Local data security access method and device based on trusted environment and medium

Abstract

The embodiment of the invention discloses a local data security access method and device based on a trusted environment and a medium. A specific embodiment of the method comprises the following steps: in response to received data reading request information sent by client equipment, performing verification processing on a user identity based on the data reading request information to obtain user identity verification information; in response to determining that the user identity verification information represents that the user is a legal user, determining the data source identifier and the user identifier as identity identifier information; acquiring storage public key information corresponding to the identity identification information from a preset security password card; generating data reading task information corresponding to the identity identification information based on the identity identification information; reading encrypted storage data corresponding to the identity identification information from a preset database; based on the storage public key information, performing decryption operation on the encrypted storage data to obtain transmission storage data; and sending the transmission storage data to the client equipment. According to the embodiment, the security of data reading is improved.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technologies, and particularly to a method, an apparatus, and a medium for secure local data access based on a trusted environment. Background Art

[0002] Secure local data access based on a trusted environment is a technology that receives a data reading request sent by a client device and reads and transmits data corresponding to the data reading request. Currently, when reading and transmitting data corresponding to a data reading request, the commonly used method is to directly read the data corresponding to the data reading request and transmit the read data to the client device.

[0003] However, when using the above method to read and transmit data corresponding to a data reading request, the following technical problems often exist:

[0004] When reading the data corresponding to the data reading request and transmitting the read data to the client device, the identity of the client user is not verified before reading the data, and the data is vulnerable to access by unauthorized users, resulting in data leakage and low security of data reading. At the same time, when storing the data of the client user, in order to ensure the security of data storage, the stored data is generally encrypted. When directly reading the data corresponding to the data reading request and transmitting the read data to the client device, the read data is not stored and decrypted, and the client user may not be able to directly read and use these un-decrypted stored data.

[0005] The above information disclosed in this background art section is only used to enhance the understanding of the background of the inventive concept, and thus, it may include information that does not form the prior art known to those of ordinary skill in the art. Summary of the Invention

[0006] This summary of the disclosure is intended to introduce concepts in a brief form, which will be described in detail in the following detailed implementation section. This summary of the disclosure is not intended to identify the key features or essential features of the claimed technical solution, nor is it intended to be used to limit the scope of the claimed technical solution.

[0007] Some embodiments of the present disclosure propose a method, an apparatus, an electronic device, and a computer-readable medium for secure local data access based on a trusted environment to solve one or more of the technical problems mentioned in the above background art section.

[0008] In a first aspect, some embodiments of the present disclosure provide a method for secure local data access based on a trusted environment. The method includes: in response to receiving data reading request information sent by a client device, based on the data reading request information, performing authentication processing on the user identity to obtain user identity authentication information, where the data reading request information includes a data source identifier, a user identifier, and a client device identifier; in response to determining that the user identity authentication information indicates that the user is a legitimate user, determining the data source identifier and the user identifier as identity identification information; sending the identity identification information to a preset security password card to obtain stored public key information corresponding to the identity identification information from the preset security password card; generating data reading task information corresponding to the identity identification information based on the identity identification information; performing a reading task corresponding to the data reading task information to read encrypted storage data corresponding to the identity identification information from a preset database; performing a decryption operation on the encrypted storage data based on the stored public key information to obtain transmitted storage data; and sending the transmitted storage data to the client device for the client device to display the transmitted storage data.

[0009] In a second aspect, some embodiments of the present disclosure provide a device for secure local data access based on a trusted environment. The device includes: an authentication processing unit configured to, in response to receiving data reading request information sent by a client device, perform authentication processing on the user identity based on the data reading request information to obtain user identity authentication information, where the data reading request information includes a data source identifier, a user identifier, and a client device identifier; a determination unit configured to, in response to determining that the user identity authentication information indicates that the user is a legitimate user, determine the data source identifier and the user identifier as identity identification information; an acquisition unit configured to send the identity identification information to a preset security password card to obtain stored public key information corresponding to the identity identification information from the preset security password card; a generation unit configured to generate data reading task information corresponding to the identity identification information based on the identity identification information; a reading unit configured to perform a reading task corresponding to the data reading task information to read encrypted storage data corresponding to the identity identification information from a preset database; a decryption operation unit configured to perform a decryption operation on the encrypted storage data based on the stored public key information to obtain transmitted storage data; and a sending unit configured to send the transmitted storage data to the client device for the client device to display the transmitted storage data.

[0010] In a third aspect, some embodiments of the present disclosure provide an electronic device, including: one or more processors; a storage device storing one or more programs thereon, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner of the first aspect above.

[0011] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium storing a computer program thereon, wherein when the program is executed by a processor, the method described in any implementation manner of the first aspect above is implemented.

[0012] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: Through the local data security access method based on a trusted environment in some embodiments of the present disclosure, the security of data reading is improved. Specifically, the reason for the low security of data reading is as follows: Reading the data corresponding to the data reading request and transmitting the read data to the client device without verifying the identity of the client user before reading the data. The data is vulnerable to access by unauthorized users, resulting in data leakage and low security of data reading. At the same time, when storing the data of the client user, in order to ensure the security of data storage, the stored data is generally encrypted. The data corresponding to the data reading request is directly read and the read data is transmitted to the client device without decrypting the stored data. The client user may not be able to directly read and use these unencrypted stored data. Based on this, in some embodiments of the present disclosure, the local data security access method based on a trusted environment first, in response to receiving the data reading request information sent by the client device, based on the above data reading request information, performs an authentication process on the user identity to obtain user identity authentication information, where the above data reading request information includes a data source identifier, a user identifier, and a client device identifier. Thus, the user identity can be verified when the data reading request information is received. After that, in response to determining that the user identity authentication information indicates that the user is a legitimate user, the above data source identifier and the above user identifier are determined as identity identification information. Thus, the identity identification information can be used to determine the public key information to be obtained. Then, the above identity identification information is sent to a preset security password card to obtain the stored public key information corresponding to the above identity identification information from the above preset security password card. Thus, the stored public key information for decrypting the encrypted stored data can be obtained from the preset security password card. After that, based on the above identity identification information, data reading task information corresponding to the above identity identification information is generated. Thus, data reading task information corresponding to the identity can be generated. Then, the reading task corresponding to the above data reading task information is executed to read the encrypted stored data corresponding to the above identity identification information from a preset database. Thus, when the client user is a legitimate user, the encrypted stored data corresponding to the above identity identification information can be read from the preset database. After that, based on the above stored public key information, a decryption operation is performed on the above encrypted stored data to obtain the transmitted stored data. Thus, the encrypted stored data read can be decrypted to obtain the transmitted stored data, ensuring that the client can obtain the transmitted stored data with strong readability and usability after storage decryption. Finally, the above transmitted stored data is sent to the above client device for the above client device to display the above transmitted stored data. Thus, when the client user is a legitimate user, the transmitted stored data after storage decryption can be sent to the client device. Also because after receiving the data reading request information sent by the client device, the user identity of the client user is authenticated.When the client user is a legitimate user, the stored decrypted transmission storage data is sent to the client device, reducing unauthorized access to the data, reducing the risk of data leakage, and improving the security of data reading. Description of the Drawings

[0013] In combination with the drawings and with reference to the following specific embodiments, the above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic and the elements and elements are not necessarily drawn to scale.

[0014] Figure 1 is a flowchart of some embodiments of a local data security access method based on a trusted environment according to the present disclosure;

[0015] Figure 2 is a schematic structural diagram of some embodiments of a local data security access device based on a trusted environment according to the present disclosure;

[0016] Figure 3 is a schematic structural diagram of an electronic device suitable for implementing some embodiments of the present disclosure. Detailed Description of the Embodiments

[0017] The embodiments of the present disclosure will be described in more detail below with reference to the drawings. Although some embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. On the contrary, these embodiments are provided to more thoroughly and completely understand the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not used to limit the protection scope of the present disclosure.

[0018] It should also be noted that, for the sake of convenience of description, only the parts related to the relevant invention are shown in the drawings. Without conflict, the embodiments in the present disclosure and the features in the embodiments can be combined with each other.

[0019] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or mutual dependence relationship of the functions performed by these devices, modules or units.

[0020] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive. Those skilled in the art should understand that unless otherwise clearly specified in the context, it should be understood as "one or more".

[0021] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are for illustrative purposes only and are not used to limit the scope of these messages or information.

[0022] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0023] Figure 1 Flow 100 of some embodiments of a local data security access method based on a trusted environment according to the present disclosure is shown. The local data security access method based on a trusted environment includes the following steps:

[0024] Step 101, in response to receiving data reading request information sent by a client device, based on the data reading request information, perform authentication processing on the user identity to obtain user identity authentication information.

[0025] In some embodiments, an execution entity (such as a computing device) of the local data security access method based on a trusted environment may, in response to receiving data reading request information sent by a client device, based on the above data reading request information, perform authentication processing on the user identity to obtain user identity authentication information. Among them, the above data reading request information includes a data source identifier, a user identifier, and a client device identifier. The above data source identifier may be a unit ID or an organization ID. The above user identifier may be a user name. The above client device identifier may be a specific code or number of the client device. The above client device may be a terminal device (for example, a personal computer, a smart phone, and a tablet computer). The above authentication information may be a boolean information indicating whether the user is a legal (i.e., authorized) user. For example, the above authentication information may be "True", indicating that the user is a legal user. The above authentication information may be "False", indicating that the user is an illegal user.

[0026] In some optional implementation manners of some embodiments, the above execution entity may perform authentication processing on the user identity based on the above data reading request information through the following steps to obtain user identity authentication information:

[0027] The first step is to determine the data source identifier included in the above data reading request information as the target data source identifier.

[0028] The second step is to determine the user identifier included in the above data reading request information as the target user identifier.

[0029] The third step is to determine the client device identifier included in the above data reading request information as the target client device identifier.

[0030] Fourthly, obtain the pre-stored user identification set corresponding to the above-mentioned target data source identification. In practice, the above-mentioned executing entity may obtain the pre-stored user identification set corresponding to the above-mentioned target data source identification from a preset database. Among them, each pre-stored user identification included in the above-mentioned pre-stored user identification set may represent each user belonging to the unit or organization corresponding to the above-mentioned target data source identification.

[0031] Fifthly, in response to determining that the above-mentioned target user identification is the same as one of the pre-stored user identifications in the above-mentioned pre-stored user identification set, obtain the historical client device identification set corresponding to the above-mentioned target user identification. In practice, the above-mentioned executing entity may obtain the historical client device identification set corresponding to the above-mentioned target user identification from a preset database. Among them, the historical client device identifications in the above-mentioned historical client device identification set may be the client device identifications when the user reads or stores data through the client device before.

[0032] Sixthly, in response to determining that the above-mentioned target client device identification is the same as one of the historical client device identifications in the above-mentioned historical client device identification set, determine the information indicating that the user is a legitimate user as the user authentication information.

[0033] In some optional implementation manners of some embodiments, after determining that the above-mentioned target client device identification is the same as one of the historical client device identifications in the above-mentioned historical client device identification set and determining the information indicating that the user is a legitimate user as the user authentication information, the above-mentioned executing entity may further perform the following steps:

[0034] First, in response to determining that there is no target client device identification in the above-mentioned historical client device identification set that is the same as the above-mentioned target client device identification, control the camera device of the client device to collect the face image of the user as the face image to be verified. Among them, the above-mentioned camera device may be a camera.

[0035] Second, obtain the pre-stored face image corresponding to the above-mentioned target user identification. In practice, the above-mentioned executing entity may obtain the pre-stored face image from a preset database. Among them, the above-mentioned pre-stored face image may be the face image of the user corresponding to the pre-stored target user identification.

[0036] Third, perform a comparison process on the above-mentioned face image to be verified and the above-mentioned pre-stored face image to obtain face verification information.

[0037] Fourth, in response to determining that the above-mentioned face verification information indicates that the face image to be verified and the pre-stored face image are the face images of the same user, determine the information indicating that the user is a legitimate user as the user authentication information.

[0038] In some alternative implementations of some embodiments, the above-mentioned execution entity may perform comparison processing on the above-mentioned face image to be verified and the above-mentioned pre-stored face image through the following steps to obtain face verification information:

[0039] First step, perform face detection processing on the above-mentioned face image to be verified and the above-mentioned pre-stored face image to obtain face position information corresponding to the above-mentioned face image to be verified and target face position information corresponding to the above-mentioned pre-stored face image. In practice, the above-mentioned execution entity may perform face detection processing on the verification face image and the above-mentioned pre-stored face image through the MTCNN face detection algorithm to obtain face position information and target face position information. Among them, the above-mentioned face position information may represent the position of the face in the above-mentioned face image to be verified in the above-mentioned face image to be verified. The above-mentioned target face position information may represent the position of the face in the above-mentioned pre-stored face image in the above-mentioned pre-stored face image.

[0040] Second step, according to the above-mentioned face position information, perform face alignment processing on the above-mentioned face image to be verified to obtain a face-aligned image to be verified corresponding to the above-mentioned face image to be verified. In practice, the above-mentioned execution entity may perform face alignment on the above-mentioned face image to be verified according to the above-mentioned face position information through a face alignment algorithm to obtain a face-aligned image to be verified.

[0041] Third step, according to the above-mentioned target face position information, perform face alignment processing on the above-mentioned pre-stored face image to obtain a pre-stored face-aligned image corresponding to the above-mentioned pre-stored face image. In practice, the above-mentioned execution entity may perform face alignment on the above-mentioned pre-stored face image according to the above-mentioned target face position information through a face alignment algorithm to obtain a pre-stored face-aligned image.

[0042] Fourth step, perform background removal processing on the above-mentioned face-aligned image to be verified and the above-mentioned pre-stored face-aligned image to obtain a target face-aligned image to be verified corresponding to the above-mentioned face-aligned image to be verified and a target pre-stored face-aligned image corresponding to the above-mentioned pre-stored face-aligned image. In practice, the above-mentioned execution entity may perform background removal processing on the above-mentioned face-aligned image to be verified and the above-mentioned pre-stored face-aligned image through a pre-trained background removal model to obtain a target face-aligned image to be verified and a target pre-stored face-aligned image.

[0043] Step 5: Input the above-mentioned target face alignment image to be verified and the above-mentioned target pre-stored face alignment image into the input layer of a pre-trained face comparison model, to obtain a pre-processed face alignment image to be verified corresponding to the above-mentioned target face alignment image to be verified and a pre-processed pre-stored face alignment image corresponding to the above-mentioned target pre-stored face alignment image. Among them, the above-mentioned face comparison model includes the above-mentioned input layer, convolutional layer, pooling layer, and feature comparison layer. Among them, the above-mentioned input layer can be an input layer for pre-processing the input image (such as grayscale processing, noise reduction processing, enhancement processing, etc.). The above-mentioned pre-processed face alignment image to be verified can be an image obtained by pre-processing the target face alignment image to be verified. The above-mentioned pre-processed pre-stored face alignment image can be an image obtained by pre-processing the above-mentioned target pre-stored face alignment image.

[0044] Step 6: Input the above-mentioned pre-processed face alignment image to be verified and the above-mentioned pre-processed pre-stored face alignment image into the above-mentioned convolutional layer, to obtain face feature information to be verified corresponding to the above-mentioned pre-processed face alignment image to be verified and pre-stored face feature information corresponding to the above-mentioned pre-processed pre-stored face alignment image. Among them, the face feature information to be verified can be a feature map representing the pre-processed face alignment image to be verified and containing feature information at different positions and scales in the pre-processed face to be verified. The above-mentioned pre-stored face feature information can be a feature map representing the pre-processed pre-stored face alignment image.

[0045] Step 7: Input the above-mentioned face feature information to be verified and the above-mentioned pre-stored face feature information into the above-mentioned pooling layer, to obtain pooled face feature information to be verified corresponding to the above-mentioned face feature information to be verified and pooled pre-stored face feature information corresponding to the above-mentioned pre-stored face feature information. Among them, the above-mentioned pooled face feature information to be verified can be a feature map obtained by performing a downsampling operation (such as max pooling or average pooling) on the feature map represented by the face feature information to be verified. The above-mentioned pooled pre-stored face feature information can be a feature map obtained by performing a downsampling operation (such as max pooling or average pooling) on the feature map represented by the pre-stored face feature information.

[0046] Step 8: Input the above-mentioned pooled face feature information to be verified and the above-mentioned pooled pre-stored face feature information into the above-mentioned feature comparison layer, to obtain a feature similarity value. Among them, the above-mentioned feature comparison layer can be a metric learning layer for calculating the similarity between the pooled face feature information to be verified and the above-mentioned pooled pre-stored face feature information. The above-mentioned similarity can be represented by cosine similarity or Euclidean distance.

[0047] In the ninth step, in response to determining that the above feature similarity value is greater than a preset value, the information indicating that the face image to be verified and the pre-stored face image are of the same user is determined as face verification information. Among them, the information indicating that the face image to be verified and the pre-stored face image are of the same user can be represented by the Boolean value True.

[0048] The above technical solution and its related content, as an inventive point of an embodiment of the present disclosure, solve the technical problem of "low accuracy of face comparison". The factors that lead to low accuracy of face comparison are often as follows: Different face images may vary due to different poses (such as head tilt, rotation, etc.), and at the same time, the background images present in the face images will cause interference during the face image comparison process, thereby resulting in low accuracy of face comparison. If the above factors are solved, the effect of improving the accuracy of face comparison can be achieved. To achieve this effect, first, face detection processing is performed on the above-mentioned face image to be verified and the above-mentioned pre-stored face image to obtain the face position information corresponding to the above-mentioned face image to be verified and the target face position information corresponding to the above-mentioned pre-stored face image. Thus, the face position information for face alignment processing of the face image to be verified and the target face position information for face alignment processing of the stored face image can be obtained. Then, according to the above-mentioned face position information, face alignment processing is performed on the above-mentioned face image to be verified to obtain a verified face alignment image corresponding to the above-mentioned face image to be verified. According to the above-mentioned target face position information, face alignment processing is performed on the above-mentioned pre-stored face image to obtain a pre-stored face alignment image corresponding to the above-mentioned pre-stored face image. Thus, through alignment processing, the face image to be verified and the pre-stored face image can be adjusted to a unified standard shape and position, eliminating the problems of pose differences and inconsistent feature point positions. Next, background removal processing is performed on the above-mentioned verified face alignment image and the above-mentioned pre-stored face alignment image to obtain a target verified face alignment image corresponding to the above-mentioned verified face alignment image and a target pre-stored face alignment image corresponding to the above-mentioned pre-stored face alignment image. Thus, background removal processing can be performed on the verified face alignment image and the pre-stored face alignment image to remove the background images in the verified face alignment image and the pre-stored face alignment image. After that, the above-mentioned target verified face alignment image and the above-mentioned target pre-stored face alignment image are input into the input layer of a pre-trained face comparison model to obtain a pre-processed verified face alignment image corresponding to the above-mentioned target verified face alignment image and a pre-processed pre-stored face alignment image corresponding to the above-mentioned target pre-stored face alignment image, wherein the above-mentioned face comparison model includes the above-mentioned input layer, convolutional layer, pooling layer, and feature comparison layer. After that, the above-mentioned pre-processed verified face alignment image and the above-mentioned pre-processed pre-stored face alignment image are input into the above-mentioned convolutional layer to obtain the verified face feature information corresponding to the above-mentioned pre-processed verified face alignment image and the pre-stored face feature information corresponding to the above-mentioned pre-processed pre-stored face alignment image. Then, the above-mentioned verified face feature information and the above-mentioned pre-stored face feature information are input into the above-mentioned pooling layer to obtain a pooled verified face feature information corresponding to the above-mentioned verified face feature information and a pooled pre-stored face feature information corresponding to the above-mentioned pre-stored face feature information.Then, input the above pooling face feature information to be verified and the above pooling pre-stored face feature information into the above feature comparison layer to obtain a feature similarity value. Thus, a feature similarity value representing the similarity between the face image to be verified and the pre-stored face image can be obtained. After that, in response to determining that the above feature similarity value is greater than a preset value, the information representing that the face image to be verified and the pre-stored face image are of the same user is determined as face verification information. Thus, the face comparison model can be used to compare the face image to be verified after background removal with the pre-stored face image to obtain face verification information with a relatively high accuracy. Also, because the face image to be verified and the pre-stored face image are aligned before being compared, the face image to be verified and the pre-stored face image are adjusted to a unified standard shape and position, reducing the influence of pose differences and inconsistent feature point positions on image comparison. At the same time, background removal is performed on the face image to be verified and the pre-stored face image, reducing the interference of the background image existing in the face image on the face image comparison process, thereby improving the accuracy of face comparison.

[0049] Step 102, in response to determining that the user identity verification information represents that the user is a legitimate user, determine the data source identifier and the user identifier as identity identifier information.

[0050] In some embodiments, the above execution entity may, in response to determining that the user identity verification information represents that the user is a legitimate user, determine the above data source identifier and the above user identifier as identity identifier information.

[0051] Step 103, send the identity identifier information to a preset security password card to obtain the stored public key information corresponding to the identity identifier information from the preset security password card.

[0052] In some embodiments, the above execution entity may send the above identity identifier information to a preset security password card to obtain the stored public key information corresponding to the above identity identifier information from the above preset security password card. Among them, the above preset security password card may be a password card embedded in a computing device such as a server. The above preset security password card stores various key pair information corresponding to the identity identifier information, and the above key pair information includes stored public key information and stored private key information. The above stored private key information may represent the private key used for storing data. The above stored public key information may represent the public key for decrypting the stored data.

[0053] Step 104, generate data reading task information corresponding to the identity identifier information based on the identity identifier information.

[0054] In some embodiments, the above execution entity may generate data reading task information corresponding to the above identity identifier information based on the above identity identifier information.

[0055] In some alternative implementations of some embodiments, the above-mentioned execution entity may generate data reading task information corresponding to the above-mentioned identity identification information through the following steps based on the above-mentioned identity identification information:

[0056] First step, fill the above-mentioned identity identification information into the preset reading task template information to update the preset reading task template information. Among them, the above-mentioned preset reading task template information may represent a template predefined for reading data corresponding to placeholders in a database. The above-mentioned preset reading task template information contains placeholders for replacing identity identification information. In practice, first, the above-mentioned execution entity may identify the placeholders in the above-mentioned preset reading task template information through regular expression technology. Then, the above-mentioned execution entity may replace the above-mentioned identity identification information according to the positions and formats of the placeholders identified in the template to update the preset reading task template information.

[0057] Second step, determine the updated preset reading task template information as data reading task information.

[0058] Step 105, execute the reading task corresponding to the data reading task information to read the encrypted storage data corresponding to the identity identification information from the preset database.

[0059] In some embodiments, the above-mentioned execution entity may execute the reading task corresponding to the above-mentioned data reading task information to read the encrypted storage data corresponding to the above-mentioned identity identification information from the preset database.

[0060] Step 106, perform a decryption operation on the encrypted storage data based on the stored public key information to obtain the transmitted storage data.

[0061] In some embodiments, the above-mentioned execution entity may perform a decryption operation on the above-mentioned encrypted storage data based on the above-mentioned stored public key information to obtain the transmitted storage data.

[0062] In some alternative implementations of some embodiments, the above-mentioned execution entity may perform a decryption operation on the above-mentioned encrypted storage data based on the above-mentioned stored public key information through the following steps to obtain the transmitted storage data:

[0063] First step, obtain the decryption algorithm information corresponding to the above-mentioned identity identification information from the preset database. Among them, the above-mentioned decryption algorithm information represents a decryption algorithm for decrypting the encrypted storage data (for example, RSA decryption algorithm).

[0064] Step 2: Based on the above decryption algorithm information and the above stored public key information, perform a decryption operation on the above encrypted storage data to obtain the transmission storage data. In practice, the above execution entity may execute the decryption algorithm corresponding to the above decryption algorithm information, and perform a decryption operation on the encrypted storage data based on the public key corresponding to the above stored public key information to obtain the original storage data as the transmission storage data.

[0065] Step 107: Send the transmission storage data to the client device for the client device to display the transmission storage data.

[0066] In some embodiments, the above execution entity may send the above transmission storage data to the above client device for the above client device to display the above transmission storage data.

[0067] In the process of adopting technical solutions to solve the problems mentioned in the background art, the following problems often accompany:

[0068] When sending the transmission storage data to the client device, the transmission storage data may usually contain a large amount of sensitive privacy data (such as personal identity information, bank account information, etc.). When the transmission storage data is intercepted and cracked during the transmission process, the sensitive privacy data in the transmission storage data is leaked, and the security of data transmission is relatively low.

[0069] Facing the above technical problems, the inventor decides to adopt the following solutions:

[0070] In some alternative implementation manners of some embodiments, the above execution entity may send the above transmission storage data to the above client device through the following steps:

[0071] First step: Perform sensitive data identification processing on the above transmission storage data to obtain sensitive data. In practice, the above execution entity may perform sensitive data identification processing on the above transmission storage data through sensitive data identification technology to obtain sensitive data. Among them, the above sensitive data may include but is not limited to the following items: personal identity information, protected health information (such as medical records, disease history, drug use conditions, etc.).

[0072] Second step: Perform desensitization processing on the sensitive data included in the above transmission storage data to update the transmission storage data. In practice, the above execution entity may perform desensitization processing on the sensitive data included in the above transmission storage data through data desensitization technology (for example, replacement technology (such as replacing the middle four digits of the phone number with asterisks)) to update the transmission storage data.

[0073] Third step: Determine the updated transmission storage data as the desensitized transmission data.

[0074] Fourth step, perform network connection quality detection processing on the network of the above-mentioned client device to obtain network connection quality scoring information. In practice, the above-mentioned execution entity can use a network monitoring tool (for example, Zabbix monitoring tool) to perform network connection quality detection processing on the network of the client to obtain network connection quality scoring information. Among them, the above-mentioned network connection quality scoring information can represent the score of the network status of the client device (for example, the above-mentioned network connection quality scoring information can be "the network connection quality score is 0.44"). Optionally, the above-mentioned execution entity can use delay detection technology to detect the network of the client to obtain the delay time. After that, the above-mentioned execution entity can determine the value corresponding to the delay time as the network connection quality scoring information.

[0075] Fifth step, in response to determining that the score represented by the above-mentioned network connection quality scoring information is greater than the preset threshold, determine the desensitized transmission data as the target transmission data.

[0076] Sixth step, in response to determining that the score represented by the above-mentioned network connection quality scoring information is less than or equal to the preset value, perform compression processing on the above-mentioned desensitized transmission data according to the preset compression algorithm to obtain compressed desensitized transmission data. Among them, the above-mentioned compressed desensitized transmission data can be the data obtained by compressing the desensitized transmission data to be compressed.

[0077] Seventh step, determine the above-mentioned compressed desensitized transmission data as the target transmission data.

[0078] Eighth step, encrypt the target transmission data according to the preset transmission key to obtain encrypted transmission data. In practice, the above-mentioned execution entity can execute a preset encryption algorithm (for example, RSA encryption algorithm) to encrypt the target transmission data based on the preset transmission key to obtain encrypted transmission data.

[0079] Ninth step, send the above-mentioned encrypted transmission data to the above-mentioned client device.

[0080] The above technical solution and its related content, as an inventive point of an embodiment of the present disclosure, solve the technical problem of "low security of data transmission". The factors that lead to low security of data transmission are often as follows: when sending transmission storage data to a client device, the transmission storage data usually may contain a large amount of sensitive privacy data (such as personal identity information, bank account information, etc.). When the transmission storage data is intercepted and cracked during the transmission process, the sensitive privacy data in the transmission storage data is leaked, resulting in low security of data transmission. If the above factors are solved, the effect of data transmission security can be achieved. To achieve this effect, first, perform sensitive data identification processing on the above transmission storage data to obtain sensitive data. Thus, the sensitive data in the transmission storage data can be identified, and the sensitive data included in the transmission storage data can be determined. Then, perform desensitization processing on the sensitive data included in the above transmission storage data to update the transmission storage data. Thus, through desensitization processing, the real sensitive data of the transmission storage data can be converted into unidentifiable data. After that, determine the updated transmission storage data as desensitized transmission data. Then, perform network connection quality detection processing on the network of the above client device to obtain network connection quality scoring information. Thus, network connection quality scoring information representing the client network connection quality can be generated. Then, in response to determining that the score represented by the above network connection quality scoring information is greater than a preset threshold, determine the desensitized transmission data as the target transmission data. Thus, when the network connection condition of the client device is good, the desensitized transmission data can be determined as the target transmission data. Then, in response to determining that the score represented by the above network connection quality scoring information is less than or equal to the preset value, perform compression processing on the above desensitized transmission data according to a preset compression algorithm to obtain compressed desensitized transmission data. Thus, the desensitized transmission data to be compressed can be compressed. Then, determine the above compressed desensitized transmission data as the target transmission data. Thus, when the network connection condition of the client device is poor, the desensitized transmission data to be compressed can be compressed to obtain the target transmission data. Then, encrypt the target transmission data according to a preset transmission key to obtain encrypted transmission data. Thus, the target transmission data can be encrypted to ensure the security of the target transmission data during the transmission process. Finally, send the above encrypted transmission data to the above client device. Also, because when sending the transmission storage data to the client device, sensitive data identification processing and desensitization processing are performed on the transmission storage data, and the real sensitive data of the transmission storage data is converted into unidentifiable data. Even when the transmission storage data is intercepted and cracked during the transmission process, the sensitive privacy data in the transmission storage data will not be leaked, improving the security of data transmission.

[0081] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: Through the local data security access method based on a trusted environment in some embodiments of the present disclosure, the security of data reading is improved. Specifically, the reason for the low security of data reading is that: the data corresponding to the data reading request is read and the read data is transmitted to the client device, and the identity of the client user is not verified before reading the data, and the data is vulnerable to access by unauthorized users, resulting in data leakage and low security of data reading. At the same time, when storing the data of the client user, in order to ensure the security of data storage, the stored data is generally encrypted. The data corresponding to the data reading request is directly read and the read data is transmitted to the client device, and the stored data is not decrypted for storage. The client user may not be able to directly read and use these unencrypted stored data. Based on this, in some embodiments of the present disclosure, the local data security access method based on a trusted environment first, in response to receiving the data reading request information sent by the client device, based on the above data reading request information, the user identity is verified to obtain the user identity verification information, wherein the above data reading request information includes a data source identifier, a user identifier, and a client device identifier. Thus, the user identity can be verified when the data reading request information is received. After that, in response to determining that the user identity verification information indicates that the user is a legitimate user, the above data source identifier and the above user identifier are determined as the identity identifier information. Thus, it can be used to determine the identity identifier information for obtaining the public key information. Then, the above identity identifier information is sent to the preset security password card to obtain the stored public key information corresponding to the above identity identifier information from the above preset security password card. Thus, the stored public key information for decrypting the encrypted stored data can be obtained from the preset security password card. After that, based on the above identity identifier information, data reading task information corresponding to the above identity identifier information is generated. Thus, data reading task information corresponding to the identity identifier can be generated. Then, the reading task corresponding to the above data reading task information is executed to read the encrypted stored data corresponding to the above identity identifier information from the preset database. Thus, when the client user is a legitimate user, the encrypted stored data corresponding to the above identity identifier information can be read from the preset database. After that, based on the above stored public key information, the above encrypted stored data is decrypted to obtain the transmitted stored data. Thus, the read encrypted stored data can be decrypted to obtain the transmitted stored data, ensuring that the client can obtain the transmitted stored data with strong readability and usability after storage decryption. Finally, the above transmitted stored data is sent to the above client device for the above client device to display the above transmitted stored data. Thus, when the client user is a legitimate user, the transmitted stored data after storage decryption can be sent to the client device. Also because the client user is authenticated after receiving the data reading request information sent by the client device.When the client user is a legitimate user, the stored decrypted transmission storage data is sent to the client device, reducing unauthorized access to the data, reducing the risk of data leakage, and improving the security of data reading.

[0082] Further reference is made to Figure 2 , as an implementation of the methods shown in the various figures, the present disclosure provides some embodiments of a local data security access device based on a trusted environment. These device embodiments correspond to Figure 1 the method embodiments shown, and the device can be specifically applied to various electronic devices.

[0083] As Figure 2 shown, some embodiments of the local data security access device 200 based on a trusted environment include: an authentication processing unit 201, a determination unit 202, an acquisition unit 203, a generation unit 204, a reading unit 205, a decryption operation unit 206, and a sending unit 207. Among them, the authentication processing unit 201 is configured to, in response to receiving data reading request information sent by the client device, based on the data reading request information, perform authentication processing on the user identity to obtain user identity authentication information, where the data reading request information includes a data source identifier, a user identifier, and a client device identifier; the determination unit 202 is configured to, in response to determining that the user identity authentication information indicates that the user is a legitimate user, determine the data source identifier and the user identifier as identity identifier information; the acquisition unit 203 is configured to send the identity identifier information to a preset security password card to obtain stored public key information corresponding to the identity identifier information from the preset security password card; the generation unit 204 is configured to generate data reading task information corresponding to the identity identifier information based on the identity identifier information; the reading unit 205 is configured to execute the reading task corresponding to the data reading task information to read encrypted storage data corresponding to the identity identifier information from a preset database; the decryption operation unit 206 is configured to perform a decryption operation on the encrypted storage data based on the stored public key information to obtain transmission storage data; the sending unit 207 is configured to send the transmission storage data to the client device for the client device to display the transmission storage data.

[0084] It can be understood that the various units described in the device 200 correspond to the respective steps in the method referred to Figure 1 above. Therefore, the operations, features, and beneficial effects described above for the method also apply to the device 200 and the units included therein, and will not be repeated here.

[0085] Next, reference is made to Figure 3 , which shows a schematic structural diagram of an electronic device 300 suitable for implementing some embodiments of the present disclosure.Figure 3 The electronic device shown is merely an example and should not impose any limitations on the functions and scope of use of the embodiments of the present disclosure.

[0086] As Figure 3 shown, the electronic device 300 may include a processing device (such as a central processing unit, a graphics processing unit, etc.) 301, which may perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage device 308 into the random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other through a bus 304. The input / output (I / O) interface 305 is also connected to the bus 304.

[0087] Generally, the following devices may be connected to the I / O interface 305: an input device 306 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 308 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 309. The communication device 309 may allow the electronic device 300 to communicate with other devices wirelessly or wirelesly to exchange data. Although Figure 3 the electronic device 300 with various devices is shown, it should be understood that it is not required to implement or include all the shown devices. More or fewer devices may be implemented or included alternatively. Figure 3 Each block shown in

[0088] Specifically, according to some embodiments of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program codes for executing the methods shown in the flowcharts. In such some embodiments, the computer program may be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the functions defined in the methods of some embodiments of the present disclosure are executed.

[0089] It should be noted that the computer-readable media described in some embodiments of the present disclosure may be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In some embodiments of the present disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In some embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium may also be any computer-readable medium other than the computer-readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0090] In some embodiments, the client and the server may communicate using any currently known or future-developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with digital data communication in any form or medium (e.g., a communication network). Examples of communication networks include local area networks ("LANs"), wide area networks ("WANs"), the Internet (e.g., the Internet), and end-to-end networks (e.g., ad hoc end-to-end networks), as well as any currently known or future-developed networks.

[0091] A computer-readable medium can be included in an electronic device or exist separately without being assembled into the electronic device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device is caused to: in response to receiving data reading request information sent by a client device, based on the data reading request information, perform authentication processing on a user identity to obtain user identity authentication information, where the data reading request information includes a data source identifier, a user identifier, and a client device identifier; in response to determining that the user identity authentication information indicates that the user is a legitimate user, determine the data source identifier and the user identifier as identity identifier information; send the identity identifier information to a preset security password card to obtain stored public key information corresponding to the identity identifier information from the preset security password card; based on the identity identifier information, generate data reading task information corresponding to the identity identifier information; execute a reading task corresponding to the data reading task information to read encrypted stored data corresponding to the identity identifier information from a preset database; based on the stored public key information, perform a decryption operation on the encrypted stored data to obtain transmitted stored data; and send the transmitted stored data to the client device for the client device to display the transmitted stored data.

[0092] Computer program code for performing the operations of some embodiments of the present disclosure can be written in one or more programming languages or combinations thereof. The programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, executed as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, by using an Internet service provider to connect through the Internet).

[0093] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram may represent a module, a segment of a program, or a portion of code that contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions noted in the blocks may occur in a different order than noted in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, or they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and combinations of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or by a combination of dedicated hardware and computer instructions.

[0094] The units described in some embodiments of the present disclosure can be implemented in software or in hardware. The described units can also be provided in a processor. For example, it can be described as: a processor includes a verification processing unit 201, a determination unit 202, an acquisition unit 203, a generation unit 204, a reading unit 205, a decryption operation unit 206, and a sending unit 207. Among them, the names of these units do not, in some cases, constitute a limitation on the unit itself. For example, the determination unit can also be described as "the unit that determines the above data source identifier and the above user identifier as identity identifier information in response to determining that the user authentication information indicates that the user is a legitimate user".

[0095] The functions described above can be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that can be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), complex programmable logic devices (CPLDs), and so on.

[0096] The above description is only some preferred embodiments of the present disclosure and an explanation of the applied technical principles. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by the specific combination of technical features, but should also cover other technical solutions formed by any combination of technical features or their equivalent features without departing from the inventive concept. For example, technical solutions formed by mutually replacing features with similar functions disclosed in the embodiments of the present disclosure (but not limited to).

Claims

1. A local data security access method based on a trusted environment, comprising: Responding to receiving data reading request information sent by a client device, and based on the data reading request information, performing authentication processing on the user identity to obtain user identity authentication information, wherein the data reading request information includes a data source identifier, a user identifier, and a client device identifier; Responding to determining that the user identity authentication information indicates that the user is a legitimate user, determining the data source identifier and the user identifier as identity identifier information; Sending the identity identifier information to a preset security password card to obtain stored public key information corresponding to the identity identifier information from the preset security password card; Generating data reading task information corresponding to the identity identifier information based on the identity identifier information; Executing the reading task corresponding to the data reading task information to read encrypted storage data corresponding to the identity identifier information from a preset database; Performing a decryption operation on the encrypted storage data based on the stored public key information to obtain transmission storage data; Sending the transmission storage data to the client device for the client device to display the transmission storage data.

2. The method according to claim 1, wherein, The generating data reading task information corresponding to the identity identifier information based on the identity identifier information includes: Filling the identity identifier information into preset reading task template information to update the preset reading task template information; Determining the updated preset reading task template information as data reading task information.

3. The method according to claim 1, wherein, The performing a decryption operation on the encrypted storage data based on the stored public key information to obtain transmission storage data includes: Obtaining decryption algorithm information corresponding to the identity identifier information from a preset database; Performing a decryption operation on the encrypted storage data based on the decryption algorithm information and the stored public key information to obtain transmission storage data.

4. The method according to claim 1, wherein The performing authentication processing on the user identity based on the data reading request information to obtain user identity authentication information includes: Determining the data source identifier included in the data reading request information as a target data source identifier; Determining the user identifier included in the data reading request information as a target user identifier; Determining the client device identifier included in the data reading request information as a target client device identifier; Obtaining a pre-stored user identifier set corresponding to the target data source identifier; Responding to determining that the target user identifier is the same as one of the pre-stored user identifiers in the pre-stored user identifier set, obtaining a historical client device identifier set corresponding to the target user identifier; Responding to determining that the target client device identifier is the same as one of the historical client device identifiers in the historical client device identifier set, determining information indicating that the user is a legitimate user as user identity authentication information.

5. The method according to claim 4, wherein After the responding to determining that the target client device identifier is the same as one of the historical client device identifiers in the historical client device identifier set and determining information indicating that the user is a legitimate user as user identity authentication information, the method further includes: In response to determining that there is no target client device identifier in the historical client device identifier set that is the same as the target client device identifier, control the camera device of the client device to collect a face image of the user as the face image to be verified; Obtain a pre-stored face image corresponding to the target user identifier; Perform a comparison process on the face image to be verified and the pre-stored face image to obtain face verification information; In response to determining that the face verification information indicates that the face image to be verified and the pre-stored face image are face images of the same user, determine the information indicating that the user is a legal user as the user identity verification information.

6. A local data security access device based on a trusted environment, comprising: A verification processing unit, configured to, in response to receiving data reading request information sent by a client device, perform a verification process on the user identity based on the data reading request information to obtain user identity verification information, wherein the data reading request information includes a data source identifier, a user identifier, and a client device identifier; A determination unit, configured to, in response to determining that the user identity verification information indicates that the user is a legal user, determine the data source identifier and the user identifier as identity identifier information; An acquisition unit, configured to send the identity identifier information to a preset security password card to obtain stored public key information corresponding to the identity identifier information from the preset security password card; A generation unit, configured to generate data reading task information corresponding to the identity identifier information based on the identity identifier information; A reading unit, configured to execute the reading task corresponding to the data reading task information to read encrypted storage data corresponding to the identity identifier information from a preset database; A decryption operation unit, configured to perform a decryption operation on the encrypted storage data based on the stored public key information to obtain transmitted storage data; A sending unit, configured to send the transmitted storage data to the client device for the client device to display the transmitted storage data.

7. An electronic device, comprising: One or more processors; A storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

8. A computer-readable medium having a computer program stored thereon, wherein, The program, when executed by the processor, implements the method according to any one of claims 1 to 5.

Images