Front-end storage encryption method and device

Abstract

This application provides a front-end storage encryption method and apparatus. The method includes: obtaining initial key generation data by performing differential privacy fusion on user behavior data and system environment parameters; training a random forest model using the initial key generation data to obtain a dynamic key generation model and a dynamic key output by the model; encrypting the initial page data of the front-end application according to the dynamic key; after encryption, segmenting the dynamic key according to a key splitting algorithm and storing them separately on different nodes to determine a distributed dynamic key storage node; when a specific event occurs, sending a subkey acquisition request to the distributed dynamic key storage node to obtain the original dynamic key for decryption; then updating the original dynamic key according to the user behavior data and system environment parameters corresponding to the specific event; and then encrypting again according to the updated dynamic key, thereby achieving dynamic encryption. This application can improve the efficiency and security of front-end data storage.

Description

Technical Field

[0001] This application relates to the field of data processing, specifically to a front-end storage encryption method and apparatus. Background Technology

[0002] In modern web development, front-end caching technologies are becoming increasingly common, especially the browser's localStorageAPI (persistent storage interface) and sessionStorageAPI (temporary storage interface). These provide applications with convenient data storage solutions, enabling them to cache data returned from the backend on the client side, thereby improving user experience and application performance.

[0003] However, these storage mechanisms also present challenges to data security and privacy protection. Currently, most front-end applications using the localStorage API and sessionStorage API often store sensitive data in plaintext. This allows attackers to easily access and steal this data through the browser's developer tools. A common solution to this problem relies on static keys. After receiving data from the backend, the browser's JavaScript encrypts the returned data using AES (a symmetric encryption algorithm) and temporarily caches it. The script decrypts and retrieves the data when needed, ensuring that the data cached by the client browser is encrypted and does not affect its use in the code logic.

[0004] However, static encryption relies too heavily on keys. Once the key is stolen, attackers can decrypt data without authentication. Therefore, enhancing data security during web storage while maintaining a user-friendly experience, and consistently protecting user privacy and improving user experience, is a pressing issue in web development. Summary of the Invention

[0005] To address the problems in the prior art, this application provides a front-end storage encryption method and apparatus, which can improve the efficiency and security of front-end data storage.

[0006] To solve at least one of the above problems, this application provides the following technical solution:

[0007] In a first aspect, this application provides a front-end storage encryption method, including:

[0008] After obtaining user information access authorization, the front-end application performs a monitoring operation on the user. Differential privacy fusion is performed on the user behavior data and system environment parameters obtained after the monitoring operation to determine the corresponding initial key generation data. The initial key generation data is used as the model training set and input into a preset random forest model for model training to obtain a dynamic key generation model. The initial real-time user behavior data and real-time system environment parameters are input into the dynamic key generation model to obtain the dynamic key output by the dynamic key generation model. The initial page data of the front-end application is encrypted according to the dynamic key to determine the corresponding initial encrypted data. The decryption information corresponding to the initial encrypted data is stored in key-value pairs to determine the corresponding key name.

[0009] The dynamic key is segmented according to a preset key segmentation algorithm to determine multiple corresponding dynamic key fragments. The multiple dynamic key fragments are stored according to preset storage nodes to determine the corresponding distributed dynamic key storage nodes.

[0010] The front-end application is monitored by a preset specific event listener to determine whether a specific event has occurred. If so, the initial encrypted data is decrypted using the distributed dynamic key storage node and the key name to obtain the initial page data. The initial page data is then modified based on the page modification data corresponding to the specific event to determine the corresponding updated page data. A dynamic key update operation is performed based on the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key. Finally, the updated page data is encrypted using the updated dynamic key to determine the corresponding updated encrypted data. The preset specific event includes at least one of front-end application page startup and front-end application page refresh.

[0011] Furthermore, the step of performing differential privacy fusion on the user behavior data and system environment parameters obtained after the monitoring operation to determine the corresponding initial key generation data includes:

[0012] Based on a preset utility function, differential privacy protection operation is performed on the user behavior data obtained after the monitoring operation to determine the corresponding fuzzy user behavior data.

[0013] A data fusion operation is performed on the fuzzy user behavior data and the system environment parameters obtained after the monitoring operation to determine the corresponding initial key generation data.

[0014] Furthermore, the step of performing differential privacy protection on the user behavior data obtained after the monitoring operation according to a preset utility function to determine the corresponding fuzzy user behavior data includes:

[0015] The user behavior data obtained after the monitoring operation is evaluated according to the preset utility function to determine the corresponding utility evaluation result, wherein the utility evaluation result is used to represent the degree of influence of the user behavior data on the result.

[0016] Based on the utility evaluation results and the preset privacy loss, noise is added to the user behavior data to determine the corresponding fuzzy user behavior data. The preset privacy loss is used to evaluate the degree of impact of the introduced noise on privacy information.

[0017] Further, the step of segmenting the dynamic key according to a preset key segmentation algorithm to determine multiple corresponding dynamic key fragments includes:

[0018] A polynomial construction operation is performed based on the dynamic key, the preset share, and the preset threshold value to determine the corresponding segmentation polynomial. The preset share is used to determine the number of dynamic key fragments, and the preset threshold value is used to reconstruct the polynomial. The preset threshold value is less than the preset share.

[0019] The dynamic key is segmented according to the segmentation polynomial to determine multiple corresponding dynamic key fragments.

[0020] Further, the step of determining whether a specific event has occurred in the front-end application, and if so, decrypting the initial encrypted data based on the distributed dynamic key storage node and the key name to obtain the initial page data, includes:

[0021] Determine whether a specific event has occurred in the front-end application. If it has, send a subkey provision request to the distributed dynamic key storage node to determine the corresponding multiple subkeys.

[0022] A dynamic key restoration operation is performed based on the multiple subkeys, and the initial encrypted data is decrypted based on the dynamic key and the key name obtained after the restoration operation to obtain the initial page data.

[0023] Further, the step of using the initial key generation data as a model training set to input into a preset random forest model for model training to obtain a dynamic key generation model, and inputting the initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model to obtain the dynamic key output by the dynamic key generation model includes:

[0024] The initial key generation data is used as the model training set and input into a preset random forest model. The model is trained according to the cross-validation algorithm to obtain the corresponding dynamic key generation model.

[0025] The system receives initial real-time user behavior data and real-time system environment parameters, and inputs the initial real-time user behavior data and the real-time system environment parameters into the dynamic key generation model to obtain the dynamic key output by the dynamic key generation model.

[0026] Furthermore, the user monitoring operation in the front-end application includes:

[0027] The visual tracking algorithm is obfuscated according to the preset code obfuscation rules to determine the corresponding obfuscated visual tracking algorithm.

[0028] The user is monitored using the obfuscated visualization tracking algorithm.

[0029] Secondly, this application provides a front-end storage encryption device, comprising:

[0030] The dynamic key generation module is used to listen to users in the front-end application after obtaining user information access authorization. It performs differential privacy fusion on the user behavior data and system environment parameters obtained after the listening operation to determine the corresponding initial key generation data. The initial key generation data is used as the model training set and input into a preset random forest model for model training to obtain a dynamic key generation model. The initial real-time user behavior data and real-time system environment parameters are input into the dynamic key generation model to obtain the dynamic key output by the dynamic key generation model. The initial page data of the front-end application is encrypted according to the dynamic key to determine the corresponding initial encrypted data. The decryption information corresponding to the initial encrypted data is stored in key-value pairs to determine the corresponding key name.

[0031] The dynamic key distribution storage module is used to perform segmentation operations on the dynamic key according to a preset key segmentation algorithm to determine multiple corresponding dynamic key fragments, and to perform storage operations on the multiple dynamic key fragments according to preset storage nodes to determine the corresponding distributed dynamic key storage nodes.

[0032] The dynamic key update module is used to listen to the front-end application according to a preset specific event listener, determine whether a specific event has occurred in the front-end application, and if so, decrypt the initial encrypted data according to the distributed dynamic key storage node and the key name to obtain the initial page data. Then, it modifies the initial page data according to the page modification data corresponding to the specific event to determine the corresponding updated page data. Finally, it performs a dynamic key update operation according to the user behavior data and environment parameters corresponding to the specific event to determine the corresponding updated dynamic key, and encrypts the updated page data according to the updated dynamic key to determine the corresponding updated encrypted data. The preset specific event includes at least one of front-end application page startup and front-end application page refresh.

[0033] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the front-end storage encryption method.

[0034] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned front-end storage encryption method.

[0035] Fifthly, this application provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the aforementioned front-end storage encryption method.

[0036] As can be seen from the above technical solution, this application provides a front-end storage encryption method and apparatus. It obtains initial key generation data by performing differential privacy fusion on user behavior data and system environment parameters. A random forest model is trained using the initial key generation data to obtain a dynamic key generation model and the dynamic key output by the model. The initial page data of the front-end application is encrypted using the dynamic key. After encryption, the dynamic key is segmented according to a key splitting algorithm and stored on different nodes to determine a distributed dynamic key storage node. When a specific event occurs, a subkey acquisition request is sent to the distributed dynamic key storage node to obtain the original dynamic key for decryption. Then, the original dynamic key is updated according to the user behavior data and system environment parameters corresponding to the specific event. Encryption is then performed again using the updated dynamic key, thereby achieving dynamic encryption and improving the efficiency and security of front-end data storage. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is one of the flowcharts illustrating the front-end storage encryption method in the embodiments of this application;

[0039] Figure 2 This is the second flowchart illustrating the front-end storage encryption method in this application embodiment;

[0040] Figure 3 This is the third flowchart illustrating the front-end storage encryption method in this application embodiment;

[0041] Figure 4 This is the fourth flowchart illustrating the front-end storage encryption method in the embodiments of this application;

[0042] Figure 5 This is the fifth flowchart illustrating the front-end storage encryption method in the embodiments of this application;

[0043] Figure 6 This is the sixth flowchart illustrating the front-end storage encryption method in this application embodiment;

[0044] Figure 7 This is the seventh flowchart illustrating the front-end storage encryption method in this application embodiment;

[0045] Figure 8 This is a structural diagram of the front-end storage encryption device in the embodiments of this application;

[0046] Figure 9 This is a schematic diagram of the structure of the electronic device in the embodiments of this application.

[0047] Figure label:

[0048] Electronic device 9600, central processing unit 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage unit 9142, data storage unit 9143, driver storage unit 9144, antenna 9111, speaker 9131, microphone 9132. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0050] The acquisition, storage, use, and processing of data in this application all comply with the relevant provisions of national laws and regulations.

[0051] Given that existing static encryption methods rely too heavily on keys, data is at risk of being illegally accessed once the key is stolen. This application provides a front-end storage encryption method and apparatus. It obtains initial key generation data by performing differential privacy fusion on user behavior data and system environment parameters. A random forest model is trained using this initial key generation data to obtain a dynamic key generation model and its output dynamic key. The initial page data of the front-end application is encrypted using this dynamic key. After encryption, the dynamic key is segmented using a key splitting algorithm and stored on different nodes, thus determining a distributed dynamic key storage node. When a specific event occurs, a subkey retrieval request is sent to the distributed dynamic key storage node to obtain the original dynamic key for decryption. Then, the original dynamic key is updated based on the user behavior data and system environment parameters corresponding to the specific event. Encryption is then performed again using the updated dynamic key, thereby achieving dynamic encryption and improving the efficiency and security of front-end data storage.

[0052] To improve the efficiency and security of front-end data storage, this application provides an embodiment of a front-end storage encryption method, see [link to embodiment]. Figure 1 The front-end storage encryption method specifically includes the following:

[0053] Step S101: After obtaining user information access authorization, the front-end application performs a monitoring operation on the user, performs differential privacy fusion operation on the user behavior data and system environment parameters obtained after the monitoring operation, determines the corresponding initial key generation data, inputs the initial key generation data as the model training set into a preset random forest model for model training, obtains a dynamic key generation model, inputs the initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model, obtains the dynamic key output by the dynamic key generation model, encrypts the initial page data of the front-end application according to the dynamic key, determines the corresponding initial encrypted data, and stores the decryption information corresponding to the initial encrypted data in key-value pairs, determines the corresponding key name;

[0054] Optionally, in this embodiment, the purpose of this step is to automatically generate a customized dynamic key based on user behavior data and system environment parameters using a model, and to encrypt the user data of the front-end application using the dynamic key to ensure that the dynamic key is unpredictable.

[0055] Optionally, in this embodiment, information acquisition is based on obtaining user authorization; authorization can be obtained through methods such as pop-up prompts, red text alerts, and vibration alerts. The user will be informed of the information acquisition method and its scope of use while the information is being acquired.

[0056] Optionally, in this embodiment, after obtaining the user's information authorization, the front-end monitoring visualization and event tracking technology is used to perform the listening operation.

[0057] Specifically, visual event tracking technology eliminates the need for developers to write code, greatly reducing the technical burden. Simply define event tracking points and add tracking points on a pre-defined visual event tracking platform.

[0058] More specifically, in the process of visual event tracking, code obfuscation techniques are used to obfuscate the visual event tracking algorithm, making it unrecognizable to external attackers. The obfuscated algorithm can still perform the original monitoring function, but it is difficult for attackers to reverse engineer and exploit it. Preferably, code obfuscation makes the code harder to understand by modifying its structure, naming, and logic, such as renaming variables and flattening the control flow.

[0059] Understandably, hiding the front-end listening operation can improve system security, prevent malicious attackers from discovering the listening mechanism, and ensure the stealth of the listening process.

[0060] Optionally, the monitoring process collects user behavior data and system environment parameters. User behavior data includes click behavior, input behavior, browsing history, mouse movements, interaction frequency, and user behavior patterns; system environment parameters include device information, network information, geographical location, time information, environmental noise, or physical sensor data. This data collection can provide support for subsequent encryption and key generation.

[0061] Optionally, in this embodiment, differential privacy fusion is performed on the user behavior data and system environment parameters obtained after the monitoring operation to determine the corresponding initial key generation data.

[0062] Because user behavior data is highly private, differential privacy algorithms are used to protect it. In terms of effectiveness, differential privacy can effectively prevent individual user behaviors from being directly identified, while also ensuring that the dynamic keys generated based on user behavior data have a high degree of unpredictable security.

[0063] Specifically, differential privacy fusion first protects user behavior data with differential privacy by obfuscating it to ensure that no sensitive information of any individual user is leaked when collecting and analyzing user data. Then, the obfuscated user behavior data is fused with system environment parameters to generate suitable "initial key generation data" for training subsequent key generation models.

[0064] More specifically, differential privacy protection adds noise to the raw data so that the analysis results are not affected, while minimizing the chance of identifying individual data.

[0065] First, differential privacy protection requires defining a utility function to evaluate the sensitivity of user behavior data. Sensitivity measures the impact of a single data item (e.g., a user's behavior data) on the query results. Higher sensitivity indicates a greater effectiveness in protecting the privacy of that data. For example, for a query function f, its sensitivity is defined by calculating the difference in results between the query function and any two adjacent datasets that differ by only one data item. Specifically, for datasets D and D' (which differ only in one element), the sensitivity Δf is the maximum output difference of query function f on adjacent datasets. Once the sensitivity is determined, differential privacy can be achieved by adding noise to the query results.

[0066] Secondly, after obtaining the sensitivity level, noise is added to the data with the highest sensitivity. The goal is to ensure that the noise protects individual data from being identified while also preventing the original data results from being affected by the noise. This is achieved by introducing privacy loss. Privacy loss involves setting a privacy budget to limit the upper limit of privacy leakage. By adjusting the privacy budget, a balance can be struck between the accuracy of data analysis and the degree of privacy protection.

[0067] By setting a privacy budget, the magnitude of noise and the strength of privacy protection can be controlled, achieving a balance between the accuracy of data analysis and the degree of privacy protection. Understandably, a smaller privacy budget indicates stronger privacy protection (because of more noise), but it also means that the accuracy of query results may decrease. The noise can be either Laplace noise or Gaussian noise, the choice depending on the nature of the data. For very strict privacy requirements, Laplace noise is chosen because it provides the strictest privacy guarantees. For relatively lenient privacy requirements, Gaussian noise is chosen because it is more stable and suitable for more complex queries.

[0068] Preferably, for this embodiment, Gaussian noise is more suitable for adapting to complex data analysis or machine learning tasks. Its lighter tail can adapt to the diversity of data, and it is especially advantageous in the process of iterative optimization. It can better control the privacy budget in multiple queries and provide smoother query results.

[0069] For example, suppose we need to analyze how often users visit different pages, but directly using these statistics might expose a user's browsing behavior.

[0070] To protect privacy, firstly, the average time all users spend accessing the page is calculated; then, the sensitivity of the query results (i.e., the maximum impact of a single user's behavior on the results) is calculated using a utility function; finally, appropriate noise (e.g., Laplace noise) is added to the average to prevent inference of individual user access behavior.

[0071] Understandably, the aforementioned differential privacy protection operations effectively obfuscate and protect user behavior data to prevent the leakage of sensitive information of individual users. At the same time, it lays the foundation for higher security of dynamic keys generated based on user behavior data, because specific user behaviors cannot be cracked, and dynamic keys generated for specific user behaviors are more secure.

[0072] More specifically, by fusing fuzzy user behavior data protected by differential privacy with system environment parameters, "initial key generation data" is formed, which is the model training set.

[0073] Understandably, the system environment parameters do not involve sensitive personal information, so there is no need to protect privacy to increase the uncertainty of the dataset. However, they are related to user behavior and are therefore still very important in model training.

[0074] To avoid leaking user behavior privacy information through system environment parameters, and to ensure the accuracy of these parameters without additional noise injection or obfuscation, this embodiment trains two models independently during the data fusion phase: one based on user behavior data protected by differential privacy, and the other based on system environment parameters. Then, a voting mechanism is used to combine the prediction results of these two sub-models, fusing their outputs.

[0075] In terms of effectiveness, this method avoids directly exposing differential privacy-preserving data to other models, reducing the impact of noise on the results.

[0076] Optionally, after data fusion, the fused data needs to be labeled to form a model training set. During the labeling process, the correlation between user behavior and the system environment's interactive information needs to be considered. The fused data will provide more contextual information, helping to label more accurately.

[0077] Optionally, one annotation method is to annotate the data based on the strength of the generated key (such as encryption strength) so that the model can adaptively generate keys of appropriate strength according to user behavior and system environment.

[0078] Optionally, one annotation method is to directly associate user behavior and environmental data with the generated keys, labeling the category or features of the keys generated under these behaviors and environmental conditions. In this case, keys need to be generated in the training dataset in advance, and the attributes of the generated keys (such as key strength, category, etc.) need to be recorded.

[0079] Optionally, one labeling method involves annotating the training data using the actually generated keys and user feedback (such as successful / failed authentication). That is, the key data is labeled based on whether the key successfully prevents attacks or meets certain security requirements. This requires an existing, preliminary key generation system in operation, which could be a random number generator.

[0080] Understandably, in the task of generating dynamic keys based on user behavior and environmental parameters, the core of data annotation is to associate different user behavior data and environmental parameters with the characteristics of the key. After annotation, the "initial key generation data", i.e. the model training set, can be obtained.

[0081] Optionally, in this embodiment, the initial key generation data is used as the model training set and input into a preset random forest model for model training to obtain a dynamic key generation model.

[0082] Specifically, the training set obtained from the above steps is input into the input layer of the random forest model, transforming it into corresponding feature vectors. During training, the model determines which features contribute significantly to dynamic key generation based on the influence of each feature. A feature importance scoring algorithm is used to determine which user behaviors and environmental features are most critical for key generation.

[0083] During training, K-fold cross-validation was used to verify the model's generalization ability, ensuring its good adaptability to different types of user behavior. After training, the model's hyperparameters, such as the number of trees, the maximum depth of the trees, and the minimum number of sample splits per tree, were optimized to improve the model's accuracy and generalization ability.

[0084] Once the random forest model is trained, it can be used to generate dynamic keys based on real-time user behavior data and environmental parameters, and these keys will be different each time. Preferably, to improve the adaptability of key generation, the model can be updated periodically, using incremental learning to adapt to new user behavior patterns.

[0085] For example, if a user is active late at night and logs in from a specific region, the model may generate a time-sensitive, region-specific key based on these behaviors.

[0086] If a user frequently transacts on a particular device, the model may generate a key associated with that device based on its characteristics.

[0087] If a user's operating pattern changes significantly (e.g., from normal operation to abnormal activity), the model may detect this change and generate a new key based on the change.

[0088] Understandably, encryption keys are usually generated by some random number generation algorithm (such as a pseudo-random number generator, hardware random number generator, etc.), which does not depend on any user behavior or system environment parameters. However, if the random number generator itself has vulnerabilities or its seed is leaked, then the random key may be predicted or regenerated by an attacker.

[0089] In this embodiment, a customized dynamic key is generated based on user behavior data and system environment parameters. This key is closely related to each user's behavior, device, location, and other information. In terms of effectiveness, the key can be dynamically adjusted according to real-time behavior, so that each interaction has a different key. At the same time, differential privacy technology is used to protect the privacy of the original user behavior, further preventing the security of the key from being affected by the leakage of user behavior, thereby effectively preventing replay attacks and prediction of user behavior.

[0090] Optionally, in this embodiment, the initial page data of the front-end application is encrypted according to the dynamic key to determine the corresponding initial encrypted data, and the decryption information corresponding to the initial encrypted data is stored in key-value pairs to determine the corresponding key name.

[0091] Specifically, this step uses a specific dynamic key obtained through the model to encrypt the user data of the front-end application. The encrypted data will be stored permanently or temporarily depending on its characteristics, and stored accordingly. The corresponding decryption information is stored in the form of key-value pairs, where the key name is the identifier of the key during decryption.

[0092] Through the above steps, a specific dynamic key was successfully generated, which enhances the security of user page data while ensuring user data privacy, laying the foundation for subsequent implementation of dynamic encryption.

[0093] Step S102: Perform a segmentation operation on the dynamic key according to a preset key segmentation algorithm to determine multiple corresponding dynamic key fragments, and perform storage operations on the multiple dynamic key fragments according to preset storage nodes to determine the corresponding distributed dynamic key storage nodes.

[0094] Optionally, in this embodiment, the purpose of this step is to distribute the dynamic key obtained in step S101 to further increase the security of the dynamic key.

[0095] Specifically, using Shamir's Secret Sharing algorithm, the data is divided into multiple shares and distributed to different nodes. This process requires constructing a partitioning polynomial, in which the dynamic key serves as a constant term and represents the secret we want to keep secret. The polynomial is used to compute n key fragments, and each participant receives a key fragment, where n is the partition share. When at least t participants collaborate, the constant term of the polynomial, i.e., the dynamic key, can be recovered using Lagrange interpolation, where t is a threshold value, representing the minimum number of fragments required to recover the original key.

[0096] The above segmentation operation yields n key fragments. Distributing these key fragments across different storage nodes is more effective in preventing intrusion and key corruption.

[0097] Optionally, the corresponding distributed dynamic key storage node is determined by performing storage operations on the multiple dynamic key fragments according to the preset storage node.

[0098] Specifically, systems with storage nodes distributed across different geographical locations, data centers, or the cloud can improve key security and fault tolerance.

[0099] For example, nodes can be distributed in the following ways:

[0100] Physical nodes: Nodes in different data centers or on different cloud platforms.

[0101] Virtual nodes: Storage nodes are allocated across multiple virtual machines or containers.

[0102] Preferably, distributed storage is used on cloud nodes and local nodes to ensure that the process of restoring dynamic keys requires the cooperation of cloud and local systems, thereby increasing security.

[0103] Preferably, copies of the same key fragment are stored across multiple storage nodes. This ensures that even if some nodes are unavailable or fail, sufficient key fragments are available to recover the key.

[0104] For example, suppose we have 5 storage nodes, the dynamic key S is divided into 5 segments, the threshold is set to 3, and the storage nodes are allocated as follows:

[0105] Node 1, key fragment f(1), storage method: local;

[0106] Node 2, key fragment f(2), storage method: cloud;

[0107] Node 3, key fragment f(3), storage method: local;

[0108] Node 4, key fragment f(4), storage method: cloud;

[0109] Node 5, key fragment f(5), storage method: cloud.

[0110] Furthermore, when the system's data processing capabilities are sufficient, encryption technology and distributed storage systems can be combined to ensure the security of key fragments by encrypting them.

[0111] Understandably, dynamic key segmentation and distributed storage further protect the security of dynamic keys, making them less susceptible to cracking and thus protecting the security of user data.

[0112] Step S103: Listen to the front-end application according to the preset specific event listener, determine whether the front-end application has experienced a specific event. If it has, decrypt the initial encrypted data according to the distributed dynamic key storage node and the key name to obtain the initial page data. Modify the initial page data according to the page modification data corresponding to the specific event to determine the corresponding updated page data. Perform a dynamic key update operation according to the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key. Encrypt the updated page data according to the updated dynamic key to determine the corresponding updated encrypted data. The preset specific event includes at least one of front-end application page startup and front-end application page refresh.

[0113] Optionally, the purpose of this step is to update the dynamic key through a specific pattern of the front-end application page, so that whenever a specific pattern occurs, the dynamic key will be updated based on the real-time user behavior data and real-time system environment parameters of the current state. Even if the dynamic key is cracked in the previous step, it cannot be used in subsequent steps, thereby further protecting the user's data security.

[0114] Optionally, in this embodiment, the front-end application is monitored according to a preset specific event listener to determine whether a specific event has occurred in the front-end application.

[0115] Specifically, in front-end applications, an event listener is needed to listen for specific events, including page startup (such as when a user accesses a page) and page refresh (such as when a user refreshes a page).

[0116] Event listeners use JavaScript to listen for these events.

[0117] Optionally, in this embodiment, if this occurs, the initial encrypted data is decrypted based on the distributed dynamic key storage node and the key name to obtain the initial page data.

[0118] Specifically, when a page launch or refresh is detected, the system needs to decrypt the initial encrypted data based on the distributed dynamic key storage node and the key name. At this point, the system first executes the encryption / decryption script. This script attempts to retrieve the corresponding key name from the cache. If the key name matches, Shamir's Secret Sharing is used to obtain the required key fragment from the distributed storage node, and these fragments are used to recover the original dynamic key. Then, this dynamic key is used to decrypt the initial encrypted data.

[0119] For example, we have 5 storage nodes, the dynamic key S is divided into 5 fragments, the threshold is set to 3, and the storage nodes are allocated as follows:

[0120] Node 1, key fragment f(1), storage method: local;

[0121] Node 2, key fragment f(2), storage method: cloud;

[0122] Node 3, key fragment f(3), storage method: local;

[0123] Node 4, key fragment f(4), storage method: cloud;

[0124] Node 5, key fragment f(5), storage method: cloud.

[0125] In this setup, if key recovery is required, key fragments f(1), f(3), and f(4) must be obtained from at least three different storage nodes (e.g., node 1, node 3, and node 4), and then the key S is recovered using Lagrange interpolation. The recovered dynamic key is then used to decrypt the initial encrypted data to obtain the original page data.

[0126] Optionally, in this embodiment, the initial page data is modified according to the page modification data corresponding to the specific event to determine the corresponding updated page data; a dynamic key update operation is performed according to the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key; and the updated page data is encrypted according to the updated dynamic key to determine the corresponding updated encrypted data.

[0127] Specifically, when a page is refreshed or launched, the page data may change. The original data is modified according to the changes in the page data, and a new dynamic key is regenerated based on the user's data modification behavior and the current system environment parameters according to the trained dynamic key generation model. The modified page data is encrypted, and the corresponding key-value pair is regenerated and stored in the system. Similarly, the encrypted new dynamic key is distributed and stored. The updated key name and the dynamic key fragment of the distributed storage node are used for decryption each time a specific event is detected.

[0128] This example demonstrates how this embodiment generates specific dynamic keys based on user behavior data and system environment parameters, then increases security through distributed storage of the dynamic keys, and encrypts user data through dynamic updates, thereby improving the efficiency and security of front-end data storage.

[0129] As described above, the front-end storage encryption method provided in this application can obtain initial key generation data by performing differential privacy fusion operations on user behavior data and system environment parameters. The initial key generation data is then used to train a random forest model to obtain a dynamic key generation model and the dynamic key output by the model. The initial page data of the front-end application is then encrypted using the dynamic key. After encryption, the dynamic key is segmented according to a key splitting algorithm and stored on different nodes to determine a distributed dynamic key storage node. When a specific event occurs, a subkey acquisition request is sent to the distributed dynamic key storage node to obtain the original dynamic key for decryption. The original dynamic key is then updated based on the user behavior data and system environment parameters corresponding to the specific event, and encryption is performed again based on the updated dynamic key. This achieves dynamic encryption, thereby improving the efficiency and security of front-end data storage.

[0130] In one embodiment of the front-end storage encryption method of this application, see [link to relevant documentation]. Figure 2 It can also specifically include the following:

[0131] Step S201: Perform differential privacy protection operation on the user behavior data obtained after the monitoring operation according to the preset utility function to determine the corresponding fuzzy user behavior data;

[0132] Step S202: Perform a data fusion operation on the fuzzy user behavior data and the system environment parameters obtained after the monitoring operation to determine the corresponding initial key generation data.

[0133] Optionally, in this embodiment, differential privacy protection is performed on the user behavior data obtained after the monitoring operation according to a preset utility function to determine the corresponding fuzzy user behavior data. This step performs differential privacy protection on the user behavior data so that individual user behaviors in the data cannot be directly identified, while the statistical effect of the overall dataset can still be achieved.

[0134] Optionally, in this embodiment, a data fusion operation is performed on the fuzzy user behavior data and the system environment parameters obtained after the monitoring operation to determine the corresponding initial key generation data.

[0135] This step fuses privacy-protected user behavior data with raw system environment parameters to obtain initial key generation data, i.e., the model training set, which is used for training the subsequent key generation model.

[0136] Understandably, the system environment parameters do not involve sensitive personal information, so there is no need to protect privacy to increase the uncertainty of the dataset. However, they are related to user behavior and are therefore still very important in model training.

[0137] To avoid leaking user behavior privacy information through system environment parameters, and to ensure the accuracy of these parameters without additional noise injection or obfuscation, this embodiment trains two models independently during the data fusion phase: one based on user behavior data protected by differential privacy, and the other based on system environment parameters. Then, a voting mechanism is used to combine the prediction results of these two sub-models, fusing their outputs.

[0138] In terms of effectiveness, this method avoids directly exposing differential privacy-preserving data to other models, reducing the impact of noise on the results.

[0139] Optionally, after data fusion, the fused data needs to be labeled to form a model training set. During the labeling process, the correlation between user behavior and the system environment's interactive information needs to be considered. The fused data will provide more contextual information, helping to label more accurately.

[0140] Optionally, one annotation method is to annotate the data based on the strength of the generated key (such as encryption strength) so that the model can adaptively generate keys of appropriate strength according to user behavior and system environment.

[0141] Optionally, one annotation method is to directly associate user behavior and environmental data with the generated keys, labeling the category or features of the keys generated under these behaviors and environmental conditions. In this case, keys need to be generated in the training dataset in advance, and the attributes of the generated keys (such as key strength, category, etc.) need to be recorded.

[0142] Optionally, one labeling method involves annotating the training data using the actually generated keys and user feedback (such as successful / failed authentication). That is, the key data is labeled based on whether the key successfully prevents attacks or meets certain security requirements. This requires an existing, preliminary key generation system in operation, which could be a random number generator.

[0143] Understandably, in the task of generating dynamic keys based on user behavior and environmental parameters, the core of data annotation is to associate different user behavior data and environmental parameters with the characteristics of the key. After annotation, the "initial key generation data", i.e. the model training set, can be obtained.

[0144] Through step S202, this embodiment obtains the model training set, laying the data foundation for subsequent training of the dynamic key generation model.

[0145] In one embodiment of the front-end storage encryption method of this application, see [link to relevant documentation]. Figure 3 It can also specifically include the following:

[0146] Step S301: Perform a utility evaluation operation on the user behavior data obtained after the monitoring operation according to the preset utility function, and determine the corresponding utility evaluation result, wherein the utility evaluation result is used to represent the degree of influence of the user behavior data on the result;

[0147] Step S302: Based on the utility evaluation results and the preset privacy loss, noise is added to the user behavior data to determine the corresponding fuzzy user behavior data, wherein the preset privacy loss is used to evaluate the degree of impact of the introduced noise on privacy information.

[0148] Optionally, in this embodiment, the utility function is used to evaluate the sensitivity of user behavior data. Sensitivity measures the degree of influence of a single data item (e.g., a user's behavior data) on the query results. A higher sensitivity indicates a greater effectiveness in protecting the privacy of that data. For example, for a query function f, its sensitivity is defined by calculating the difference in results between the query function and any two adjacent datasets that differ by only one data item. Specifically, for datasets D and D' (which differ only in one element), the sensitivity Δf is the maximum output difference of the query function f on adjacent datasets. Once the sensitivity is determined, differential privacy can be achieved by adding noise to the query results.

[0149] Secondly, after obtaining the sensitivity level, noise is added to the data with the highest sensitivity. The goal is to ensure that the noise protects individual data from being identified while also preventing the original data results from being affected by the noise. This is achieved by introducing privacy loss. Privacy loss involves setting a privacy budget to limit the upper limit of privacy leakage. By adjusting the privacy budget, a balance can be struck between the accuracy of data analysis and the degree of privacy protection.

[0150] By setting a privacy budget, the magnitude of noise and the strength of privacy protection can be controlled, achieving a balance between the accuracy of data analysis and the degree of privacy protection. Understandably, a smaller privacy budget indicates stronger privacy protection (because of more noise), but it also means that the accuracy of query results may decrease. The noise can be either Laplace noise or Gaussian noise, the choice depending on the nature of the data. For very strict privacy requirements, Laplace noise is chosen because it provides the strictest privacy guarantees. For relatively lenient privacy requirements, Gaussian noise is chosen because it is more stable and suitable for more complex queries.

[0151] Preferably, for this embodiment, Gaussian noise is more suitable for adapting to complex data analysis or machine learning tasks. Its lighter tail can adapt to the diversity of data, and it is especially advantageous in the process of iterative optimization. It can better control the privacy budget in multiple queries and provide smoother query results.

[0152] For example, suppose we need to analyze how often users visit different pages, but directly using these statistics might expose a user's browsing behavior.

[0153] To protect privacy, firstly, the average time all users spend accessing the page is calculated; then, the sensitivity of the query results (i.e., the maximum impact of a single user's behavior on the results) is calculated using a utility function; finally, appropriate noise (e.g., Laplace noise) is added to the average to prevent inference of individual user access behavior.

[0154] Understandably, the aforementioned differential privacy protection operations effectively obfuscate and protect user behavior data to prevent the leakage of sensitive information of individual users. At the same time, it lays the foundation for higher security of dynamic keys generated based on user behavior data, because specific user behaviors cannot be cracked, and dynamic keys generated for specific user behaviors are more secure.

[0155] Through step S302, this embodiment achieves differential privacy protection for user behavior, increases the security of user information, and lays the foundation for the subsequent generation of an uncrackable dynamic key.

[0156] In one embodiment of the front-end storage encryption method of this application, see [link to relevant documentation]. Figure 4It can also specifically include the following:

[0157] Step S401: Perform a polynomial construction operation based on the dynamic key, preset share, and preset threshold value to determine the corresponding segmentation polynomial. The preset share is used to determine the number of dynamic key fragments, and the preset threshold value is used to reconstruct the polynomial. The preset threshold value is less than the preset share.

[0158] Step S402: Perform a segmentation operation on the dynamic key according to the segmentation polynomial to determine the corresponding multiple dynamic key fragments.

[0159] Optionally, in this embodiment, Shamir's Secret Sharing algorithm is used to divide the data into multiple shares and distribute them to different nodes. This process requires constructing a partitioning polynomial, in which the dynamic key serves as a constant term and represents the secret we want to keep confidential. The polynomial is used to calculate n key fragments, and each participant receives a key fragment, where n is the partition share. When at least t participants collaborate, the constant term of the polynomial, i.e., the dynamic key, can be recovered using Lagrange interpolation, where t is a threshold value, i.e., the minimum number of fragments required to recover the original key.

[0160] The above segmentation operation yields n key fragments. Distributing these key fragments across different storage nodes is more effective in preventing intrusion and key corruption.

[0161] Through step S402, this embodiment successfully segments the dynamic key, obtaining multiple dynamic key fragments, which increases the difficulty of cracking the dynamic key.

[0162] In one embodiment of the front-end storage encryption method of this application, see [link to relevant documentation]. Figure 5 It can also specifically include the following:

[0163] Step S501: Determine whether a specific event has occurred in the front-end application. If it has, send a subkey provision request to the distributed dynamic key storage node to determine the corresponding multiple subkeys.

[0164] Step S502: Perform a dynamic key restoration operation based on the multiple subkeys, and decrypt the initial encrypted data based on the dynamic key and the key name obtained after the restoration operation to obtain the initial page data.

[0165] Optionally, in this embodiment, specific events include page initiation (such as when a user accesses a page) and page refresh (such as when a user refreshes a page).

[0166] Optionally, in this embodiment, when a page startup or refresh is detected, the system needs to decrypt the initial encrypted data based on the distributed dynamic key storage node and the key name. At this time, the system first executes the encryption / decryption script. This script attempts to retrieve the corresponding key name from the cache. If the key name matches, Shamir's Secret Sharing is used to obtain the required key fragment from the distributed storage node, and these fragments are used to recover the original dynamic key. Then, this dynamic key is used to decrypt the initial encrypted data.

[0167] For example, we have 5 storage nodes, the dynamic key S is divided into 5 fragments, the threshold is set to 3, and the storage nodes are allocated as follows:

[0168] Node 1, key fragment f(1), storage method: local;

[0169] Node 2, key fragment f(2), storage method: cloud;

[0170] Node 3, key fragment f(3), storage method: local;

[0171] Node 4, key fragment f(4), storage method: cloud;

[0172] Node 5, key fragment f(5), storage method: cloud.

[0173] In this setup, if key recovery is required, key fragments f(1), f(3), and f(4) must be obtained from at least three different storage nodes (e.g., node 1, node 3, and node 4), and then the key S is recovered using Lagrange interpolation. The recovered dynamic key is then used to decrypt the initial encrypted data to obtain the original page data.

[0174] Through step S502, this embodiment successfully restored the dynamic key using the subkey, laying the foundation for subsequent dynamic key updates.

[0175] In one embodiment of the front-end storage encryption method of this application, see [link to relevant documentation]. Figure 6 It can also specifically include the following:

[0176] Step S601: Input the initial key generation data as the model training set into the preset random forest model, and train the model according to the cross-validation algorithm to obtain the corresponding dynamic key generation model;

[0177] Step S602: Receive initial real-time user behavior data and real-time system environment parameters, and input the initial real-time user behavior data and the real-time system environment parameters into the dynamic key generation model to obtain the dynamic key output by the dynamic key generation model.

[0178] Optionally, in this embodiment, the "initial key generation data" obtained in step S202, i.e., the model training set, is input into the input layer of the random forest model and converted into corresponding feature vectors. During training, the model determines which features contribute significantly to dynamic key generation based on the influence of each feature. A feature importance scoring algorithm is used to determine which user behaviors and environmental features are most critical for key generation.

[0179] During training, K-fold cross-validation was used to verify the model's generalization ability, ensuring its good adaptability to different types of user behavior. After training, the model's hyperparameters, such as the number of trees, the maximum depth of the trees, and the minimum number of sample splits per tree, were optimized to improve the model's accuracy and generalization ability.

[0180] Once the random forest model is trained, it can be used to generate dynamic keys based on real-time user behavior data and environmental parameters, and these keys will be different each time. Preferably, to improve the adaptability of key generation, the model can be updated periodically, using incremental learning to adapt to new user behavior patterns.

[0181] For example, if a user is active late at night and logs in from a specific region, the model may generate a time-sensitive, region-specific key based on these behaviors.

[0182] If a user frequently transacts on a particular device, the model may generate a key associated with that device based on its characteristics.

[0183] If a user's operating pattern changes significantly (e.g., from normal operation to abnormal activity), the model may detect this change and generate a new key based on the change.

[0184] Through step S602, this embodiment successfully generates a specific dynamic key through model adaptation, laying a solid foundation for increasing user data security.

[0185] In one embodiment of the front-end storage encryption method of this application, see [link to relevant documentation]. Figure 7 It can also specifically include the following:

[0186] Step S701: Obfuscate the visual tracking algorithm according to the preset code obfuscation rules to determine the corresponding obfuscated visual tracking algorithm;

[0187] Step S702: Perform user monitoring operations according to the obfuscated visualization tracking algorithm.

[0188] Optionally, in this embodiment, code obfuscation technology is used during the visualization tracking process to obfuscate the visualization tracking algorithm, making it unrecognizable to external attackers. The obfuscated algorithm can still perform the original monitoring function, but it is difficult for attackers to reverse engineer and exploit it. Preferably, code obfuscation makes the code difficult to understand by modifying its structure, naming, and logic, for example, by renaming variables or flattening the control flow.

[0189] Understandably, hiding the front-end listening operation can improve system security, prevent malicious attackers from discovering the listening mechanism, and ensure the stealth of the listening process.

[0190] Through step S702, this embodiment successfully achieved code obfuscation using visual tracking technology, which hides the monitoring program and prevents malicious attacks from cracking user behavior based on the monitoring program's actions, thereby increasing system security.

[0191] To improve the efficiency and security of front-end data storage, this application provides an embodiment of a front-end storage encryption device for implementing all or part of the aforementioned front-end storage encryption method. See [link to embodiment]. Figure 8 The front-end storage encryption device specifically includes the following components:

[0192] The dynamic key generation module 10 is used to listen to the user in the front-end application after obtaining user information access authorization, perform differential privacy fusion operation on the user behavior data and system environment parameters obtained after the listening operation, determine the corresponding initial key generation data, input the initial key generation data as the model training set into a preset random forest model for model training, obtain the dynamic key generation model, input the initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model to obtain the dynamic key output by the dynamic key generation model, encrypt the initial page data of the front-end application according to the dynamic key, determine the corresponding initial encrypted data, and store the decryption information corresponding to the initial encrypted data in key-value pairs to determine the corresponding key name;

[0193] The dynamic key distribution storage module 20 is used to perform segmentation operations on the dynamic key according to a preset key segmentation algorithm to determine multiple corresponding dynamic key fragments, and to perform storage operations on the multiple dynamic key fragments according to preset storage nodes to determine the corresponding distributed dynamic key storage nodes.

[0194] The dynamic key update module 30 is used to listen to the front-end application according to a preset specific event listener, determine whether a specific event has occurred in the front-end application, and if so, decrypt the initial encrypted data according to the distributed dynamic key storage node and the key name to obtain the initial page data, modify the initial page data according to the page modification data corresponding to the specific event to determine the corresponding updated page data, perform a dynamic key update operation according to the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key, and encrypt the updated page data according to the updated dynamic key to determine the corresponding updated encrypted data. The preset specific event includes at least one of front-end application page startup and front-end application page refresh.

[0195] As described above, the front-end storage encryption device provided in this application embodiment can obtain initial key generation data by performing differential privacy fusion operations on user behavior data and system environment parameters. It then trains a random forest model using the initial key generation data to obtain a dynamic key generation model and the dynamic key output by the model. The device encrypts the initial page data of the front-end application using the dynamic key. After encryption, the dynamic key is segmented according to a key splitting algorithm and stored on different nodes to determine a distributed dynamic key storage node. When a specific event occurs, a subkey acquisition request is sent to the distributed dynamic key storage node to obtain the original dynamic key for decryption. The original dynamic key is then updated based on the user behavior data and system environment parameters corresponding to the specific event, and encryption is performed again using the updated dynamic key. This achieves dynamic encryption, thereby improving the efficiency and security of front-end data storage.

[0196] From a hardware perspective, in order to improve the efficiency and security of front-end data storage, this application provides an embodiment of an electronic device for implementing all or part of the aforementioned front-end storage encryption method. The electronic device specifically includes the following components:

[0197] The system comprises a processor, memory, a communications interface, and a bus; wherein the processor, memory, and communications interface communicate with each other via the bus; the communications interface is used to realize information transmission between the front-end storage encryption method and core business systems, user terminals, and related databases and other related devices; the logic controller can be a desktop computer, tablet computer, or mobile terminal, etc., and this embodiment is not limited to these. In this embodiment, the logic controller can be implemented with reference to the embodiments of the front-end storage encryption method in the previous embodiment, and the content of the embodiments of the front-end storage encryption method is incorporated herein, and repeated parts will not be described again.

[0198] It is understood that the user terminal may include smartphones, tablet computers, network set-top boxes, portable computers, desktop computers, personal digital assistants (PDAs), in-vehicle devices, smart wearable devices, etc. Among these, the smart wearable devices may include smart glasses, smartwatches, smart bracelets, etc.

[0199] In practical applications, the front-end storage encryption method can be executed on the electronic device side as described above, or all operations can be completed on the client device. The choice can be made based on the processing power of the client device and the limitations of the user's usage scenario. This application does not impose any limitations on this. If all operations are completed on the client device, the client device may further include a processor.

[0200] The aforementioned client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission. The server may include a server on the task scheduling center side; in other implementation scenarios, it may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a distributed server structure.

[0201] Figure 9 This is a schematic block diagram illustrating the system configuration of the electronic device 9600 according to an embodiment of this application. Figure 9 As shown, the electronic device 9600 may include a central processing unit 9100 and a memory 9140; the memory 9140 is coupled to the central processing unit 9100. It is worth noting that... Figure 9 This is an example; other types of structures can also be used to supplement or replace this structure to achieve telecommunications functions or other functions.

[0202] In one embodiment, the front-end storage encryption method functionality can be integrated into the central processing unit 9100. The central processing unit 9100 can be configured to perform the following controls:

[0203] Step S101: After obtaining user information access authorization, the front-end application performs a monitoring operation on the user, performs differential privacy fusion operation on the user behavior data and system environment parameters obtained after the monitoring operation, determines the corresponding initial key generation data, inputs the initial key generation data as the model training set into a preset random forest model for model training, obtains a dynamic key generation model, inputs the initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model, obtains the dynamic key output by the dynamic key generation model, encrypts the initial page data of the front-end application according to the dynamic key, determines the corresponding initial encrypted data, and stores the decryption information corresponding to the initial encrypted data in key-value pairs, determines the corresponding key name;

[0204] Step S102: Perform a segmentation operation on the dynamic key according to a preset key segmentation algorithm to determine multiple corresponding dynamic key fragments, and perform storage operations on the multiple dynamic key fragments according to preset storage nodes to determine the corresponding distributed dynamic key storage nodes.

[0205] Step S103: Listen to the front-end application according to the preset specific event listener, determine whether the front-end application has experienced a specific event. If it has, decrypt the initial encrypted data according to the distributed dynamic key storage node and the key name to obtain the initial page data. Modify the initial page data according to the page modification data corresponding to the specific event to determine the corresponding updated page data. Perform a dynamic key update operation according to the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key. Encrypt the updated page data according to the updated dynamic key to determine the corresponding updated encrypted data. The preset specific event includes at least one of front-end application page startup and front-end application page refresh.

[0206] As described above, the electronic device provided in this application embodiment obtains initial key generation data by performing differential privacy fusion on user behavior data and system environment parameters. A random forest model is trained using the initial key generation data to obtain a dynamic key generation model and the dynamic key output by the model. The initial page data of the front-end application is encrypted using the dynamic key. After encryption, the dynamic key is segmented according to a key splitting algorithm and stored on different nodes to determine a distributed dynamic key storage node. When a specific event occurs, a subkey acquisition request is sent to the distributed dynamic key storage node to obtain the original dynamic key for decryption. Then, the original dynamic key is updated according to the user behavior data and system environment parameters corresponding to the specific event, and encryption is performed again using the updated dynamic key. This achieves dynamic encryption, thereby improving the efficiency and security of front-end data storage.

[0207] In another embodiment, the front-end storage encryption method can be configured separately from the central processing unit 9100. For example, the front-end storage encryption method can be configured as a chip connected to the central processing unit 9100, and the front-end storage encryption method function can be implemented through the control of the central processing unit.

[0208] like Figure 9 As shown, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily need to include these components. Figure 9 All components shown; in addition, the electronic device 9600 may also include Figure 9 For components not shown, please refer to existing technologies.

[0209] like Figure 9 As shown, the central processing unit 9100, sometimes also referred to as a controller or operating control, may include a microprocessor or other processor device and / or logic device, which receives inputs and controls the operation of various components of the electronic device 9600.

[0210] The memory 9140 may be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It may store the aforementioned failure-related information, and also store a program for executing that information. The central processing unit 9100 may execute the program stored in the memory 9140 to perform information storage or processing, etc.

[0211] Input unit 9120 provides input to central processing unit 9100. Input unit 9120 may be, for example, a keypad or touch input device. Power supply 9170 provides power to electronic device 9600. Display 9160 displays images and text. Display may be, for example, an LCD display, but is not limited thereto.

[0212] The memory 9140 can be a solid-state memory, such as a read-only memory (ROM), random access memory (RAM), a SIM card, etc. It can also be a memory that retains information even when power is off, can be selectively erased, and contains more data; examples of this type of memory are sometimes referred to as EPROMs. The memory 9140 can also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142 for storing application programs and function programs or processes for executing the operation of the electronic device 9600 via the central processing unit 9100.

[0213] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers for the electronic device's communication functions and / or for performing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0214] The communication module 9110 is a transmitter / receiver that sends and receives signals via the antenna 9111. The communication module 9110 is coupled to the central processing unit 9100 to provide input signals and receive output signals, which is the same as in a conventional mobile communication terminal.

[0215] Based on different communication technologies, multiple communication modules 9110 can be configured in the same electronic device, such as cellular network modules, Bluetooth modules, and / or wireless LAN modules. The communication module 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby realizing typical telecommunications functions. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. Furthermore, the audio processor 9130 is also coupled to a central processing unit 9100, enabling on-device recording via the microphone 9132 and on-device playback of stored sound via the speaker 9131.

[0216] Embodiments of this application also provide a computer program product capable of implementing all steps of the front-end storage encryption method with the execution subject being a server or client in the above embodiments. When the computer program / instructions are executed by a processor, they implement the steps of the front-end storage encryption method. For example, the computer program / instructions implement the following steps:

[0217] Step S101: After obtaining user information access authorization, the front-end application performs a monitoring operation on the user, performs differential privacy fusion operation on the user behavior data and system environment parameters obtained after the monitoring operation, determines the corresponding initial key generation data, inputs the initial key generation data as the model training set into a preset random forest model for model training, obtains a dynamic key generation model, inputs the initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model, obtains the dynamic key output by the dynamic key generation model, encrypts the initial page data of the front-end application according to the dynamic key, determines the corresponding initial encrypted data, and stores the decryption information corresponding to the initial encrypted data in key-value pairs, determines the corresponding key name;

[0218] Step S102: Perform a segmentation operation on the dynamic key according to a preset key segmentation algorithm to determine multiple corresponding dynamic key fragments, and perform storage operations on the multiple dynamic key fragments according to preset storage nodes to determine the corresponding distributed dynamic key storage nodes.

[0219] Step S103: Listen to the front-end application according to the preset specific event listener, determine whether the front-end application has experienced a specific event. If it has, decrypt the initial encrypted data according to the distributed dynamic key storage node and the key name to obtain the initial page data. Modify the initial page data according to the page modification data corresponding to the specific event to determine the corresponding updated page data. Perform a dynamic key update operation according to the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key. Encrypt the updated page data according to the updated dynamic key to determine the corresponding updated encrypted data. The preset specific event includes at least one of front-end application page startup and front-end application page refresh.

[0220] As described above, the computer program product provided in this application embodiment obtains initial key generation data by performing differential privacy fusion operations on user behavior data and system environment parameters. A random forest model is trained using the initial key generation data to obtain a dynamic key generation model and the dynamic key output by the model. The initial page data of the front-end application is encrypted using the dynamic key. After encryption, the dynamic key is segmented according to a key splitting algorithm and stored on different nodes to determine a distributed dynamic key storage node. When a specific event occurs, a subkey acquisition request is sent to the distributed dynamic key storage node to obtain the original dynamic key for decryption. Then, the original dynamic key is updated according to the user behavior data and system environment parameters corresponding to the specific event, and encryption is performed again using the updated dynamic key. This achieves dynamic encryption, thereby improving the efficiency and security of front-end data storage.

[0221] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0222] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0223] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0224] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0225] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A front-end storage encryption method, characterized in that, The method includes: After obtaining user information access authorization, the front-end application performs a monitoring operation on the user. Differential privacy fusion is performed on the user behavior data and system environment parameters obtained after the monitoring operation to determine the corresponding initial key generation data. The initial key generation data is used as the model training set and input into a preset random forest model for model training to obtain a dynamic key generation model. The initial real-time user behavior data and real-time system environment parameters are input into the dynamic key generation model to obtain the dynamic key output by the dynamic key generation model. The initial page data of the front-end application is encrypted according to the dynamic key to determine the corresponding initial encrypted data. The decryption information corresponding to the initial encrypted data is stored in key-value pairs to determine the corresponding key name. The dynamic key is segmented according to a preset key segmentation algorithm to determine multiple corresponding dynamic key fragments. The multiple dynamic key fragments are stored according to preset storage nodes to determine the corresponding distributed dynamic key storage nodes. The front-end application is monitored by a preset specific event listener to determine whether a specific event has occurred. If so, the initial encrypted data is decrypted using the distributed dynamic key storage node and the key name to obtain the initial page data. The initial page data is then modified based on the page modification data corresponding to the specific event to determine the corresponding updated page data. A dynamic key update operation is performed based on the user behavior data and system environment parameters corresponding to the specific event to determine the corresponding updated dynamic key. Finally, the updated page data is encrypted using the updated dynamic key to determine the corresponding updated encrypted data. The preset specific event includes at least one of front-end application page startup and front-end application page refresh.

2. The front-end storage encryption method according to claim 1, characterized in that, The step of performing differential privacy fusion on the user behavior data and system environment parameters obtained after the monitoring operation to determine the corresponding initial key generation data includes: Based on a preset utility function, differential privacy protection operation is performed on the user behavior data obtained after the monitoring operation to determine the corresponding fuzzy user behavior data. A data fusion operation is performed on the fuzzy user behavior data and the system environment parameters obtained after the monitoring operation to determine the corresponding initial key generation data.

3. The front-end storage encryption method according to claim 2, characterized in that, The step of performing differential privacy protection on the user behavior data obtained after the monitoring operation according to a preset utility function to determine the corresponding fuzzy user behavior data includes: The user behavior data obtained after the monitoring operation is evaluated according to the preset utility function to determine the corresponding utility evaluation result, wherein the utility evaluation result is used to represent the degree of influence of the user behavior data on the result. Based on the utility evaluation results and the preset privacy loss, noise is added to the user behavior data to determine the corresponding fuzzy user behavior data. The preset privacy loss is used to evaluate the degree of impact of the introduced noise on privacy information.

4. The front-end storage encryption method according to claim 1, characterized in that, The step of segmenting the dynamic key according to a preset key segmentation algorithm to determine multiple corresponding dynamic key fragments includes: A polynomial construction operation is performed based on the dynamic key, the preset share, and the preset threshold value to determine the corresponding segmentation polynomial. The preset share is used to determine the number of dynamic key fragments, and the preset threshold value is used to reconstruct the polynomial. The preset threshold value is less than the preset share. The dynamic key is segmented according to the segmentation polynomial to determine multiple corresponding dynamic key fragments.

5. The front-end storage encryption method according to claim 1, characterized in that, The determination of whether a specific event has occurred in the front-end application, and if so, the initial encrypted data being decrypted based on the distributed dynamic key storage node and the key name to obtain the initial page data, including: Determine whether a specific event has occurred in the front-end application. If it has, send a subkey provision request to the distributed dynamic key storage node to determine the corresponding multiple subkeys. A dynamic key restoration operation is performed based on the multiple subkeys, and the initial encrypted data is decrypted based on the dynamic key and the key name obtained after the restoration operation to obtain the initial page data.

6. The front-end storage encryption method according to claim 1, characterized in that, The process of using the initial key generation data as a model training set to input into a preset random forest model for model training to obtain a dynamic key generation model, and inputting initial real-time user behavior data and real-time system environment parameters into the dynamic key generation model to obtain the dynamic key output by the dynamic key generation model includes: The initial key generation data is used as the model training set and input into a preset random forest model. The model is trained according to the cross-validation algorithm to obtain the corresponding dynamic key generation model. The system receives initial real-time user behavior data and real-time system environment parameters, and inputs the initial real-time user behavior data and the real-time system environment parameters into the dynamic key generation model to obtain the dynamic key output by the dynamic key generation model.

7. The front-end storage encryption method according to claim 1, characterized in that, The aforementioned user monitoring operation in the front-end application includes: The visual tracking algorithm is obfuscated according to the preset code obfuscation rules to determine the corresponding obfuscated visual tracking algorithm. The user is monitored using the obfuscated visualization tracking algorithm.

8. A front-end storage encryption device, characterized in that, The device includes: The dynamic key generation module is used to listen to users in the front-end application after obtaining user information access authorization. It performs differential privacy fusion on the user behavior data and system environment parameters obtained after the listening operation to determine the corresponding initial key generation data. The initial key generation data is used as the model training set and input into a preset random forest model for model training to obtain a dynamic key generation model. The initial real-time user behavior data and real-time system environment parameters are input into the dynamic key generation model to obtain the dynamic key output by the dynamic key generation model. The initial page data of the front-end application is encrypted according to the dynamic key to determine the corresponding initial encrypted data. The decryption information corresponding to the initial encrypted data is stored in key-value pairs to determine the corresponding key name. The dynamic key distribution storage module is used to perform segmentation operations on the dynamic key according to a preset key segmentation algorithm to determine multiple corresponding dynamic key fragments, and to perform storage operations on the multiple dynamic key fragments according to preset storage nodes to determine the corresponding distributed dynamic key storage nodes. The dynamic key update module is used to listen to the front-end application according to a preset specific event listener, determine whether a specific event has occurred in the front-end application, and if so, decrypt the initial encrypted data according to the distributed dynamic key storage node and the key name to obtain the initial page data. Then, it modifies the initial page data according to the page modification data corresponding to the specific event to determine the corresponding updated page data. Finally, it performs a dynamic key update operation according to the user behavior data and environment parameters corresponding to the specific event to determine the corresponding updated dynamic key, and encrypts the updated page data according to the updated dynamic key to determine the corresponding updated encrypted data. The preset specific event includes at least one of front-end application page startup and front-end application page refresh.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the front-end storage encryption method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the front-end storage encryption method according to any one of claims 1 to 7.

Images