Data encryption writing method, device and equipment based on trusted key and medium

Abstract

Embodiments of the present disclosure disclose a data encryption writing method and device based on a trusted key, equipment and a medium. A specific implementation of the method comprises: determining transmission private key information corresponding to data writing request information based on the data writing request information; performing writing lock state detection processing to obtain writing lock state detection information; in response to determining that the writing lock state detection information represents that writing has not been performed, performing decryption operation on encrypted writing data based on the transmission private key information to obtain decrypted writing data; generating storage key information; performing storage encryption processing on the decrypted writing data based on the storage key information to obtain encrypted storage writing data; generating storage location information corresponding to the encrypted storage writing data; storing the encrypted storage writing data to a storage location corresponding to the storage location information; and sending a data writing feedback message representing that data writing is successful to a mobile terminal. The implementation reduces the number of data storage failures.

Description

TECHNICAL FIELD

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular, to a data encryption writing method and device based on a trusted key, equipment and medium. BACKGROUND

[0002] The data encryption writing based on a trusted key is a technology for storing data sent by a mobile terminal. At present, when storing data sent by a mobile terminal, the commonly used way is to directly store the data sent by the mobile terminal to the data storage area without writing lock state detection.

[0003] However, when the above-mentioned way is used to store the data sent by the mobile terminal, the following technical problems often exist:

[0004] Without writing lock state detection, the data sent by the mobile terminal is directly stored to the data storage area. When multiple mobile terminals simultaneously attempt to write data to the server, if lock state detection is not performed, the risk of data being overwritten, modified or lost may be increased, and the number of data storage failures is increased.

[0005] The above information disclosed in the background section is only for the purpose of enhancing the understanding of the background of the present inventive concept, and therefore, it can include information that does not form the prior art known to those of ordinary skill in the art. SUMMARY

[0006] The summary section of the present disclosure is used to introduce the concepts in a brief form, which will be described in detail in the specific embodiments section. The summary section of the present disclosure is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to be used to limit the scope of the claimed technical solutions.

[0007] Some embodiments of the present disclosure propose a data encryption writing method and device based on a trusted key, equipment and medium to solve one or more of the technical problems mentioned in the background section.

[0008] In a first aspect, some embodiments of the present disclosure provide a data encryption writing method based on a trusted key, the method comprising: in response to receiving data writing request information sent by a mobile terminal, determining transmission private key information corresponding to the data writing request information based on the data writing request information; in response to receiving encrypted writing data sent by the mobile terminal, performing writing lock state detection processing to obtain writing lock state detection information; in response to determining that the writing lock state detection information indicates that writing has not been performed, performing decryption operation on the encrypted writing data based on the transmission private key information to obtain decrypted writing data; generating storage key information based on the data writing request information, wherein the storage key information comprises storage public key information and storage private key information; performing storage encryption processing on the decrypted writing data based on the storage key information to obtain encrypted storage writing data; generating storage location information corresponding to the encrypted storage writing data based on the data writing request information; storing the encrypted storage writing data to a storage location corresponding to the storage location information; and sending a data writing feedback message indicating that data writing is successful to the mobile terminal, so that the mobile terminal displays the data writing feedback message.

[0009] In a second aspect, some embodiments of the present disclosure provide a data encryption writing device based on a trusted key, the device comprising: a determination unit configured to, in response to receiving data writing request information sent by a mobile terminal, determine transmission private key information corresponding to the data writing request information based on the data writing request information; a writing lock state detection unit configured to, in response to receiving encrypted writing data sent by the mobile terminal, perform writing lock state detection processing to obtain writing lock state detection information; a decryption operation unit configured to, in response to determining that the writing lock state detection information indicates that writing has not been performed, perform decryption operation on the encrypted writing data based on the transmission private key information to obtain decrypted writing data; a first generation unit configured to generate storage key information based on the data writing request information, wherein the storage key information comprises storage public key information and storage private key information; a storage encryption unit configured to perform storage encryption processing on the decrypted writing data based on the storage key information to obtain encrypted storage writing data; a second generation unit configured to generate storage location information corresponding to the encrypted storage writing data based on the data writing request information; a storage unit configured to store the encrypted storage writing data to a storage location corresponding to the storage location information; and a sending unit configured to send a data writing feedback message indicating that data writing is successful to the mobile terminal, so that the mobile terminal displays the data writing feedback message.

[0010] In a third aspect, some embodiments of the present disclosure provide an electronic device, comprising: one or more processors; a storage device having stored thereon one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement the method described in any implementation manner of the first aspect.

[0011] In a fourth aspect, some embodiments of the present disclosure provide a computer readable medium having stored thereon a computer program, wherein the program, when executed by a processor, implements the method described in any implementation manner of the first aspect.

[0012] The above various embodiments of the present disclosure have the following beneficial effects: the number of data storage failures is reduced by the data encryption write method based on a trusted key of some embodiments of the present disclosure. Specifically, the reason for the increase in the number of data storage failures is that the write lock state detection is not performed, and the data sent by the mobile terminal is directly stored in the data storage area. When multiple mobile terminals simultaneously attempt to write data to the server, if the lock state detection is not performed, the risk of data being overwritten, modified or lost may be increased, and the number of data storage failures is increased. Based on this, the data encryption write method based on a trusted key of some embodiments of the present disclosure first, in response to receiving the data write request information sent by the mobile terminal, determines the transmission private key information corresponding to the data write request information based on the data write request information. Thus, the transmission private key information used to decrypt the encrypted write data sent by the mobile terminal can be obtained. Then, in response to receiving the encrypted write data sent by the mobile terminal, write lock state detection processing is performed to obtain write lock state detection information. Thus, the write lock state detection processing can be performed to obtain the write lock state detection information representing the write lock state of the storage device, storage system or storage location. Then, in response to determining that the write lock state detection information represents that no write is performed, the encrypted write data is decrypted based on the transmission private key information to obtain decrypted write data. Thus, the encrypted write data sent by the mobile terminal can be decrypted in the state that no write is performed to obtain the data sent by the mobile terminal, i.e., the decrypted write data. Next, the storage key information is generated based on the data write request information, wherein the storage key information includes storage public key information and storage private key information. Thus, the storage key information for storage encryption processing of the decrypted write data can be generated. Then, the storage encryption processing of the decrypted write data is performed based on the storage key information to obtain encrypted storage write data. Thus, the storage encryption processing of the data can be performed before the data sent by the mobile terminal is stored to ensure the security of data storage. Then, the storage location information corresponding to the encrypted storage write data is generated based on the data write request information. Thus, the storage location information for storing the encrypted storage write data can be generated. Then, the encrypted storage write data is stored in the storage location corresponding to the storage location information. Finally, the data write feedback message representing the success of data write is sent to the mobile terminal for displaying the data write feedback message by the mobile terminal. Thus, the data write feedback message representing the success of data write can be sent to the mobile terminal. Also, the write lock state detection processing is performed before the data sent by the mobile terminal (i.e., the decrypted write data) is stored to obtain the write lock state detection information representing the write lock state of the storage device or storage location.And in the write lock state detection information represents the state of not writing, the data sent by the mobile terminal is encrypted and stored subsequently, reducing the risk of data being overwritten, modified or lost caused by multiple mobile terminals simultaneously attempting to write data to the server, reducing the number of data storage failures. BRIEF DESCRIPTION OF DRAWINGS

[0013] The above and other features, advantages and aspects of embodiments of the present disclosure will become more apparent by describing in detail some embodiments thereof with reference to the attached drawings in which:

[0014] Figure 1 is a flowchart of some embodiments of a trusted key-based data encryption write method according to the present disclosure;

[0015] Figure 2 is a structural schematic diagram of some embodiments of a trusted key-based data encryption write device according to the present disclosure;

[0016] Figure 3 is a structural schematic diagram of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0017] Embodiments of the present disclosure will be described below in more detail with reference to the accompanying drawings. Although some embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms, and should not be interpreted as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes, and are not intended to limit the scope of protection of the present disclosure.

[0018] In addition, it should be further noted that only parts related to the invention are shown in the drawings for ease of description. The embodiments in the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0019] It should be noted that the concepts of "first", "second", etc. mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not intended to limit the order or interdependence of the functions performed by these devices, modules or units.

[0020] It should be noted that the adjectives "one", "multiple" mentioned in the present disclosure are illustrative and not limiting, and those skilled in the art should understand that unless otherwise explicitly stated in the context, it should be understood as "one or more".

[0021] Names of messages or information exchanged between multiple devices in the embodiments of the present disclosure are only for illustrative purposes, and are not intended to limit the scope of the messages or information.

[0022] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0023] Figure 1 Flow 100 of some embodiments of a trusted key-based data encryption writing method according to the present disclosure is shown. The trusted key-based data encryption writing method includes the following steps:

[0024] Step 101, in response to receiving data writing request information sent by a mobile terminal, determining transmission private key information corresponding to the data writing request information based on the data writing request information.

[0025] In some embodiments, the execution subject (e.g., a server) of the trusted key-based data encryption writing method can determine transmission private key information corresponding to the data writing request information based on the data writing request information in response to receiving data writing request information sent by a mobile terminal. Wherein the mobile terminal uses a computer device (e.g., a smartphone, a computer, etc.). The data writing request information includes data source identification, user identification, mobile terminal device identification, access token information. The data source identification can be a unit ID or an organization ID. The user identification can be a username. The mobile terminal device identification can be a specific code or number of the mobile terminal device. The access token information includes header information, payload information, and signature information. The header information can represent the header of the token represented by the access token information. The payload information can represent the payload of the token represented by the access token information. The signature information can represent the signature of the token represented by the access token information.

[0026] In some optional implementations of some embodiments, the execution subject can determine the transmission private key information corresponding to the data writing request information based on the data writing request information by the following steps:

[0027] First, token verification processing is performed on the access token information to obtain token verification information.

[0028] Second, in response to determining that the token verification information represents successful token verification, the data writing request information is sent to a pre-set secure password card to obtain transmission private key information corresponding to the data writing request information from the secure password card. Wherein the transmission private key information can represent a private key for decrypting encrypted writing data. The transmission private key information corresponds to one of the data source identification, the user identification, and the mobile terminal device identification in the data writing request information.

[0029] In some optional implementations of some embodiments, the above execution subject can perform token verification processing on the above access token information to obtain token verification information by the following steps:

[0030] Firstly, obtain system time.

[0031] Secondly, in response to determining that the system time is within the time limit of the token validity period included in the access token information, encode the header information and the payload information to obtain a first encoding corresponding to the header information and a second encoding corresponding to the payload information. In practice, the execution subject can perform Base64 encoding on the header information and the payload information to obtain the first encoding corresponding to the header information and the second encoding corresponding to the payload information.

[0032] Thirdly, splice the first encoding and the second encoding to obtain spliced encoding. In practice, the execution subject can splice the first encoding and the second encoding in the order of the first encoding first and the second encoding second to obtain the spliced encoding. As an example, the first encoding can be "R29vZ". The second encoding can be "SSBsb3". The spliced encoding can be "R29vZSSBsb3".

[0033] Fourthly, encrypt the spliced encoding to obtain to-be-verified signature information. In practice, the execution subject can perform a preset encryption algorithm (for example, AES encryption algorithm) to encrypt the spliced encoding to obtain encrypted data as the to-be-verified signature information.

[0034] Fifthly, in response to determining that the to-be-verified signature information and the signature information included in the access token information are different, determine information representing that the token verification is unsuccessful as the token verification information. The information representing that the token verification is unsuccessful can be text information. For example, the information representing that the token verification is unsuccessful can be "token verification unsuccessful".

[0035] Sixthly, in response to determining that the to-be-verified signature information and the signature information included in the access token information are the same, determine information representing that the token verification is successful as the token verification information. The information representing that the token verification is successful can be text information.

[0036] Step 102, in response to receiving the encrypted write data sent by the mobile terminal, perform write lock state detection processing to obtain write lock state detection information.

[0037] In some embodiments, the execution subject can perform write lock state detection processing in response to receiving the encrypted write data sent by the mobile terminal, and obtain write lock state detection information. The write lock state detection information can represent whether data is being written or stored in the storage device, storage system or storage location associated with the server before the encrypted write data sent by the mobile terminal is stored. For example, the write lock state detection information can be text information representing no write or write lock. Alternatively, in practice, the execution subject can call a lock detection API interface to perform write lock state detection processing and obtain write lock state detection information.

[0038] In the process of solving the problems mentioned in the background by using the technical solutions, the following problems often occur:

[0039] Before storing the data sent by the mobile terminal in the data storage area, write lock state detection needs to be performed. However, the database records the state of no write or write lock in real time, and determines the state of no write or write lock corresponding to the current time by querying the database as write lock state detection information. In a high-concurrency environment, continuously recording and querying the database in real time can cause a large load on the database, and recording the write lock state in real time can occupy a large amount of storage space and waste storage resources.

[0040] To solve the above technical problems, the inventors have decided to use the following solutions:

[0041] In some optional implementations of some embodiments, the execution subject can perform write lock state detection processing in response to receiving the encrypted write data sent by the mobile terminal, and obtain write lock state detection information by the following steps:

[0042] First, in response to receiving the encrypted write data sent by the mobile terminal, the following write lock state detection processing is performed:

[0043] First sub-step, send a preset data packet to a preset coordinator. The preset data packet can be a heartbeat packet for detecting whether the coordinator (such as a coordination service or a pre-configured system or component) is in an active state and whether it is performing some operations (such as write operations). Here, the preset coordinator can receive the heartbeat packet and send feedback information when the storage device, storage system or storage location is in a state of no write. For example, the feedback information can be "storage device is idle, please prepare data for writing".

[0044] Second sub-step, determine the sending time of the preset data packet and the system time.

[0045] A third sub-step, performing the following determination step according to the sending time and the system time.

[0046] A first sub-step, determining the time interval between the system time and the sending time.

[0047] A second sub-step, performing the following steps in response to determining that the time interval is less than or equal to a preset value:

[0048] A first sub-step, in response to detecting the feedback information sent by the preset coordinator, determining information indicating that the write is not performed as the write lock state detection information. For example, the above-mentioned preset value can be "10 minutes".

[0049] A second sub-step, in response to not detecting the feedback information sent by the preset coordinator, determining the system time again after a preset time period of the sending time, and performing the determination step again according to the system time determined again.

[0050] A third sub-step, performing the following steps in response to determining that the time interval is greater than the preset value and not detecting the feedback information sent by the preset coordinator:

[0051] A first sub-step, determining information indicating the write lock as the write lock state detection information.

[0052] A second sub-step, sending the preset write lock prompt information to the mobile terminal, and performing the write lock state detection processing again.

[0053] The above technical solution and related content as an inventive point of an embodiment of the present disclosure solves the technical problem of wasting storage resources. The factors that waste storage resources are often as follows: before storing the data sent by the mobile terminal to the data storage area, write lock state detection needs to be performed. However, the database records the state of not performing write or write locking in real time, and determines the state of not performing write or write locking corresponding to the current time as write lock state detection information by querying the database. In a high-concurrency environment, continuously recording and querying the database in real time can make the load of the database larger, and recording the write lock state in real time can occupy a large amount of storage space, wasting storage resources. If the above factors are solved, the waste of storage resources can be reduced. In order to achieve this effect, first, in response to receiving the encrypted write data sent by the mobile terminal, the following write lock state detection processing is performed: first, a preset data packet is sent to a preset coordinator. Second, the sending time of the preset data packet and the system time are determined. Thus, the sending time and the system time used to determine the time interval can be obtained. Third, according to the sending time and the system time, the following determination step is performed: first sub-step, determine the time interval between the system time and the sending time. Thus, the time interval between the real-time time (i.e. the system time) and the sending time can be determined. Second sub-step, in response to determining that the time interval is less than or equal to a preset value, the following steps are performed: sub-step one, in response to detecting feedback information sent by the preset coordinator, determine information indicating that write is not performed as write lock state detection information. Thus, in the case that the time interval is less than or equal to the preset value and the preset coordinator responds to the data packet, i.e. receives the feedback information sent by the preset coordinator, the information indicating that write is performed is determined as the write lock state detection information. Sub-step two, in response to not detecting the feedback information sent by the preset coordinator, the system time is determined again after a preset time period of the sending time, and the determination step is performed again according to the system time determined again. Thus, in the case that the time interval between the real-time time (i.e. the system time) and the sending time is less than or equal to the preset value, the write lock state detection processing is performed in real time through the above determination step. Fourth, in response to determining that the time interval is greater than the preset value and that the feedback information sent by the preset coordinator is not detected, the following steps are performed: sub-step one, determine information indicating that write is locked as write lock state detection information. Sub-step two, send the preset write lock prompt information to the mobile terminal, and perform the write lock state detection processing again. Thus, in the case that the time interval is greater than the preset value and the feedback information sent by the preset coordinator is not detected, the preset write lock prompt information is sent to the mobile terminal, and the write lock state detection processing is continuously performed in real time.Also, the system writes state is determined by sending the preset data packet to the preset collaborator in real time, detecting whether the preset collaborator responds to the data packet, without recording the write lock state in real time, thereby reducing the waste of storage resources.

[0054] In step 103, in response to determining that the write lock state detection information represents that no write is performed, the encrypted write data is decrypted based on the transmission private key information to obtain decrypted write data.

[0055] In some embodiments, the execution subject can decrypt the encrypted write data based on the transmission private key information to obtain decrypted write data in response to determining that the write lock state detection information represents that no write is performed. In practice, the execution subject can perform a preset decryption algorithm (for example, RSA decryption algorithm), transmission private key information, and decryption operation on the encrypted write data to obtain decrypted write data. The transmission private key information can represent a private key for decrypting the encrypted write data. The decrypted write data can be the data obtained after decrypting the encrypted write data.

[0056] In step 104, the storage key information is generated based on the data write request information, wherein the storage key information includes storage public key information and storage private key information.

[0057] In some embodiments, the execution subject can generate storage key information based on the data write request information. The storage key information includes storage public key information and storage private key information. The storage public key information can be a key (i.e. trusted key) for encrypting the decrypted write data. The storage private key information can be a key for decrypting the data.

[0058] In some optional implementations of some embodiments, the execution subject can generate storage key information based on the data write request information by the following steps:

[0059] First, the data source identifier included in the data write request information is determined as a to-be-searched data source identifier.

[0060] Second, the to-be-searched data source identifier is input into a preset secure password card to obtain a query storage key information set corresponding to the to-be-searched data source identifier from the preset secure password card. Each query storage key information in the query storage key information set corresponds to a user identifier. The secure password card can be a password card embedded in a server or other device. The query storage key information set can be each key information corresponding to the data source identifier and stored in the secure password card in advance. Each key information in the key information set represents a key pair (for example, a public key and a private key pair).

[0061] Thirdly, the user identifier included in the data write request information is determined as the to-be-queried user identifier.

[0062] Fourthly, the query storage key information corresponding to the to-be-queried user identifier in the query storage key information set is determined as the storage key information.

[0063] In step 105, the decrypted write data is stored and encrypted based on the storage key information, and encrypted storage write data is obtained.

[0064] In some embodiments, the execution subject can store and encrypt the decrypted write data based on the storage key information, and obtain encrypted storage write data.

[0065] In some optional implementations of some embodiments, the execution subject can store and encrypt the decrypted write data based on the storage key information by the following steps, and obtain encrypted storage write data:

[0066] Firstly, the storage public key information included in the storage key information is stored. In practice, the execution subject can store the storage public key information in a preset database.

[0067] Secondly, the storage private key information included in the storage key information is determined as the to-be-extended key information.

[0068] Thirdly, the decrypted write data is stored and encrypted based on the to-be-extended key information, and encrypted storage write data is obtained.

[0069] In the process of solving the problems mentioned in the background by the technical solutions, the following problems often occur:

[0070] Before storing the decrypted write data, in order to ensure the security of data storage, the decrypted write data needs to be encrypted. The decrypted write data is directly statically encrypted according to a key. Static encryption usually only performs one encryption operation, is vulnerable to brute force attacks, and thus the security of the decrypted write data storage is low.

[0071] In the face of the above technical problems, the inventors decided to adopt the following solutions:

[0072] In some optional implementations of some embodiments, the execution subject can store and encrypt the decrypted write data based on the to-be-extended key information by the following steps, and obtain encrypted storage write data:

[0073] In a first step, preset encryption algorithm information is obtained from a preset database. The preset encryption algorithm information includes extension algorithm information and round function information. The extension algorithm information can represent a key extension algorithm. For example, the extension algorithm information can represent a key extension algorithm of AES. The round function information can represent a round function corresponding to the extension algorithm information and used for confusion and transformation of the to-be-encrypted write data. The preset database can be a MySQL database. The round function information can represent a round function.

[0074] In a second step, the to-be-extended key information is extended according to the extension algorithm information to obtain an extended key information sequence. In practice, the execution subject can extend a key corresponding to the to-be-extended key information by executing a key extension algorithm corresponding to the extension algorithm information to obtain an extended key information sequence. The key corresponding to the to-be-extended key information can include characters. One piece of extended key information in the extended key information sequence can represent a round key. The round key can be a character. For example, the extended key information can be "0b01100101".

[0075] In a third step, the decrypted write data is determined as the to-be-encrypted write data.

[0076] In a fourth step, according to the extended key information sequence and the to-be-encrypted write data, the following round encryption processing is performed:

[0077] In a first sub-step, a first extended key information in the extended key information sequence is determined.

[0078] In a second sub-step, the to-be-encrypted write data is encrypted according to the round function information included in the preset encryption algorithm information and the first extended key information to obtain target write data. In practice, the execution subject can convert the to-be-encrypted write data into byte data. Then, the execution subject can input the byte data and a round key corresponding to the first extended key information into a round function corresponding to the round function information to obtain the target write data. The target write data can be data obtained by encrypting the to-be-encrypted write data according to the round function information and the first extended key information.

[0079] In a third sub-step, the first extended key information is deleted from the extended key information sequence to update the extended key information sequence.

[0080] In a fourth sub-step, in response to determining that the extended key information sequence is not empty, the following steps are performed:

[0081] In a first sub-step, the target write data is determined as the to-be-encrypted write data to update the to-be-encrypted write data.

[0082] Sub-step two, based on the updated extended key information sequence and the updated to-be-encrypted write data, the above-mentioned round encryption processing is executed again.

[0083] Fifth sub-step, in response to determining that the extended key information sequence is empty, the obtained target write data is determined as the encrypted storage write data.

[0084] The technical scheme above combines step 107 and related content thereof as one invention point of an embodiment of the present disclosure, and solves the technical problem of low security of decrypted write data storage. Factors leading to low security of decrypted write data storage are often as follows: before storing the decrypted write data, the decrypted write data needs to be encrypted to ensure the security of data storage, the decrypted write data is directly statically encrypted according to a key, static encryption usually only performs one encryption operation, is vulnerable to brute force attacks, and thus leads to low security of decrypted write data storage. If the above factors are solved, the effect of improving the security of decrypted write data storage can be achieved. To achieve this effect, first, preset encryption algorithm information is obtained from a preset database. The preset encryption algorithm information includes: extension algorithm information, round function information. In this way, the preset encryption algorithm information can be obtained. Then, the to-be-extended key information is extended according to the extension algorithm information, and an extended key information sequence is obtained. In this way, the to-be-extended key information can be extended to obtain an extended key information sequence for round encryption processing. Then, the decrypted write data is determined as to-be-encrypted write data. Then, according to the extended key information sequence and the to-be-encrypted write data, the following round encryption processing is performed: in a first sub-step, a first extended key information in the extended key information sequence is determined. In this way, the first extended key information for encrypting the to-be-encrypted write data can be obtained. In a second sub-step, the to-be-encrypted write data is encrypted according to the round function information included in the preset encryption algorithm information and the first extended key information, and target write data is obtained. In this way, the to-be-encrypted write data can be encrypted once based on the round function information and the first extended key information. In a third sub-step, the first extended key information is deleted from the extended key information sequence to update the extended key information sequence. In this way, the first extended key information that participates in encryption can be deleted from the extended key information sequence. In a fourth sub-step, in response to a determination that the extended key information sequence is not empty, the following steps are performed: in a first sub-sub-step, the target write data is determined as to-be-encrypted write data to update the to-be-encrypted write data. In this way, the to-be-encrypted write data can be updated. In a second sub-sub-step, the round encryption processing is performed again according to the updated extended key information sequence and the updated to-be-encrypted write data. In a fifth sub-step, in response to a determination that the extended key information sequence is empty, the obtained target write data is determined as encrypted storage write data. In this way, through the round encryption processing, multiple rounds of encryption processing of the to-be-encrypted write data can be implemented, each round of encryption produces a new impact on the structure of the data, and the difficulty of cracking by an attacker is increased. In combination with step 107, the encrypted storage write data is stored in a storage location corresponding to the storage location information. In this way, the decrypted write data after multiple rounds of encryption processing can be stored, and the security of decrypted write data storage is improved.

[0085] Step 106, based on the data write request information, generating storage location information corresponding to the encrypted storage write data.

[0086] In some embodiments, the execution subject can generate the storage location information corresponding to the encrypted storage write data based on the data write request information. The storage location information can be a specific location or identifier of the encrypted storage write data in the storage system.

[0087] In some optional implementations of some embodiments, the execution subject can generate the storage location information corresponding to the encrypted storage write data based on the data write request information by the following steps:

[0088] First, determine each user identifier corresponding to each preset storage area as each to-be-queried user identifier. Each preset storage area in the above-mentioned each preset storage area corresponds to at least one user identifier in the above-mentioned each user identifier. Each preset storage area in the above-mentioned each preset storage area can be a predefined storage location, such as a specific sector in a disk, a specific table or field in a database, etc.

[0089] Second, determine the user identifier included in the data write request information as a target user identifier.

[0090] Third, determine the to-be-queried user identifier in the above-mentioned each to-be-queried user identifier that is the same as the above-mentioned target user identifier as a to-be-stored identifier.

[0091] Fourth, determine the above-mentioned to-be-stored identifier as the storage location information corresponding to the above-mentioned encrypted storage write data.

[0092] Step 107, storing the encrypted storage write data to the storage location corresponding to the storage location information.

[0093] In some embodiments, the execution subject can store the above-mentioned encrypted storage write data to the storage location corresponding to the above-mentioned storage location information.

[0094] Step 108, sending a data write feedback message representing data write success to the mobile terminal for the mobile terminal to display the data write feedback message.

[0095] In some embodiments, the execution subject can send a data write feedback message representing data write success to the above-mentioned mobile terminal for the above-mentioned mobile terminal to display the above-mentioned data write feedback message. The data write feedback message can be text information representing data write success. For example, the data write feedback message can be "data write success".

[0096] The above various embodiments of the present disclosure have the following beneficial effects: the number of data storage failures is reduced by the data encryption write method based on a trusted key of some embodiments of the present disclosure. Specifically, the reason for the increase in the number of data storage failures is that the write lock state detection is not performed, and the data sent by the mobile terminal is directly stored in the data storage area. When multiple mobile terminals simultaneously attempt to write data to the server, if the lock state detection is not performed, the risk of data being overwritten, modified or lost may be increased, and the number of data storage failures is increased. Based on this, the data encryption write method based on a trusted key of some embodiments of the present disclosure first, in response to receiving the data write request information sent by the mobile terminal, determines the transmission private key information corresponding to the data write request information based on the data write request information. Thus, the transmission private key information used to decrypt the encrypted write data sent by the mobile terminal can be obtained. Then, in response to receiving the encrypted write data sent by the mobile terminal, write lock state detection processing is performed to obtain write lock state detection information. Thus, the write lock state detection processing can be performed to obtain the write lock state detection information representing the write lock state of the storage device, storage system or storage location. Then, in response to determining that the write lock state detection information represents that no write is performed, the encrypted write data is decrypted based on the transmission private key information to obtain decrypted write data. Thus, the encrypted write data sent by the mobile terminal can be decrypted in the state that no write is performed to obtain the data sent by the mobile terminal, i.e., the decrypted write data. Next, the storage key information is generated based on the data write request information. The storage key information includes storage public key information and storage private key information. Thus, the storage key information for storage encryption of the decrypted write data can be generated. Then, the decrypted write data is storage encrypted based on the storage key information to obtain encrypted storage write data. Thus, the data sent by the mobile terminal can be storage encrypted before storage to ensure the security of data storage. Then, the storage location information corresponding to the encrypted storage write data is generated based on the data write request information. Thus, the storage location information for storage of the encrypted storage write data can be generated. Then, the encrypted storage write data is stored in the storage location corresponding to the storage location information. Finally, the data write feedback message representing the success of data write is sent to the mobile terminal for displaying the data write feedback message by the mobile terminal. Thus, the data write feedback message representing the success of data write can be sent to the mobile terminal. Also, the write lock state detection processing is performed before the data sent by the mobile terminal (i.e., the decrypted write data) is stored to obtain the write lock state detection information representing the write lock state of the storage device or storage location.And in the write lock state detection information represents the state of not writing, the data sent by the mobile terminal is encrypted and stored, reducing the risk of data being overwritten, modified or lost caused by multiple mobile terminals simultaneously attempting to write data to the server, reducing the number of data storage failures.

[0097] Further reference Figure 2 , as the implementation of the method shown in the figure, the present disclosure provides some embodiments of a data encryption writing device based on trusted key, which device embodiments correspond to those method embodiments shown in Figure 1 , the device can be applied to various electronic devices.

[0098] As Figure 2 shown, the data encryption writing device based on trusted key 200 of some embodiments includes a determination unit 201, a write lock state detection unit 202, a decryption operation unit 203, a first generation unit 204, a storage encryption unit 205, a second generation unit 206, a storage unit 207 and a sending unit 208. Among them, the determination unit 201 is configured to determine the transmission private key information corresponding to the data write request information based on the above data write request information in response to receiving the data write request information sent by the mobile terminal; the write lock state detection unit 202 is configured to perform write lock state detection processing in response to receiving the encrypted write data sent by the mobile terminal, and obtain write lock state detection information; the decryption operation unit 203 is configured to perform decryption operation on the encrypted write data based on the transmission private key information in response to determining that the write lock state detection information represents no write; the first generation unit 204 is configured to generate storage key information based on the data write request information, wherein the storage key information includes storage public key information and storage private key information; the storage encryption unit 205 is configured to perform storage encryption processing on the decrypted write data based on the storage key information, and obtain encrypted storage write data; the second generation unit 206 is configured to generate storage location information corresponding to the encrypted storage write data based on the data write request information; the storage unit 207 is configured to store the encrypted storage write data to the storage location corresponding to the storage location information; the sending unit 208 is configured to send a data write feedback message representing data write success to the mobile terminal, so that the mobile terminal displays the data write feedback message.

[0099] It can be understood that the units recorded in the device 200 correspond to each step in the method described with reference to Figure 1 . Therefore, the operations, features and beneficial effects described above for the method also apply to the device 200 and the units contained therein, which will not be described here.

[0100] Reference will now be made to the following description Figure 3 which illustrates the structure of an electronic device 300 suitable for use in implementing some embodiments of the present disclosure. Figure 3 The electronic device shown is merely one example, and should not be taken as limiting the scope of functionality or use of embodiments of the present disclosure.

[0101] As Figure 3 shown, the electronic device 300 can include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301 that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 302 or loaded from a storage device 308 into a random access memory (RAM) 303. Various programs and data required for operation of the electronic device 300 are also stored in the RAM 303. The processing device 301, the ROM 302, and the RAM 303 are connected to each other through a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0102] Generally, the following devices can be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 can allow the electronic device 300 to communicate wirelessly or wired with other devices to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that not all of the devices shown are required to implement or be present. More or fewer devices can alternatively be implemented or present. Figure 3 Each block shown in the flowcharts can represent a device, or multiple devices, as needed.

[0103] In particular, processes described above with reference to the flowcharts can be implemented as a computer software program according to some embodiments of the present disclosure. For example, some embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In some such embodiments, the computer program can be downloaded and installed from a network through the communication devices 309, or installed from the storage devices 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the functions defined in the methods of some embodiments of the present disclosure are performed.

[0104] Note that the computer-readable medium in some embodiments of the present disclosure can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium may, for example and without limitation, be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the computer-readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In some embodiments of the present disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program used by or in connection with an instruction execution system, apparatus, or device. In some embodiments of the present disclosure, the computer-readable signal medium can include a data signal propagated in baseband or propagated as a carrier wave in a propagated data signal, in which the computer-readable program code is contained. Such a propagated data signal can take a variety of forms, including but not limited to electro-magnetic, optical, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium that is not a storage medium and that can communicate, propagate, or transport program for use by or in connection with an instruction execution system, apparatus, or device. Program code contained in the computer-readable medium can be transmitted using any suitable medium, including but not limited to wire, cable, RF, etc., or any suitable combination of the foregoing.

[0105] In some embodiments, the client, server, or both can communicate using any current known or future developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include local area networks ("LAN"), wide area networks ("WAN"), the Internet, and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any current known or future developed networks.

[0106] The computer readable medium can be included in the electronic device or exist separately from the electronic device. The computer readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: in response to receiving data write request information sent by a mobile terminal, determine transmission private key information corresponding to the data write request information based on the data write request information; in response to receiving encrypted write data sent by the mobile terminal, perform write lock state detection processing to obtain write lock state detection information; in response to determining that the write lock state detection information indicates that no write is performed, perform decryption on the encrypted write data based on the transmission private key information to obtain decrypted write data; generate storage key information based on the data write request information, wherein the storage key information includes storage public key information and storage private key information; perform storage encryption processing on the decrypted write data based on the storage key information to obtain encrypted storage write data; generate storage location information corresponding to the encrypted storage write data based on the data write request information; store the encrypted storage write data in a storage location corresponding to the storage location information; and send a data write feedback message indicating that the data write is successful to the mobile terminal, so that the mobile terminal displays the data write feedback message.

[0107] Computer program code for carrying out operations of some embodiments of the disclosure can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0108] The flow and block diagrams in the drawings represent possible architectural, functional, and operational architectures of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block can represent a module, a segment, or a portion of code that comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations thereof, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or combinations of hardware and software.

[0109] The units described in some embodiments of the present disclosure can be implemented by means of software, or can be implemented by means of hardware. The described units can also be provided in a processor, for example, a processor can be described as comprising a determination unit, a write lock state detection unit, a decryption operation unit, a first generation unit, a storage encryption unit, a second generation unit, a storage unit and a sending unit. Among them, the name of these units does not constitute a limitation to the unit itself in some cases, for example, the write lock state detection unit can also be described as "a unit that responds to the receipt of the encrypted write data sent by the mobile terminal, performs write lock state detection processing, and obtains write lock state detection information".

[0110] The functions described above in the present document can be performed, at least in part, by one or more hardware logic components. For example, and without limitation, example types of hardware logic components that can be used include Field-programmable Gate Arrays (FPGAs), Application-specific Integrated Circuits (ASICs), Application-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

[0111] The above description is merely some of the preferred embodiments of the present disclosure and a description of the principles of the technology employed. It will be understood by those skilled in the art that the scope of the application involved in the embodiments of the present disclosure is not limited to the technical solutions formed by the specific combinations of technical features, and should also cover other technical solutions formed by any combination of technical features or their equivalent features without departing from the inventive concept. For example, the technical solutions formed by the mutual replacement of features and the technical features disclosed in the embodiments of the present disclosure (but not limited to) having similar functions.

Claims

1. A method for encrypting and writing data based on a trusted key, comprising: In response to receiving a data write request information sent by a mobile terminal, the transmission private key information corresponding to the data write request information is determined based on the data write request information; In response to receiving encrypted write data sent by the mobile terminal, write lock status detection processing is performed to obtain write lock status detection information; In response to determining that the write lock state detection information indicates that no write has been performed, the encrypted write data is decrypted based on the transmission private key information to obtain decrypted write data; Based on the data write request information, storage key information is generated, wherein the storage key information includes storage public key information and storage private key information; Based on the storage key information, the decrypted write data is subjected to storage encryption processing to obtain encrypted storage write data; Based on the data write request information, generate storage location information corresponding to the encrypted storage write data; The encrypted storage data is written to the storage location corresponding to the storage location information; A data write feedback message indicating successful data writing is sent to the mobile terminal so that the mobile terminal can display the data write feedback message; The step of responding to receiving encrypted write data sent by the mobile terminal and performing write lock state detection processing to obtain write lock state detection information includes: In response to receiving encrypted write data sent by the aforementioned mobile terminal, the following write lock state detection process is performed: Send a preset data packet to the preset coordinator; Determine the sending time of the preset data packet and the system time; Based on the sending time and system time, perform the following determination steps: Determine the time interval between the system time and the transmission time; In response to a determination that the time interval is less than or equal to a preset value, the following steps are performed: In response to the detection of feedback information sent by the preset coordinator, the information indicating that no writing has been performed is determined as write lock state detection information; In response to the absence of feedback information from the preset coordinator, the system time is determined again after a preset time period following the transmission time, and the determination step is executed again based on the newly determined system time. In response to a time interval greater than a preset value and no feedback information from a preset coordinator being detected, the following steps are performed: The information representing the write lock is identified as write lock state detection information; The preset write lock prompt message is sent to the aforementioned mobile terminal, and the write lock status detection process is executed again.

2. The method according to claim 1, wherein, The data write request information includes data source identifier, user identifier, mobile terminal device identifier, and access token information; And determining the transmission private key information corresponding to the data write request information based on the data write request information includes: The access token information is subjected to token verification processing to obtain token verification information; In response to determining that the token verification information indicates successful token verification, the data write request information is sent to a preset security password card to obtain the transmission private key information corresponding to the data write request information from the security password card.

3. The method according to claim 2, wherein, The step of generating storage key information based on the data write request information includes: The data source identifier included in the data writing request information is identified as the data source identifier to be searched; The identifier of the data source to be searched is input into a preset security password card to obtain a set of query storage key information corresponding to the identifier of the data source to be searched from the preset security password card. Each query storage key in the set of query storage key information corresponds to a user identifier. The user identifier included in the data writing request information is determined as the user identifier to be queried; The query storage key information corresponding to the user identifier to be queried in the query storage key information set is determined as the storage key information.

4. The method according to claim 1, wherein, The step of generating storage location information corresponding to the encrypted storage write data based on the data write request information includes: Each user identifier corresponding to each preset storage area is determined as a user identifier to be queried, wherein each preset storage area corresponds to at least one user identifier among the user identifiers; The user identifier included in the data writing request information is identified as the target user identifier; Among the various user identifiers to be queried, the user identifier that is the same as the target user identifier is identified as the identifier to be stored; The identifier to be stored is determined as the storage location information corresponding to the encrypted storage data.

5. The method according to claim 1, wherein, The step of performing storage encryption processing on the decrypted and written data based on the storage key information to obtain encrypted storage and written data includes: The public key information included in the stored key information is stored; The stored private key information included in the stored key information is determined as the key information to be expanded; Based on the key information to be expanded, the decrypted write data is stored and encrypted to obtain encrypted storage write data.

6. The method according to claim 2, wherein, The access token information includes header information, payload information, and signature information. The payload information includes the token validity period. The token verification process performed on the access token information to obtain token verification information includes: Get the system time; In response to determining that the system time is within the validity period of the token included in the access token information, the header information and the payload information are encoded to obtain a first encoding corresponding to the header information and a second encoding corresponding to the payload information; The first code and the second code are concatenated to obtain the concatenated code; The concatenated code is encrypted to obtain the signature information to be verified; In response to the determination that the signature information to be verified and the signature information included in the access token information are different, the information indicating that the token verification failed is determined as the token verification information; In response to determining that the signature information to be verified is the same as the signature information included in the access token information, the information indicating successful token verification is determined as token verification information.

7. A data encryption writing device based on a trusted key, comprising: The determining unit is configured to, in response to receiving a data write request information sent by a mobile terminal, determine transmission private key information corresponding to the data write request information based on the data write request information; The write lock state detection unit is configured to perform write lock state detection processing in response to receiving encrypted write data sent by the mobile terminal, and obtain write lock state detection information, including: In response to receiving encrypted write data sent by the aforementioned mobile terminal, the following write lock state detection process is performed: Send a preset data packet to the preset coordinator; Determine the sending time of the preset data packet and the system time; Based on the sending time and system time, perform the following determination steps: Determine the time interval between the system time and the transmission time; In response to a determination that the time interval is less than or equal to a preset value, the following steps are performed: In response to the detection of feedback information sent by the preset coordinator, the information indicating that no writing has been performed is determined as write lock state detection information; In response to the absence of feedback information from the preset coordinator, the system time is determined again after a preset time period following the transmission time, and the determination step is executed again based on the newly determined system time. In response to a time interval greater than a preset value and no feedback information from a preset coordinator being detected, the following steps are performed: The information representing the write lock is identified as write lock state detection information; Send the preset write lock prompt message to the aforementioned mobile terminal, and perform the aforementioned write lock status detection process again; The decryption operation unit is configured to, in response to determining that the write lock state detection information indicates that no write has been performed, perform a decryption operation on the encrypted write data based on the transmission private key information to obtain decrypted write data; The first generation unit is configured to generate storage key information based on the data write request information, wherein the storage key information includes storage public key information and storage private key information; The storage encryption unit is configured to perform storage encryption processing on the decrypted write data based on storage key information to obtain encrypted storage write data. The second generation unit is configured to generate storage location information corresponding to the encrypted storage write data based on the data write request information. The storage unit is configured to store the encrypted storage data to the storage location corresponding to the storage location information; The sending unit is configured to send a data write feedback message indicating that the data has been successfully written to the mobile terminal, so that the mobile terminal can display the data write feedback message.

8. An electronic device, comprising: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 6.

9. A computer-readable medium having a computer program stored thereon, wherein, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 6.

Images