragment f(2), storage method, cloud;

[0122] Node 3, key fragment f(3), storage mode, local;

[0123] Node 4, key fragment f(4), storage method, cloud;

[0124] Node 5, key fragment f(5), storage method, cloud.

[0125] In this setting, if the key needs to be recovered, it is necessary to obtain key fragments f(1), f(3), and f(4) from at least three different storage nodes (e.g., node 1, node 3, and node 4), and then use the Lagrange interpolation method to recover the key S. Use the recovered dynamic key to decrypt the initial encrypted data to obtain the original page data.

[0126] Optionally, in this embodiment, the initial page data is modified according to the page modification data corresponding to the specific event to determine the corresponding updated page data, a dynamic key update operation is performed according to the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key, and an encryption operation is performed on the updated page data according to the updated dynamic key to determine the corresponding updated encrypted data.

[0127] Specifically, when the page is refreshed or started, the page data may change. The original data is modified according to the change of the page data, and a new dynamic key is regenerated according to the trained dynamic key generation model based on the user's behavior of changing the data and the current system environment parameters. The changed page data is encrypted, and the corresponding key-value pair is regenerated and stored in the system. The encrypted new dynamic key is also distributedly stored, and the updated key name and the dynamic key fragment of the distributed storage node are used for decryption each time a specific event is subsequently monitored.

[0128] This example demonstrates how this embodiment generates specific dynamic keys based on user behavior data and system environment parameters, and then performs distributed storage of the dynamic keys to increase security, and implements encryption of user data through dynamic updates, thereby improving the efficiency and security of front-end data storage.

[0129] From the above description, it can be seen that the front-end storage encryption method provided in the embodiment of the present application can obtain initial key generation data by performing differential privacy fusion operations on user behavior data and system environment parameters, and use the initial key generation data to train the random forest model to obtain a dynamic key generation model and the dynamic key output by the model, and encrypt the initial page data of the front-end application according to the dynamic key; after encryption, the dynamic key is split according to the key splitting algorithm and stored in different nodes respectively, and the distributed dynamic key storage node is determined; when a specific event occurs, a sub-key acquisition request is sent to the distributed dynamic key storage node to obtain the original dynamic key for decryption, and then the original dynamic key is updated according to the user behavior data and system environment parameters corresponding to the specific event, and encrypted again according to the updated dynamic key, so as to achieve dynamic encryption, thereby improving the efficiency and security of front-end data storage.

[0130] In one embodiment of the front-end storage encryption method of the present application, see Figure 2 , and can also include the following:

[0131] Step S201: performing a differential privacy protection operation on the user behavior data obtained after the monitoring operation according to a preset utility function to determine corresponding fuzzy user behavior data;

[0132] Step S202: performing a data fusion operation on the fuzzy user behavior data and the system environment parameters obtained after the monitoring operation to determine corresponding initial key generation data.

[0133] Optionally, in this embodiment, a differential privacy protection operation is performed on the user behavior data obtained after the monitoring operation according to a preset utility function to determine the corresponding fuzzy user behavior data. This step performs differential privacy protection on the user behavior data so that a single user behavior in the data cannot be directly identified, while the statistical effect of the overall data set can still be achieved.

[0134] Optionally, in this embodiment, a data fusion operation is performed on the fuzzy user behavior data and the system environment parameters obtained after the monitoring operation to determine the corresponding initial key generation data.

[0135] This step fuses the privacy-protected user behavior data and the original system environment parameters to obtain the initial key generation data, i.e., the model training set, which is used for the subsequent training of the key generation model.

[0136] It is understandable that system environment parameters do not involve personal sensitive information, so privacy protection is not required to increase the uncertainty of the data set, but they are correlated with user behavior and are therefore still very important in model training.

[0137] In order to avoid leaking the privacy information of user behavior through system environment parameters, and at the same time not injecting additional noise and blurring the system environment parameters, the accuracy of the system environment parameters is ensured. In this embodiment, two models are trained independently in the data fusion stage, one based on user behavior data protected by differential privacy, and the other based on system environment parameters. Afterwards, a meta-learner is used to synthesize the prediction results of the two sub-models through a voting mechanism, and the output results of the two models are fused.

[0138] In terms of effect, this method can avoid exposing differentially private data directly to other models and reduce the impact of noise on the results.

[0139] Optionally, after data fusion, the fused data needs to be labeled to form a model training set. The labeling process needs to take into account the correlation between the interactive information between user behavior and system environment. The fused data will provide more contextual information, which can help to label more accurately.

[0140] Optionally, one annotation method is to annotate the data according to the strength of the generated key (such as encryption strength) so that the model can adaptively generate keys of corresponding strength according to user behavior and system environment.

[0141] Alternatively, one annotation method is to directly associate user behavior and environmental data with the generated key, and annotate the category or characteristics of the key generated under these behavior and environmental conditions. In this case, it is necessary to generate keys in advance in the training data set and record the attributes of the generated keys (such as key strength, category, etc.).

[0142] Optionally, one way to label is to label the training data with actual generated keys and user feedback (such as successful / failed authentication). That is, label the key data based on whether the key successfully prevents attacks or meets certain security requirements. At this point, a preliminary key generation system needs to be running, which can be a random generator.

[0143] It is understandable that in the task of generating dynamic keys based on user behavior and environmental parameters, the core of data annotation is to associate different user behavior data and environmental parameters with the characteristics of the key. After annotation, the "initial key generation data" can be obtained, that is, the model training set.

[0144] Through step S202, this embodiment obtains a model training set, laying a data foundation for subsequent training of a dynamic key generation model.

[0145] In one embodiment of the front-end storage encryption method of the present application, see Figure 3 , and can also include the following:

[0146] Step S301: performing a utility evaluation operation on the user behavior data obtained after the monitoring operation according to a preset utility function, and determining a corresponding utility evaluation result, wherein the utility evaluation result is used to indicate the degree of influence of the user behavior data on the result;

[0147] Step S302: performing a noise adding operation on the user behavior data according to the utility evaluation result and the preset privacy loss to determine the corresponding fuzzy user behavior data, wherein the preset privacy loss is used to evaluate the impact of the introduced noise on the privacy information.

[0148] Optionally, in this embodiment, the utility function is used to evaluate the sensitivity of user behavior data, and sensitivity is a measure of the impact of a single data item (such as a user's behavior data) on the query results. The greater the sensitivity, the higher the privacy protection effect of the data. For example, for a query function f, its sensitivity is defined by calculating the difference in the results of the query function on any two adjacent data sets that differ by one data item. Specifically, for data sets D and D' (which differ only in one element), the sensitivity Δf is the maximum output difference of the query function f on adjacent data sets. Once the sensitivity is determined, the purpose of differential privacy protection can be achieved by adding noise to the query results.

[0149] Secondly, after obtaining the sensitivity, add noise to the data with the highest sensitivity. It is necessary to ensure that the noise can protect individual data from being identified, and the results of the original data are not affected by the noise. At this time, privacy loss is introduced to achieve the purpose. Privacy loss means setting a privacy budget to limit the upper limit of privacy leakage. By adjusting the privacy budget, the accuracy of data analysis and the degree of privacy protection can be balanced.

[0150] By setting a privacy budget to control the size of the noise and the strength of privacy protection, we can balance the accuracy of data analysis and the degree of privacy protection. It is understandable that a smaller privacy budget means stronger privacy protection (because the noise is greater), but it also means that the accuracy of the query results may decrease. The noise can be Laplace noise or Gaussian noise, and the choice depends on the nature of the data. For very strict privacy protection requirements, choose Laplace noise because it provides the most stringent privacy protection. For relatively loose privacy protection requirements, choose Gaussian noise because it is smoother and suitable for more complex queries.

[0151] Preferably, for this embodiment, which needs to adapt to complex data analysis or machine learning tasks, it is more appropriate to choose Gaussian noise. Through its lighter tail, it can adapt to the diversity of data, especially in the iterative optimization process. It can better control the privacy budget in multiple queries and provide smoother query results.

[0152] For example, suppose you need to analyze the frequency with which users visit different pages, but directly using these statistics may expose a certain user's access behavior.

[0153] To protect privacy, first, the average access time of all users to the page is calculated; then, the sensitivity of the query result (i.e., the maximum impact of a single user's behavior on the result) is calculated through the utility function; finally, appropriate noise (e.g., Laplace noise) is added to the average to prevent inferring the access behavior of a single user.

[0154] It can be understood that through the above-mentioned differential privacy protection operation, the user behavior data is effectively fuzzy protected to prevent the leakage of sensitive information of individual users. At the same time, it lays the foundation for the subsequent dynamic keys generated based on user behavior data to have higher security. Because specific user behavior cannot be cracked, the dynamic keys generated for specific user behavior are more secure.

[0155] Through step S302, this embodiment implements differential privacy protection of user behavior, increases the security of user information, and lays a foundation for the subsequent generation of unbreakable dynamic keys.

[0156] In one embodiment of the front-end storage encryption method of the present application, see Figure 4, and can also include the following:

[0157] Step S401: performing a polynomial construction operation according to the dynamic key, a preset share, and a preset threshold value to determine a corresponding segmentation polynomial, wherein the preset share is used to determine the number of dynamic key fragments, the preset threshold value is used to reconstruct the polynomial, and the preset threshold value is less than the preset share;

[0158] Step S402: performing a split operation on the dynamic key according to the split polynomial to determine a corresponding plurality of dynamic key fragments.

[0159] Optionally, in this embodiment, Shamir's Secret Sharing algorithm is used to divide the data into multiple shares and distribute them to different nodes. This process requires the construction of a split polynomial. In the polynomial, the dynamic key is used as a constant term, which is the secret we want to keep confidential. n key fragments are calculated by the polynomial, and each participant will obtain a key fragment, where n is the split share. When at least t participants are united, the constant term of the polynomial, i.e., the dynamic key, can be restored by the Lagrange interpolation method, where t is the threshold value, i.e., the minimum number of fragments required to restore the original key.

[0160] Through the above splitting operation, n key fragments are obtained. Distributing and storing these key fragments in different storage nodes is more conducive to preventing intrusion and destroying the key.

[0161] Through step S402, this embodiment successfully divides the dynamic key into multiple dynamic key fragments, thereby increasing the difficulty of cracking the dynamic key.

[0162] In one embodiment of the front-end storage encryption method of the present application, see Figure 5 , and can also include the following:

[0163] Step S501: determining whether a specific event occurs in the front-end application, and if so, sending a subkey provision request to the distributed dynamic key storage node to determine the corresponding multiple subkeys;

[0164] Step S502: performing a dynamic key restoration operation according to the multiple subkeys, and decrypting the initial encrypted data according to the dynamic key and the key name obtained after the restoration operation to obtain the initial page data.

[0165] Optionally, in this embodiment, the specific events include page startup (such as when a user accesses a page) and page refresh (such as when a user refreshes a page).

[0166] Optionally, in this embodiment, when the page is started or refreshed, the system needs to decrypt the initial encrypted data according to the distributed dynamic key storage node and key name. At this time, the system starts to execute the encryption and decryption script first. This script code will try to obtain the corresponding key name from the cache. If the key name corresponds, Shamir's Secret Sharing is used to obtain the required key fragments from the distributed storage node, and these fragments are used to restore the original dynamic key. Then, the dynamic key is used to decrypt the initial encrypted data.

[0167] For example, we have 5 storage nodes, the dynamic key S is divided into 5 segments, the threshold is set to 3, and the storage nodes are allocated as follows:

[0168] Node 1, key fragment f(1), storage mode, local;

[0169] Node 2, key fragment f(2), storage method, cloud;

[0170] Node 3, key fragment f(3), storage mode, local;

[0171] Node 4, key fragment f(4), storage method, cloud;

[0172] Node 5, key fragment f(5), storage method, cloud.

[0173] In this setting, if the key needs to be recovered, it is necessary to obtain key fragments f(1), f(3), and f(4) from at least three different storage nodes (e.g., node 1, node 3, and node 4), and then use the Lagrange interpolation method to recover the key S. Use the recovered dynamic key to decrypt the initial encrypted data to obtain the original page data.

[0174] Through step S502, this embodiment successfully restores the dynamic key through the subkey, laying a foundation for subsequent dynamic key update.

[0175] In one embodiment of the front-end storage encryption method of the present application, see Figure 6 , and can also include the following:

[0176] Step S601: input the initial key generation data into a preset random forest model as a model training set, perform model training according to a cross-validation algorithm, and obtain a corresponding dynamic key generation model;

[0177] Step S602: receiving initial real-time user behavior data and real-time system environment parameters, and inputting the initial real-time user behavior data and the real-time system environment parameters into the dynamic key generation model to obtain a dynamic key output by the dynamic key generation model.

[0178] Optionally, in this embodiment, the "initial key generation data" obtained in step S202, i.e., the model training set, is input into the input layer of the random forest model and converted into a corresponding feature vector. During the training process, the model will determine which features contribute more to the dynamic key generation based on the influence of each feature. The feature importance scoring algorithm is used to determine which user behaviors and environmental features are most critical to the generation of the key.

[0179] During training, the K-fold cross-validation method is used to verify the generalization ability of the model to ensure that it has good adaptability to different types of user behaviors. After training, the model's hyperparameters, such as the number of trees, the maximum depth of the tree, and the minimum number of sample splits per tree, are optimized to improve the accuracy and generalization ability of the model.

[0180] When the random forest model is trained, it can be used to generate dynamic keys, which are generated based on real-time user behavior data and environmental parameters and are different each time. Preferably, in order to improve the adaptability of key generation, the model can be updated regularly to adapt to new user behavior patterns through incremental learning.

[0181] For example, if a user is active late at night and logs in from a specific region, the model might generate a time-sensitive, regional key based on these behaviors.

[0182] If a user frequently performs transactions on a specific device, the model may generate a key associated with that device based on the characteristics of that device.

[0183] If there is a significant change in the user's operating pattern (for example, from normal operation to unusual activity), the model may detect this change and generate a new key based on the change.

[0184] Through step S602, this embodiment successfully generates a specific dynamic key through model adaptability, laying a solid foundation for increasing user data security.

[0185] In one embodiment of the front-end storage encryption method of the present application, see Figure 7 , and can also include the following:

[0186] Step S701: performing an obfuscation operation on the visualization embedding algorithm according to a preset code obfuscation rule to determine a corresponding obfuscated visualization embedding algorithm;

[0187] Step S702: monitoring the user according to the obfuscated visualization tracking algorithm.

[0188] Optionally, in this embodiment, during the visualization tracking process, code obfuscation technology is used to confuse the visualization tracking algorithm so that it is unrecognizable to external attackers. The obfuscated algorithm can still perform the original monitoring function, but it is difficult for attackers to reverse understand and use it. Preferably, code obfuscation makes the code difficult to understand by modifying the structure, naming and logic of the code, for example, renaming variables and flattening the control flow.

[0189] It is understandable that hiding the front-end monitoring operation can improve the security of the system, prevent malicious attackers from discovering the monitoring mechanism, and ensure the concealment of the monitoring process.

[0190] Through step S702, this embodiment successfully implements the code obfuscation of the visual tracking technology, so that the monitoring program is hidden, malicious attacks cannot crack user behaviors based on the actions of the monitoring program, and the security of the system is increased.

[0191] In order to improve the efficiency and security of front-end data storage, the present application provides an embodiment of a front-end storage encryption device for implementing all or part of the content of the front-end storage encryption method, see Figure 8 , the front-end storage encryption device specifically includes the following contents:

[0192] The dynamic key generation module 10 is used to, after obtaining the user information access authorization, perform a monitoring operation on the user in the front-end application, perform a differential privacy fusion operation on the user behavior data and system environment parameters obtained after the monitoring operation, determine the corresponding initial key generation data, input the initial key generation data as a model training set into a preset random forest model for model training, obtain a dynamic key generation model, input the initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model, obtain the dynamic key output by the dynamic key generation model, perform an encryption operation on the initial page data of the front-end application according to the dynamic key, determine the corresponding initial encrypted data, and store the decryption information corresponding to the initial encrypted data in the form of a key-value pair to determine the corresponding key name;

[0193] The dynamic key distribution storage module 20 is used to perform a split operation on the dynamic key according to a preset key splitting algorithm, determine a corresponding plurality of dynamic key fragments, perform a storage operation on the plurality of dynamic key fragments according to preset storage nodes, and determine a corresponding distributed dynamic key storage node;

[0194] The dynamic key update module 30 is used to listen to the front-end application according to a preset specific event listener to determine whether a specific event occurs in the front-end application. If so, the initial encrypted data is decrypted according to the distributed dynamic key storage node and the key name to obtain the initial page data, and the initial page data is modified according to the page modification data corresponding to the specific event to determine the corresponding updated page data, and a dynamic key update operation is performed according to the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key, and the updated page data is encrypted according to the updated dynamic key to determine the corresponding updated encrypted data, wherein the preset specific event includes at least one of the front-end application page startup and the front-end application page refresh.

[0195] From the above description, it can be seen that the front-end storage encryption device provided in the embodiment of the present application can obtain initial key generation data by performing differential privacy fusion operations on user behavior data and system environment parameters, and use the initial key generation data to train the random forest model to obtain a dynamic key generation model and the dynamic key output by the model, and encrypt the initial page data of the front-end application according to the dynamic key; after encryption, the dynamic key is split according to the key splitting algorithm and stored in different nodes respectively, and the distributed dynamic key storage node is determined; when a specific event occurs, a sub-key acquisition request is sent to the distributed dynamic key storage node to obtain the original dynamic key for decryption, and then the original dynamic key is updated according to the user behavior data and system environment parameters corresponding to the specific event, and encrypted again according to the updated dynamic key, so as to achieve dynamic encryption, thereby improving the efficiency and security of front-end data storage.

[0196] From the hardware level, in order to improve the efficiency and security of front-end data storage, the present application provides an embodiment of an electronic device for implementing all or part of the content in the front-end storage encryption method, and the electronic device specifically includes the following content:

[0197] Processor, memory, communication interface and bus; wherein the processor, memory and communication interface communicate with each other through the bus; the communication interface is used to realize the information transmission between the front-end storage encryption method and the core business system, user terminal and related database and other related devices; the logic controller can be a desktop computer, a tablet computer and a mobile terminal, etc., but the present embodiment is not limited thereto. In the present embodiment, the logic controller can be implemented with reference to the embodiment of the front-end storage encryption method and the embodiment of the front-end storage encryption method in the embodiment, and the contents thereof are incorporated herein, and the repeated parts are not repeated.

[0198] It is understandable that the user terminal may include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. Among them, the smart wearable device may include smart glasses, a smart watch, a smart bracelet, etc.

[0199] In practical applications, part of the front-end storage encryption method can be executed on the electronic device side as described above, or all operations can be completed in the client device. The specific selection can be based on the processing capability of the client device and the limitations of the user's usage scenario. This application does not limit this. If all operations are completed in the client device, the client device may also include a processor.

[0200] The client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side, and other implementation scenarios may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, or a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0201] Fig. 9 FIG. 9 is a schematic block diagram of the system structure of the electronic device 9600 according to an embodiment of the present application. Fig. 9 As shown, the electronic device 9600 may include a central processor 9100 and a memory 9140; the memory 9140 is coupled to the central processor 9100. It is worth noting that Fig. 9 is exemplary; other types of structures may also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0202] In one embodiment, the front-end storage encryption method function may be integrated into the central processing unit 9100. The central processing unit 9100 may be configured to perform the following control:

[0203] Step S101: After obtaining the user information access authorization, the front-end application performs a monitoring operation on the user, performs a differential privacy fusion operation on the user behavior data and system environment parameters obtained after the monitoring operation, determines the corresponding initial key generation data, inputs the initial key generation data as a model training set into a preset random forest model for model training, obtains a dynamic key generation model, inputs the initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model, obtains the dynamic key output by the dynamic key generation model, performs an encryption operation on the initial page data of the front-end application according to the dynamic key, determines the corresponding initial encrypted data, and stores the decryption information corresponding to the initial encrypted data in the form of a key-value pair to determine the corresponding key name;

[0204] Step S102: performing a split operation on the dynamic key according to a preset key splitting algorithm to determine a corresponding plurality of dynamic key fragments, performing storage operations on the plurality of dynamic key fragments respectively according to preset storage nodes to determine corresponding distributed dynamic key storage nodes;

[0205] Step S103: Listen to the front-end application according to the preset specific event listener to determine whether a specific event occurs in the front-end application; if so, decrypt the initial encrypted data according to the distributed dynamic key storage node and the key name to obtain the initial page data; modify the initial page data according to the page modification data corresponding to the specific event to determine the corresponding updated page data; perform a dynamic key update operation according to the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key; encrypt the updated page data according to the updated dynamic key to determine the corresponding updated encrypted data, wherein the preset specific event includes at least one of the front-end application page startup and the front-end application page refresh.

[0206] From the above description, it can be seen that the electronic device provided in the embodiment of the present application obtains initial key generation data by performing differential privacy fusion operations on user behavior data and system environment parameters, uses the initial key generation data to train a random forest model, obtains a dynamic key generation model and a dynamic key output by the model, and encrypts the initial page data of the front-end application according to the dynamic key; after encryption, the dynamic key is split according to the key splitting algorithm and stored in different nodes respectively, and a distributed dynamic key storage node is determined; when a specific event occurs, a sub-key acquisition request is sent to the distributed dynamic key storage node to obtain the original dynamic key for decryption, and then the original dynamic key is updated according to the user behavior data and system environment parameters corresponding to the specific event, and encrypted again according to the updated dynamic key, so as to achieve dynamic encryption, thereby improving the efficiency and security of front-end data storage.

[0207] In another embodiment, the front-end storage encryption method can be configured separately from the central processor 9100. For example, the front-end storage encryption method can be configured as a chip connected to the central processor 9100, and the front-end storage encryption method function is implemented through the control of the central processor.

[0208] like Fig. 9 As shown, the electronic device 9600 may also include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily have to include Fig. 9 In addition, the electronic device 9600 may also include Fig. 9 For components not shown, reference may be made to the prior art.

[0209] like Fig. 9 As shown, the central processing unit 9100 is sometimes also referred to as a controller or an operation control, and may include a microprocessor or other processor device and / or logic device. The central processing unit 9100 receives input and controls the operation of various components of the electronic device 9600.

[0210] The memory 9140 may be, for example, one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices. The above-mentioned information related to the failure may be stored, and a program for executing the relevant information may also be stored. The CPU 9100 may execute the program stored in the memory 9140 to implement information storage or processing, etc.

[0211] The input unit 9120 provides input to the central processing unit 9100. The input unit 9120 is, for example, a key or a touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display display objects such as images and texts. The display may be, for example, an LCD display, but is not limited thereto.

[0212] The memory 9140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), a SIM card, etc. It may also be a memory that saves information even when the power is off, can be selectively erased, and is provided with more data, examples of which are sometimes referred to as EPROMs, etc. The memory 9140 may also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142, which is used to store application programs and function programs or processes for executing the operation of the electronic device 9600 through the central processor 9100.

[0213] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0214] The communication module 9110 is a transmitter / receiver that sends and receives signals via the antenna 9111. The communication module 9110 is coupled to the central processor 9100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0215] Based on different communication technologies, multiple communication modules 9110 may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless local area network module, etc. The communication module 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide an audio output via the speaker 9131 and receive an audio input from the microphone 9132, thereby realizing a common telecommunication function. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 9130 is also coupled to the central processor 9100, so that recording can be performed on the machine through the microphone 9132, and the sound stored on the machine can be played through the speaker 9131.

[0216] The embodiments of the present application also provide a computer program product capable of implementing all steps of the front-end storage encryption method in the above embodiments, where the execution subject is a server or a client. When the computer program / instruction is executed by a processor, the steps of the front-end storage encryption method are implemented. For example, the computer program / instruction implements the following steps:

[0217] Step S101: After obtaining the user information access authorization, the front-end application performs a monitoring operation on the user, performs a differential privacy fusion operation on the user behavior data and system environment parameters obtained after the monitoring operation, determines the corresponding initial key generation data, inputs the initial key generation data as a model training set into a preset random forest model for model training, obtains a dynamic key generation model, inputs the initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model, obtains the dynamic key output by the dynamic key generation model, performs an encryption operation on the initial page data of the front-end application according to the dynamic key, determines the corresponding initial encrypted data, and stores the decryption information corresponding to the initial encrypted data in the form of a key-value pair to determine the corresponding key name;

[0218] Step S102: performing a split operation on the dynamic key according to a preset key splitting algorithm to determine a corresponding plurality of dynamic key fragments, performing storage operations on the plurality of dynamic key fragments respectively according to preset storage nodes to determine corresponding distributed dynamic key storage nodes;

[0219] Step S103: Listen to the front-end application according to the preset specific event listener to determine whether a specific event occurs in the front-end application; if so, decrypt the initial encrypted data according to the distributed dynamic key storage node and the key name to obtain the initial page data; modify the initial page data according to the page modification data corresponding to the specific event to determine the corresponding updated page data; perform a dynamic key update operation according to the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key; encrypt the updated page data according to the updated dynamic key to determine the corresponding updated encrypted data, wherein the preset specific event includes at least one of the front-end application page startup and the front-end application page refresh.

[0220] From the above description, it can be seen that the computer program product provided in the embodiment of the present application obtains initial key generation data by performing differential privacy fusion operations on user behavior data and system environment parameters, uses the initial key generation data to train the random forest model, obtains a dynamic key generation model and the dynamic key output by the model, and encrypts the initial page data of the front-end application according to the dynamic key; after encryption, the dynamic key is split according to the key splitting algorithm and stored in different nodes respectively, and the distributed dynamic key storage node is determined; when a specific event occurs, a sub-key acquisition request is sent to the distributed dynamic key storage node to obtain the original dynamic key for decryption, and then the original dynamic key is updated according to the user behavior data and system environment parameters corresponding to the specific event, and then encrypted again according to the updated dynamic key, so as to achieve dynamic encryption, thereby improving the efficiency and security of front-end data storage.

[0221] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0222] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (apparatus), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0223] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0224] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0225] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A front-end storage encryption method, characterized in that: The method comprises: After obtaining the user information access authorization, the front-end application monitors the user, performs a differential privacy fusion operation on the user behavior data and system environment parameters obtained after the monitoring operation, determines the corresponding initial key generation data, inputs the initial key generation data as a model training set into a preset random forest model for model training, obtains a dynamic key generation model, inputs the initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model, obtains the dynamic key output by the dynamic key generation model, performs an encryption operation on the initial page data of the front-end application according to the dynamic key, determines the corresponding initial encrypted data, and stores the decryption information corresponding to the initial encrypted data in the form of a key-value pair to determine the corresponding key name; Performing a split operation on the dynamic key according to a preset key splitting algorithm to determine a corresponding plurality of dynamic key fragments, and performing storage operations on the plurality of dynamic key fragments according to preset storage nodes to determine corresponding distributed dynamic key storage nodes; The front-end application is listened to according to the preset specific event listener to determine whether a specific event occurs in the front-end application; if so, the initial encrypted data is decrypted according to the distributed dynamic key storage node and the key name to obtain the initial page data; the initial page data is modified according to the page modification data corresponding to the specific event to determine the corresponding updated page data; a dynamic key update operation is performed according to the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key; and the updated page data is encrypted according to the updated dynamic key to determine the corresponding updated encrypted data, wherein the preset specific event includes at least one of the front-end application page startup and the front-end application page refresh.

2. The front-end storage encryption method according to claim 1, characterized in that: The performing a differential privacy fusion operation on the user behavior data and the system environment parameters obtained after the monitoring operation to determine the corresponding initial key generation data includes: Performing a differential privacy protection operation on the user behavior data obtained after the monitoring operation according to a preset utility function to determine corresponding fuzzy user behavior data; A data fusion operation is performed on the fuzzy user behavior data and the system environment parameters obtained after the monitoring operation to determine corresponding initial key generation data.

3. The front-end storage encryption method according to claim 2, characterized in that: The performing a differential privacy protection operation on the user behavior data obtained after the monitoring operation according to a preset utility function to determine the corresponding fuzzy user behavior data includes: Performing a utility evaluation operation on the user behavior data obtained after the monitoring operation according to a preset utility function to determine a corresponding utility evaluation result, wherein the utility evaluation result is used to indicate the degree of influence of the user behavior data on the result; A noise adding operation is performed on the user behavior data according to the utility evaluation result and the preset privacy loss to determine the corresponding fuzzy user behavior data, wherein the preset privacy loss is used to evaluate the impact of the introduced noise on the privacy information.

4. The front-end storage encryption method according to claim 1, characterized in that: The step of performing a split operation on the dynamic key according to a preset key splitting algorithm to determine a corresponding plurality of dynamic key fragments includes: Performing a polynomial construction operation according to the dynamic key, a preset share, and a preset threshold value to determine a corresponding segmentation polynomial, wherein the preset share is used to determine the number of dynamic key fragments, the preset threshold value is used to reconstruct the polynomial, and the preset threshold value is less than the preset share; The dynamic key is split according to the split polynomial to determine a corresponding plurality of dynamic key fragments.

5. The front-end storage encryption method according to claim 1, characterized in that: The determining whether a specific event occurs in the front-end application, and if so, decrypting the initial encrypted data according to the distributed dynamic key storage node and the key name to obtain the initial page data, includes: Determine whether a specific event occurs in the front-end application, and if so, send a subkey provision request to the distributed dynamic key storage node to determine the corresponding multiple subkeys; A dynamic key restoration operation is performed according to the multiple subkeys, and the initial encrypted data is decrypted according to the dynamic key and the key name obtained after the restoration operation to obtain the initial page data.

6. The front-end storage encryption method according to claim 1, characterized in that: The initial key generation data is input as a model training set into a preset random forest model for model training to obtain a dynamic key generation model, and the initial real-time user behavior data and real-time system environment parameters are input into the dynamic key generation model to obtain a dynamic key output by the dynamic key generation model, including: The initial key generation data is input into a preset random forest model as a model training set, and the model is trained according to a cross-validation algorithm to obtain a corresponding dynamic key generation model; Initial real-time user behavior data and real-time system environment parameters are received, and the initial real-time user behavior data and the real-time system environment parameters are input into the dynamic key generation model to obtain a dynamic key output by the dynamic key generation model.

7. The front-end storage encryption method according to claim 1, characterized in that: The monitoring operation of the user by the front-end application includes: Perform obfuscation operation on the visualization embedding algorithm according to the preset code obfuscation rules to determine the corresponding obfuscated visualization embedding algorithm; The user is monitored according to the obfuscated visualization tracking algorithm.

8. A front-end storage encryption device, characterized in that: The device comprises: A dynamic key generation module is used to, after obtaining user information access authorization, perform a monitoring operation on the user in the front-end application, perform a differential privacy fusion operation on the user behavior data and system environment parameters obtained after the monitoring operation, determine the corresponding initial key generation data, input the initial key generation data as a model training set into a preset random forest model for model training, obtain a dynamic key generation model, input the initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model, obtain the dynamic key output by the dynamic key generation model, perform an encryption operation on the initial page data of the front-end application according to the dynamic key, determine the corresponding initial encrypted data, and store the decryption information corresponding to the initial encrypted data in the form of a key-value pair to determine the corresponding key name; A dynamic key distribution storage module, used to perform a split operation on the dynamic key according to a preset key splitting algorithm, determine a corresponding plurality of dynamic key fragments, perform storage operations on the plurality of dynamic key fragments respectively according to preset storage nodes, and determine a corresponding distributed dynamic key storage node; A dynamic key update module is used to listen to the front-end application according to a preset specific event listener to determine whether a specific event occurs in the front-end application; if so, decrypt the initial encrypted data according to the distributed dynamic key storage node and the key name to obtain the initial page data; modify the initial page data according to the page modification data corresponding to the specific event to determine the corresponding updated page data; perform a dynamic key update operation according to the user behavior data and the environmental parameters corresponding to the specific event to determine the corresponding updated dynamic key; and encrypt the updated page data according to the updated dynamic key to determine the corresponding updated encrypted data, wherein the preset specific event includes at least one of the front-end application page startup and the front-end application page refresh.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the front-end storage encryption method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the front-end storage encryption method described in any one of claims 1 to 7 are implemented.

Images