Data processing method and system for realizing availability and invisibility of data

Abstract

The invention discloses a data processing method and system for realizing availability and invisibility of data, and the method specifically comprises the steps: receiving user unique information and user sensitive information submitted by a user, generating an irreversible user unique identifier, carrying out the encryption processing of the user sensitive information, and storing the encrypted user sensitive information into a database; storing the unique identifier of the user and the encrypted sensitive information of the user into a database; receiving an access request submitted by a querier and unique information of the querier; authenticating the identity of the querier; transcoding the unique information of the querier to generate a temporary identifier of the querier; and decrypting the encrypted sensitive information of the user, and returning a combination of the decrypted sensitive information and the unique information of the querier. Therefore, the leakage risk of the mapping relation can be avoided, the situation that original sensitive information and data attribution cannot be directly obtained can be avoided, rainbow table attacks can be effectively resisted, it is ensured that only legal authorized users can conduct data access, and the unauthorized access risk is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a data processing method and system for realizing data usability and invisibility. BACKGROUND

[0002] With the increasing requirements of data security and privacy protection, sensitive information (such as name, ID number, salary, education background, family background, etc.) may be leaked in the process of database maintenance, debugging, log recording and the like even if access permission control is performed under the traditional database management mode. Therefore, how to realize data invisibility while ensuring data usability has become a technical problem to be solved. SUMMARY

[0003] The present application aims to at least partly solve the above technical problems.

[0004] To this end, the present application discloses a data processing method for realizing data usability and invisibility, comprising a data storage process and a data access process, wherein,

[0005] The data storage process comprises the following steps:

[0006] S101: receiving user unique information and user sensitive information submitted by a user;

[0007] S102: using a one-way hash function in combination with a unique salt value to code the user unique information in the memory, to generate an irreversible user unique identifier, and the coding process and mapping relationship are only performed in the memory;

[0008] S103: performing encryption processing on the user sensitive information;

[0009] S104: storing the user unique identifier as a primary key and the encrypted user sensitive information in a database;

[0010] The data access process comprises the following steps:

[0011] S201: receiving an access request and queryer unique information submitted by a queryer, and performing identity authentication on the queryer;

[0012] S202: if the authentication is passed, using the same one-way hash function in combination with the unique salt value as in step S102 to code the queryer unique information in the memory, to generate a queryer temporary identifier;

[0013] S203: querying the database based on the queryer temporary identifier, to obtain corresponding encrypted user sensitive information;

[0014] S204: decrypt the encrypted user sensitive information, combine the decrypted sensitive information and the inquirer unique information, and return.

[0015] In addition, the data processing method for realizing data availability invisibility according to the present application can have the following additional technical features:

[0016] Further, in step S102, the one-way hash function is SHA-256 or SHA-512.

[0017] Further, in step S103, the encryption algorithm used for the encryption processing of the user sensitive information is AES-256.

[0018] Further, in step S201, the identity authentication adopts a role-based access control mechanism.

[0019] Further, in step S101, the user unique information includes but is not limited to an ID card number, a mobile phone number, or a work number, and the user sensitive information includes but is not limited to salary information, educational background information, or family information.

[0020] Another aspect of the present application discloses a data processing system for realizing data availability invisibility, comprising a data storage layer and a data access layer, wherein,

[0021] The data storage layer is configured to receive user-submitted user unique information and user sensitive information, use a one-way hash function in combination with a unique salt value to convert the user unique information in memory, generate an irreversible user unique identifier, and only perform the conversion process and mapping relationship in memory, encrypt the user sensitive information, and store the user unique identifier as a primary key together with the encrypted user sensitive information in a database.

[0022] The data access layer is configured to receive an access request and inquirer unique information submitted by an inquirer, perform identity authentication on the inquirer, generate an inquirer temporary identifier by using a one-way hash function in combination with a unique salt value to convert the inquirer unique information in memory if the authentication is passed, query the database based on the inquirer temporary identifier, obtain the corresponding encrypted user sensitive information, decrypt the encrypted user sensitive information, combine the decrypted sensitive information and the inquirer unique information, and return.

[0023] According to the data processing method and system for realizing data availability invisibility disclosed in the application, the unique identity of a user is stored by transcoding, and in the data access stage, the transcoding is processed by the memory level, so that the sensitive information in the database cannot be identified, only the authorized access can obtain the binding result, and the data privacy protection strength is greatly improved, at least the following beneficial effects are obtained:

[0024] (1) The personal unique information is not directly stored, the transcoding and mapping relationship is only processed in the memory, and is not stored in the database, so as to avoid the risk of mapping relationship leakage;

[0025] (2) The sensitive information is stored by encryption, and the database administrator cannot directly obtain the original sensitive information and data ownership whether accessing the database or the log;

[0026] (3) The salt value is combined with the hash algorithm, so as to effectively resist rainbow table attack and improve the transcoding security;

[0027] (4) The permission verification and access authorization mechanism based on RBAC is used, so as to ensure that only the authorized user can access the data, and the unauthorized access risk is reduced.

[0028] The additional contents and advantages of the application will be given in the following description, or can be understood by the practice of the application. BRIEF DESCRIPTION OF DRAWINGS

[0029] The technical scheme and beneficial effects of the application will become obvious and easy to understand from the following contents combined with the drawings, in which:

[0030] Figure 1 The flowchart of the data processing method for realizing data availability invisibility of the application;

[0031] Figure 2 The architecture diagram of the data processing system for realizing data availability invisibility of the application. DETAILED DESCRIPTION

[0032] The technical scheme in the embodiments of the application will be described clearly and completely in the following with reference to the drawings of the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all the embodiments.

[0033] The data processing method and system for realizing data availability invisibility disclosed in the application will be described below with reference to the drawings;

[0034] As shown in the figure, Figure 1 A data processing method for realizing data availability invisibility comprises a data storage process and a data access process, wherein,

[0035] The data storage process comprises the following steps:

[0036] S101: receiving user-submitted user unique information and user sensitive information;

[0037] Specifically, the user unique information includes but is not limited to: ID number, mobile phone number or work number, and the user sensitive information includes but is not limited to: salary information, educational background information or family information;

[0038] S102: using a one-way hash function in combination with a unique salt value to encode the user unique information in the memory, to generate an irreversible user unique identifier, and the encoding process and mapping relationship are only performed in the memory;

[0039] Specifically, the one-way hash function is SHA-256 or SHA-512;

[0040] S103: encrypting the user sensitive information;

[0041] Specifically, the encryption algorithm used for encrypting the user sensitive information is AES-256;

[0042] S104: storing the user unique identifier as the primary key and the encrypted user sensitive information in the database;

[0043] The data access process includes the following steps:

[0044] S201: receiving a query-submitted access request and query unique information, and authenticating the query;

[0045] Specifically, the authentication adopts a role-based access control mechanism;

[0046] S202: if the authentication is passed, using the same one-way hash function in combination with a unique salt value as in step S102 to encode the query unique information in the memory, to generate a query temporary identifier;

[0047] S203: querying the database based on the query temporary identifier to obtain the corresponding encrypted user sensitive information;

[0048] S204: decrypting the encrypted user sensitive information, and returning the decrypted sensitive information combined with the query unique information.

[0049] As shown in Figure 2 A data processing system for realizing data availability and invisibility, comprising: a data storage layer and a data access layer, wherein,

[0050] The data storage layer is configured to receive user-submitted user unique information and user sensitive information, to use a one-way hash function in combination with a unique salt value to transcode the user unique information in memory, to generate a non-reversible user unique identifier, and to perform encryption processing on the user sensitive information, and to store the user unique identifier as a primary key and the encrypted user sensitive information in a database.

[0051] The data access layer is configured to receive a query-submitted access request and query unique information, to perform identity authentication on the query, to use a one-way hash function in combination with a unique salt value to transcode the query unique information in memory if the authentication is passed, to generate a query temporary identifier, to query the database based on the query temporary identifier, to obtain corresponding encrypted user sensitive information, to perform decryption on the encrypted user sensitive information, and to return the decrypted sensitive information and the query unique information.

[0052] Specifically, after receiving the user-submitted user unique information (such as an ID card number, a mobile phone number, etc.) and user sensitive information (such as salary information, educational background information, etc.), the data storage layer immediately starts the transcoding and encryption process in memory. The transcoding process for the user unique information is strictly limited in the memory environment, a one-way hash function such as SHA-256 or SHA-512 is used, and a unique salt value independently generated for each piece of user unique information is mixed for operation, and the generated user unique identifier has non-reversibility, which means that even if the database is illegally accessed, the original user unique information cannot be inferred from the stored user unique identifier. At the same time, the "original user unique information-user unique identifier" mapping relationship formed during the transcoding process only exists temporarily in memory operation and disappears after the operation is completed, and is not stored in any storage medium, thereby avoiding the risk of mapping relationship leakage from the root.

[0053] For the user sensitive information, the data storage layer uses the AES-256 encryption algorithm for encryption processing. This algorithm has high encryption strength, with a key length of 256 bits, and can effectively resist attack methods such as brute force cracking. The encrypted sensitive information will be stored in the database together with the user unique identifier generated above (as the database primary key, to ensure the uniqueness of data association), so that only processed non-sensitive identifiers and encrypted data exist in the database. Even if the database administrator or other unauthorized personnel directly access the database, they cannot obtain the original sensitive information and the corresponding data ownership relationship.

[0054] After receiving the access request of the inquirer and the unique information of the inquirer (such as the inquirer's work number), the data access layer first performs identity authentication based on the RBAC (Role-Based Access Control) mechanism. According to the pre-set role permission rules, the RBAC mechanism checks whether the inquirer has the access right to the corresponding data. For example, only the human resource role is allowed to access the salary-related data, and the access request of other roles will be directly rejected, so as to realize accurate permission control.

[0055] If the authentication is passed, the data access layer will reuse the SHA-256 or SHA-512 hash function used by the data storage layer in the memory and the same unique salt value to encode the unique information of the inquirer, generating a temporary identifier of the inquirer. This temporary identifier is consistent with the user unique identifier generated by the data storage layer in algorithm logic, ensuring that the corresponding encrypted sensitive information can be accurately matched in the database through the identifier.

[0056] After obtaining the encrypted sensitive information, the data access layer will use the corresponding key to decrypt it, and finally return the decrypted sensitive information combined with the unique information of the inquirer (such as the inquirer's submitted work number) to the inquirer. In the whole process, the original user unique information, the mapping relationship and the decryption key are not stored in the database, but only necessary operations are completed in the memory, which not only ensures that authorized inquirers can normally obtain the required data (realizing "available"), but also avoids the leakage of original sensitive information and associated relationships in the storage or transmission link (realizing "invisible").

[0057] In summary, according to the data processing method and system for realizing data availability and invisibility disclosed by the present application, the user unique identity is converted and stored, and the reverse conversion processing is performed in the data access stage through the memory level, so that the sensitive information in the database cannot be identified, only authorized access can obtain the binding result, which greatly improves the data privacy protection strength, at least has the following beneficial effects:

[0058] (1) The personal unique information is not directly stored, the conversion and mapping relationship are only processed in the memory, not stored in the database, avoiding the risk of mapping relationship leakage;

[0059] (2) The sensitive information is stored after encryption, and the database administrator cannot directly obtain the original sensitive information and data ownership whether accessing the database or the log;

[0060] (3) The salt value is combined with the hash algorithm to effectively resist rainbow table attacks and improve the conversion security;

[0061] (4) The permission verification and access authorization mechanism based on RBAC ensures that only authorized users can access the data, reducing the risk of unauthorized access.

[0062] Although the embodiments of the present application have been shown and described above, it is understood that the above-described embodiments are exemplary and are not to be construed as limiting the present application, and that variations, modifications, substitutions and changes can be made by those skilled in the art without departing from the scope of the present application.

Claims

1. A data processing method for realizing data availability invisibility, characterized in that, The application relates to a data storage and access method. The data storage process comprises the following steps: S101: receiving user-submitted user unique information and user sensitive information; S102: using a one-way hash function in combination with a unique salt value to code the user unique information in the memory, to generate an irreversible user unique identifier, and the coding process and mapping relationship are only carried out in the memory; S103: encrypting the user sensitive information; S104: storing the user unique identifier as a primary key and the encrypted user sensitive information in a database; The data access process comprises the following steps: S201: receiving a queryer-submitted access request and queryer unique information, and authenticating the queryer; S202: if the authentication is passed, using the same one-way hash function in combination with a unique salt value to code the queryer unique information in the memory, to generate a queryer temporary identifier; S203: querying the database based on the queryer temporary identifier, to obtain corresponding encrypted user sensitive information; S204: decrypting the encrypted user sensitive information, and returning the decrypted sensitive information and the queryer unique information. In step S102, the one-way hash function is SHA-256 or SHA-512.

2. The data processing method for realizing data usability invisibility according to claim 1, wherein, In step S103, the encryption algorithm used for encrypting the user sensitive information is AES-256.

3. The data processing method for realizing data usability invisibility according to claim 2, wherein, In step S201, the authentication adopts a role-based access control mechanism.

4. The data processing method for realizing data usability invisibility according to claim 3, wherein, In step S101, the user unique information comprises but is not limited to an ID card number, a mobile phone number or a work number, and the user sensitive information comprises but is not limited to salary information, educational background information or family information.

5. The data processing method for realizing data usability invisibility according to claim 4, wherein, The application relates to a data storage and access method.

6. A data processing system that enables data availability invisibility, characterized by, The data storage layer is used for receiving user-submitted user unique information and user sensitive information, using a one-way hash function in combination with a unique salt value to code the user unique information in the memory, to generate an irreversible user unique identifier, and the coding process and mapping relationship are only carried out in the memory, encrypting the user sensitive information, and storing the user unique identifier as a primary key and the encrypted user sensitive information in a database; The data access layer is used for receiving a queryer-submitted access request and queryer unique information, authenticating the queryer, using a one-way hash function in combination with a unique salt value to code the queryer unique information in the memory to generate a queryer temporary identifier if the authentication is passed, querying the database based on the queryer temporary identifier, obtaining corresponding encrypted user sensitive information, decrypting the encrypted user sensitive information, and returning the decrypted sensitive information and the queryer unique information. ​ ​

Images