Data processing method and device, storage medium and electronic equipment

Abstract

The invention discloses a data processing method and device, a storage medium and electronic equipment. The method comprises the following steps: determining a target key through a plurality of data encryption service modules and a plurality of data decryption service modules in a trusted execution environment; determining target encrypted financial data according to the target key and the target financial data through a plurality of data encryption service modules and a data decryption service module; and decrypting the target encrypted financial data by using the target key through the data decryption service module to obtain the target financial data. By means of the data protection method and device, the problem that in the related technology, data protection is conducted on financial data through a special hardware cipher machine, and convenience is poor is solved.

Description

Technical Field

[0001] This application relates to the field of financial technology, and more specifically, to a data processing method and apparatus, a storage medium and an electronic device. Background Technology

[0002] Cryptographic services play a crucial role in the financial industry. To ensure transaction security, financial institutions often employ dedicated hardware encryption devices, such as financial service cryptographic machines, for data encryption and decryption. While these devices offer high security, their internal software services are typically provided by specific vendors and are not flexible or user-friendly, impacting the flexibility and efficiency of data encryption and decryption during financial data processing.

[0003] The use of dedicated hardware cryptographic machines to protect financial data in related technologies suffers from poor convenience, and no effective solution has yet been proposed. Summary of the Invention

[0004] The main objective of this application is to provide a data processing method and apparatus, storage medium and electronic device to solve the problem that the data protection of financial data using dedicated hardware cryptographic machines in related technologies is not very convenient.

[0005] To achieve the above objectives, according to one aspect of this application, a data processing method is provided. The method includes: determining a target key through multiple data encryption service modules and a data decryption service module in a trusted execution environment; determining target encrypted financial data based on the target key and target financial data through the multiple data encryption service modules and the data decryption service module; and decrypting the target encrypted financial data using the target key through the data decryption service module to obtain the target financial data.

[0006] Furthermore, determining the target key through multiple data encryption and decryption service modules in the trusted execution environment includes: obtaining a preset base and a preset prime number through each data encryption and decryption service module; obtaining the private key corresponding to each data encryption service module through each data encryption service module; obtaining the private key corresponding to each data decryption service module through each data decryption service module; and determining the target key through each data encryption and decryption service module based on the preset base, the preset prime number, the private key corresponding to each data encryption service module, and the private key corresponding to each data decryption service module.

[0007] Furthermore, in the case of multiple data encryption service modules including a first data encryption service module, a second data encryption service module, and a third data encryption service module, determining the target key by each data encryption service module and data decryption service module based on a preset base, a preset prime number, the private key corresponding to each data encryption service module, and the private key corresponding to the data decryption service module includes: calculating a first key by the first data encryption service module based on the preset base, the preset prime number, and the private key corresponding to the first data encryption service module, and sending the first key to the second data encryption service module; calculating a second key by the second data encryption service module based on the preset base, the preset prime number, and the private key corresponding to the second data encryption service module, calculating a third key based on the first and second keys, and sending the third key to the third data encryption service module; calculating a fourth key by the third data encryption service module based on the preset base, the preset prime number, and the private key corresponding to the third data encryption service module, calculating a fifth key based on the third and fourth keys, and sending the fifth key to the data decryption service module; and calculating a sixth key by the data decryption service module based on the preset base, the preset prime number, and the private key corresponding to the data decryption service module, and calculating the target key based on the fifth and sixth keys.

[0008] Furthermore, determining the target encrypted financial data based on the target key and target financial data through multiple data encryption service modules and data decryption service modules includes: encrypting the target financial data using the target key through each data encryption service module to obtain the encrypted financial data corresponding to each data encryption service module, and sending the encrypted financial data corresponding to each data encryption service module to the data decryption service module; and generating the target encrypted financial data through the data decryption service module based on the encrypted financial data corresponding to each data encryption service module.

[0009] Furthermore, before determining the target key through multiple data encryption service modules and data decryption service modules in the trusted execution environment, the method further includes: initiating remote authentication challenges between the remote authentication submodules of each data encryption service module and the remote authentication submodule of the data decryption service module; determining the target signature value through each remote authentication submodule other than the remote authentication submodule that initiated the challenge, and sending the target signature value to the remote authentication submodule that initiated the challenge; and performing security verification of the target signature value based on the certificate by the remote authentication submodule that initiated the challenge.

[0010] Furthermore, determining the target signature value through each remote authentication submodule other than the one that initiates the challenge includes: calculating the hash value of the service module to which each remote authentication submodule belongs, and signing the hash value using the chip key of the trusted execution environment to obtain the target signature value.

[0011] Furthermore, after decrypting the target encrypted financial data using the target key through the data decryption service module to obtain the target financial data, the method also includes: processing the target financial data using a preset large model, and outputting the processed result data to a preset storage location or application interface.

[0012] To achieve the above objectives, according to another aspect of this application, a data processing apparatus is provided. The apparatus includes: a first determining unit, configured to determine a target key through multiple data encryption service modules and data decryption service modules in a trusted execution environment; a second determining unit, configured to determine target encrypted financial data based on the target key and target financial data through the multiple data encryption service modules and data decryption service modules; and a first processing unit, configured to decrypt the target encrypted financial data using the target key through the data decryption service modules to obtain the target financial data.

[0013] Further, the first determining unit includes: a first obtaining subunit, used to obtain a preset base and a preset prime number through each data encryption service module and data decryption service module; a second obtaining subunit, used to obtain the private key corresponding to each data encryption service module through each data encryption service module, and obtain the private key corresponding to the data decryption service module through the data decryption service module; and a determining subunit, used to determine the target key through each data encryption service module and data decryption service module based on the preset base, the preset prime number, the private key corresponding to each data encryption service module, and the private key corresponding to the data decryption service module.

[0014] Furthermore, in the case where multiple data encryption service modules include a first data encryption service module, a second data encryption service module, and a third data encryption service module, the sub-unit is determined to include: a first calculation module, used to calculate a first key using the first data encryption service module based on a preset base, a preset prime number, and the private key corresponding to the first data encryption service module, and send the first key to the second data encryption service module; a second calculation module, used to calculate a second key using the second data encryption service module based on a preset base, a preset prime number, and the private key corresponding to the second data encryption service module, calculate a third key based on the first and second keys, and send the third key to the third data encryption service module; a third calculation module, used to calculate a fourth key using the third data encryption service module based on a preset base, a preset prime number, and the private key corresponding to the third data encryption service module, calculate a fifth key based on the third and fourth keys, and send the fifth key to the data decryption service module; and a fourth calculation module, used to calculate a sixth key using the data decryption service module based on a preset base, a preset prime number, and the private key corresponding to the data decryption service module, and calculate a target key based on the fifth and sixth keys.

[0015] Furthermore, the second determining unit includes: a first processing subunit, used to encrypt the target financial data using the target key through each data encryption service module to obtain encrypted financial data corresponding to each data encryption service module, and send the encrypted financial data corresponding to each data encryption service module to the data decryption service module; and a second processing subunit, used to generate target encrypted financial data through the data decryption service module based on the encrypted financial data corresponding to each data encryption service module.

[0016] Furthermore, the device also includes: a second processing unit, configured to initiate remote authentication challenges between the remote authentication submodules of each data encryption service module and the remote authentication submodule of the data decryption service module before determining the target key through multiple data encryption service modules and data decryption service modules in the trusted execution environment; a third processing unit, configured to determine the target signature value through each remote authentication submodule other than the remote authentication submodule that initiated the challenge, and send the target signature value to the remote authentication submodule that initiated the challenge; and a fourth processing unit, configured to perform security verification of the target signature value based on the certificate through the remote authentication submodule that initiated the challenge.

[0017] Furthermore, the third processing unit includes a computation subunit, which is used to calculate the hash value of the service module to which each remote authentication submodule belongs, except for the remote authentication submodule that initiates the challenge, and to sign the hash value using the chip key of the trusted execution environment to obtain the target signature value.

[0018] Furthermore, the device also includes a fifth processing unit, which, after decrypting the target encrypted financial data using the target key through the data decryption service module to obtain the target financial data, processes the target financial data using a preset large model and outputs the processed result data to a preset storage location or application interface.

[0019] According to another aspect of the present invention, an electronic device is also provided, comprising: a memory storing an executable program; and a processor for running the program, wherein the program executes the data processing method described above during runtime.

[0020] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein the storage medium stores a program, and the program controls the device where the storage medium is located to execute the data processing method described above when it is running.

[0021] In this embodiment, the following steps are employed: a target key is determined through multiple data encryption and decryption service modules within a trusted execution environment; target encrypted financial data is determined based on the target key and target financial data through the multiple data encryption and decryption service modules; and the target encrypted financial data is decrypted using the target key by the data decryption service module to obtain the target financial data. This solves the technical problem in related technologies where data protection using dedicated hardware cryptographic machines for financial data protection suffers from poor convenience.

[0022] In this solution, the generation and sharing of keys by multiple parties are achieved through a trusted execution environment. Financial data does not need to be remotely invoked by a hardware encryption machine. While ensuring the security of financial data, the efficiency and convenience of data encryption are improved, and the dependence on remote invocation of dedicated cryptographic hardware is reduced. This allows data encryption, decryption and processing to be carried out efficiently and securely in a local trusted execution environment. Attached Figure Description

[0023] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0024] Figure 1 A hardware structure block diagram of a computer terminal for implementing a data processing method is shown.

[0025] Figure 2 This is a flowchart of a data processing method provided according to an embodiment of this application;

[0026] Figure 3 This is a schematic diagram of the structure of a data processing system provided according to an embodiment of this application;

[0027] Figure 4 This is a schematic diagram of a data processing apparatus provided according to an embodiment of this application;

[0028] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0032] Example 1

[0033] According to an embodiment of this application, a method embodiment for data processing is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0034] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a data processing method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0035] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0036] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the data processing method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned data processing method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0037] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0038] The display may be a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0039] Under the aforementioned operating environment, this application provides the following: Figure 2 The data processing method shown. Figure 2 This is a flowchart of a data processing method according to Embodiment 1 of this application. The data processing method includes:

[0040] Step S201: Determine the target key through multiple data encryption service modules and data decryption service modules in the trusted execution environment.

[0041] In an optional embodiment, Figure 3 This is a schematic diagram of the structure of a data processing system provided according to an embodiment of this application, such as... Figure 3As shown, the system comprises a data encryption service module 1, a data encryption service module 2, a data encryption service module 3, and a data decryption service module 4. Optionally, multiple data encryption service modules can be deployed in the trusted execution environment of the data provider, and the data decryption service module can be deployed in the trusted execution environment of the data user. Data encryption service module 1 consists of a remote authentication submodule 11, a key exchange submodule 12, and a data encryption submodule 13. Data encryption service module 2 consists of a remote authentication submodule 21, a key exchange submodule 22, and a data encryption submodule 23. Data encryption service module 3 consists of a remote authentication submodule 31, a key exchange submodule 32, and a data encryption submodule 33. Data decryption service module 4 consists of a remote authentication submodule 41, a key exchange submodule 42, a data decryption submodule 43, and a data processing submodule 44.

[0042] Optionally, a protection key (i.e., the target key) can be determined jointly by key exchange submodule 12, key exchange submodule 22, key exchange submodule 32 and key exchange submodule 42.

[0043] Step S202: The target encrypted financial data is determined by multiple data encryption service modules and data decryption service modules based on the target key and the target financial data.

[0044] Optionally, in the data processing method provided in this application embodiment, determining the target encrypted financial data based on the target key and target financial data through multiple data encryption service modules and data decryption service modules includes: encrypting the target financial data using the target key through each data encryption service module to obtain the encrypted financial data corresponding to each data encryption service module, and sending the encrypted financial data corresponding to each data encryption service module to the data decryption service module; and generating the target encrypted financial data through the data decryption service module based on the encrypted financial data corresponding to each data encryption service module.

[0045] In an optional embodiment, each data encryption service module encrypts the target financial data using the target key to obtain encrypted financial data corresponding to each data encryption service module, and then sends the encrypted financial data corresponding to each data encryption service module to the data decryption service module. For example, key exchange submodule 12 gives the key Yabcd to data encryption submodule 13. Data encryption submodule 13 encrypts the target financial data using a symmetric encryption algorithm in a trusted execution environment to obtain ciphertext Da, which is then sent to data decryption submodule 43. Similarly, key exchange submodule 22 gives the key Yabcd to data encryption submodule 23. Data encryption submodule 23 encrypts the target financial data using a symmetric encryption algorithm in a trusted execution environment to obtain ciphertext Db, which is then sent to data decryption submodule 43. Key exchange submodule 32 gives the key Yabcd to data encryption submodule 33. Data encryption submodule 33 encrypts the target financial data using a symmetric encryption algorithm in a trusted execution environment to obtain ciphertext Dc, which is then sent to data decryption submodule 43.

[0046] The data decryption service module generates target encrypted financial data based on the encrypted financial data corresponding to each data encryption service module. For example, the data decryption submodule 43 receives encrypted financial data Da, encrypted financial data Db, and encrypted financial data Dc, and merges them to obtain target encrypted financial data Dd.

[0047] The ciphertext is encrypted in parallel by multiple parties, shortening the overall encryption time and improving the encryption efficiency of financial data. Since both encryption and decryption operations are performed within a trusted execution environment, the risk of data tampering or leakage during transmission is avoided, thus enhancing security.

[0048] Step S203: The target encrypted financial data is decrypted using the target key through the data decryption service module to obtain the target financial data.

[0049] Optionally, the target key Yabcd is passed to the data decryption submodule 43 via the key exchange submodule 42 of the data decryption service module 4. The data decryption submodule 43, in a trusted execution environment, uses the key Yabcd to decrypt and obtain the plaintext financial data (i.e., the target financial data). Since the ciphertexts Da, Db, and Dc of the financial data are all encrypted using the same key Yabcd, they can be decrypted using the key Yabcd.

[0050] In summary, by enabling multi-party key generation and sharing through a trusted execution environment, financial data can be encrypted without remotely calling hardware encryption machines. This ensures the security of financial data while improving the efficiency and convenience of data encryption, reducing reliance on remote calls to dedicated cryptographic hardware, and enabling data encryption, decryption, and processing to be carried out efficiently and securely in a local trusted execution environment.

[0051] Optionally, in the data processing method provided in this application embodiment, determining the target key through multiple data encryption service modules and data decryption service modules in a trusted execution environment includes: obtaining a preset base and a preset prime number through each data encryption service module and data decryption service module; obtaining the private key corresponding to each data encryption service module through each data encryption service module; obtaining the private key corresponding to each data decryption service module through each data decryption service module; and determining the target key through each data encryption service module and data decryption service module based on the preset base, the preset prime number, the private key corresponding to each data encryption service module, and the private key corresponding to the data decryption service module.

[0052] In an optional embodiment, a preset base and a preset prime number are obtained by each data encryption service module and data decryption service module. For example, key exchange submodules 12, 22, 32, and 42 first publicly obtain the base g and the prime number p. Each data encryption service module obtains its corresponding private key, and the data decryption service module obtains its corresponding private key. For example, key exchange submodule 12 generates private key a via a chip, key exchange submodule 22 generates private key b via a chip, key exchange submodule 32 generates private key c via a chip, and key exchange submodule 42 generates private key d via a chip. The target key is determined by each data encryption service module and data decryption service module based on the preset base, the preset prime number, the private key corresponding to each data encryption service module, and the private key corresponding to each data decryption service module. For example, key exchange submodules 12, 22, 32 and 42 can determine the target key based on the base g, prime number p, private key a, private key b, private key c and private key d.

[0053] Secure key generation is achieved by exchanging keys using a preset base and a preset prime number.

[0054] Optionally, in the data processing method provided in this application embodiment, when multiple data encryption service modules include a first data encryption service module, a second data encryption service module, and a third data encryption service module, determining the target key by each data encryption service module and data decryption service module based on a preset base, a preset prime number, the private key corresponding to each data encryption service module, and the private key corresponding to the data decryption service module includes: calculating a first key by the first data encryption service module based on the preset base, a preset prime number, and the private key corresponding to the first data encryption service module, and sending the first key to the second data encryption service module; and then, by the second data encryption service module based on the preset base, a preset prime number, and the private key corresponding to the first data encryption service module, determining the target key by the second ... determining the target key by the second data encryption service module based on the preset base, a preset prime number, and the private key corresponding to the first data encryption service module, and then, by the second data encryption service module based on the preset base, a preset prime number, and the private key corresponding to the first data encryption service module, determining the target key by the second data encryption service module based on the preset base, a preset prime number, and the private key corresponding to the first data encryption service module, and then, by the second data encryption service module based on the preset base, a preset prime number, and the private key corresponding to the first data encryption service module, determining the target key by the second data encryption service module based on the preset base, a preset prime number, and the private key corresponding to the first data encryption service module, and then, by the second data encryption service module based on the preset base, a preset prime number, and the private key corresponding to the first data encryption service module, determining the target key by the second data A second key is calculated based on a preset base, a preset prime number, and the private key corresponding to the second data encryption service module. A third key is calculated based on the first and second keys and sent to the third data encryption service module. A fourth key is calculated by the third data encryption service module based on the preset base, a preset prime number, and the private key corresponding to the third data encryption service module. A fifth key is calculated based on the third and fourth keys and sent to the data decryption service module. A sixth key is calculated by the data decryption service module based on the preset base, a preset prime number, and the private key corresponding to the data decryption service module. A target key is calculated based on the fifth and sixth keys.

[0055] In an optional embodiment, a first key is calculated by the first data encryption service module based on a preset base, a preset prime number, and the private key corresponding to the first data encryption service module, and the first key is sent to the second data encryption service module. For example, the first key Ya is calculated by the key exchange submodule 12 of the data encryption service module 1 based on the base g, the prime number p, and the private key a, as shown in the following formula:

[0056] Ya = g a modp

[0057] Here, mod is the modulo function.

[0058] Then the first key Ya is transmitted to the key exchange submodule 22 of the data encryption service module 2.

[0059] The second data encryption service module calculates a second key based on a preset base, a preset prime number, and the private key corresponding to the second data encryption service module. It then calculates a third key based on the first and second keys and sends the third key to the third data encryption service module. For example, the key exchange submodule 22 of data encryption service module 2 calculates the second key Yb based on the base g, the prime number p, and the private key b, as shown in the following formula:

[0060] Yb = g b modp

[0061] The third key Yab is calculated based on the first key Ya and the second key Yb, using the following formula:

[0062] Yab = Ya * Yb, that is, Yab = g ab modp

[0063] The third key, Yab, is transmitted to the key exchange submodule 32 of the data encryption service module 3.

[0064] The third data encryption service module calculates the fourth key based on the preset base, the preset prime number, and the private key corresponding to the third data encryption service module. The fifth key is then calculated based on the third and fourth keys and sent to the data decryption service module. For example, the fourth key Yc is calculated by the key exchange submodule 32 based on the base g, the prime number p, and the private key c, using the following formula:

[0065] Yc = g c modp

[0066] The fifth key, Yabc, is calculated based on the third key, Yab, and the fourth key, Yc, using the following formula:

[0067] Yabc = Yab * Yc, that is, Yabc = g abc modp

[0068] The fifth key, Yabc, is transmitted to the key exchange submodule 42 of the data decryption service module 4.

[0069] The data decryption service module calculates the sixth key based on the preset base, preset prime number, and the private key corresponding to the data decryption service module. The target key is then calculated using the fifth and sixth keys. For example, the sixth key Yd is calculated by the key exchange submodule 42 based on the base g, prime number p, and private key d, using the following formula:

[0070] Yd = g d modp

[0071] The target key Yabcd is calculated based on the fifth key Yabc and the sixth key Yd, using the following formula:

[0072] Yabcd=Yabc*Yd, that is, Yabcd=g abcd modp

[0073] The key exchange submodule 42 obtains the target key Yabcd.

[0074] Similarly, key exchange submodule 22 sends Yb to key exchange submodule 32, key exchange submodule 32 sends Ybc to key exchange submodule 42, key exchange submodule 42 sends Ybcd to key exchange submodule 12, and key exchange submodule 12 obtains the target key Yabcd; key exchange submodule 32 sends Yc to key exchange submodule 42, key exchange submodule 42 sends Ycd to key exchange submodule 12, key exchange submodule 12 sends Yacd to key exchange submodule 22, and key exchange submodule 22 obtains the target key Yabcd; key exchange submodule 42 sends Yd to key exchange submodule 12, key exchange submodule 12 sends Yad to key exchange submodule 22, key exchange submodule 22 sends Yabd to key exchange submodule 32, and key exchange submodule 32 obtains the target key Yabcd.

[0075] By exchanging cryptographic keys among multiple trusted execution environments to generate the same protection key, key sharing among trusted execution environments is achieved, thus enhancing key security.

[0076] Optionally, in the data processing method provided in this application embodiment, before determining the target key through multiple data encryption service modules and data decryption service modules in a trusted execution environment, the method further includes: initiating remote authentication challenges between the remote authentication submodules of each data encryption service module and the remote authentication submodule of the data decryption service module; determining the target signature value through each remote authentication submodule other than the remote authentication submodule that initiated the challenge, and sending the target signature value to the remote authentication submodule that initiated the challenge; and performing security verification of the target signature value based on the certificate through the remote authentication submodule that initiated the challenge.

[0077] In an optional embodiment, remote authentication is performed before determining the target key through multiple data encryption and decryption service modules in the trusted execution environment. For example, remote authentication submodule 11 remotely authenticates with remote authentication submodules 21, 31, and 41. Remote authentication submodule 11 initiates a remote proof challenge to remote authentication submodules 21, 31, and 41. Remote authentication submodule 21 initiates remote authentication, calculates the hash value of the entire service module, signs the hash value using the chip key of its trusted execution environment, and returns the signature value (i.e., the target signature value) to remote authentication submodule 11. Remote authentication submodules 31 and 41 perform the same operation.

[0078] Remote authentication submodule 11 receives the signature values ​​from remote authentication submodules 21, 31, and 41, verifies the signature values ​​through certificates, and thus completes the security authentication between remote authentication submodule 11 and remote authentication submodules 21, 31, and 41.

[0079] Similarly, remote authentication submodule 21 initiates and completes security authentication with remote authentication submodule 11, remote authentication submodule 31, and remote authentication submodule 41; remote authentication submodule 31 initiates and completes security authentication with remote authentication submodule 11, remote authentication submodule 21, and remote authentication submodule 41; and remote authentication submodule 41 initiates and completes security authentication with remote authentication submodule 11, remote authentication submodule 21, and remote authentication submodule 31.

[0080] The remote authentication challenge mechanism ensures the authenticity of the modules involved in the encryption and decryption process. Leveraging the unforgeability and immutability of the trusted execution environment effectively prevents the access of counterfeit modules, guaranteeing the secure operation of the entire system.

[0081] Optionally, in the data processing method provided in this application embodiment, determining the target signature value through each remote authentication submodule other than the remote authentication submodule that initiates the challenge includes: calculating the hash value of the service module to which each remote authentication submodule belongs, and signing the hash value using the chip key of the trusted execution environment to which it belongs, thereby obtaining the target signature value.

[0082] In an optional embodiment, the target signature value can be obtained by each remote authentication submodule (excluding the one initiating the challenge) calculating the hash value of its service module and signing the hash value using the chip key of its trusted execution environment. For example, remote authentication submodule 11 initiates a remote authentication challenge to remote authentication submodules 21, 31, and 41. Remote authentication submodule 21 initiates remote authentication, calculates the hash value of the entire service module, and signs the hash value using the chip key of its trusted execution environment to obtain the target signature value. Remote authentication submodules 31 and 41 perform the same operation.

[0083] By using the chip key of the Trusted Execution Environment to sign the hash value, the authenticity of the signature is guaranteed, providing a data foundation for security verification.

[0084] Optionally, in the data processing method provided in the embodiments of this application, after decrypting the target encrypted financial data using the target key through the data decryption service module to obtain the target financial data, the method further includes: processing the target financial data using a preset large model, and outputting the processed result data to a preset storage location or application interface.

[0085] In an optional embodiment, the data processing submodule 44 processes the financial data, which can be applied to data processing scenarios such as large-scale models. The preset large-scale model can be a machine learning model, data analysis algorithm, or other business logic processing program, capable of performing in-depth processing on the decrypted financial data to extract valuable information or make decisions. This ensures both data security and effective data utilization.

[0086] The data processing method provided in this application embodiment enables multi-party generation and sharing of keys through a trusted execution environment. Financial data does not require remote invocation of hardware encryption machines. While ensuring the security of financial data, it improves the efficiency and convenience of data encryption, reduces the dependence on remote invocation of dedicated cryptographic hardware, and enables data encryption, decryption and processing to be carried out efficiently and securely in a local trusted execution environment.

[0087] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0088] Example 2

[0089] This application also provides a data processing apparatus. It should be noted that the data processing apparatus of this application can be used to execute the data processing method provided in this application. The data processing apparatus provided in this application will be described below.

[0090] According to embodiments of this application, a data processing apparatus for implementing the above-described data processing method is also provided, such as... Figure 4 As shown, the device includes: a first determining unit 401, a second determining unit 402, and a first processing unit 403.

[0091] The first determining unit 401 is used to determine the target key through multiple data encryption service modules and data decryption service modules in the trusted execution environment;

[0092] The second determining unit 402 is used to determine the target encrypted financial data based on the target key and the target financial data through multiple data encryption service modules and data decryption service modules;

[0093] The first processing unit 403 is used to decrypt the target encrypted financial data using the target key through the data decryption service module to obtain the target financial data.

[0094] The data processing apparatus provided in this application embodiment determines a target key through a first determining unit 401 using multiple data encryption and decryption service modules in a trusted execution environment; a second determining unit 402 determines target encrypted financial data based on the target key and target financial data through the multiple data encryption and decryption service modules; and a first processing unit 403 decrypts the target encrypted financial data using the target key through the data decryption service module to obtain the target financial data. This solves the technical problem in related technologies where data protection using dedicated hardware cryptographic machines for financial data protection is inconvenient.

[0095] Optionally, in the data processing apparatus provided in this application embodiment, the first determining unit 401 includes: a first obtaining subunit, used to obtain a preset base and a preset prime number through each data encryption service module and data decryption service module; a second obtaining subunit, used to obtain the private key corresponding to each data encryption service module through each data encryption service module, and obtain the private key corresponding to the data decryption service module through the data decryption service module; and a determining subunit, used to determine the target key through each data encryption service module and data decryption service module based on the preset base, the preset prime number, the private key corresponding to each data encryption service module, and the private key corresponding to the data decryption service module.

[0096] Optionally, in the data processing apparatus provided in this application embodiment, when the multiple data encryption service modules include a first data encryption service module, a second data encryption service module, and a third data encryption service module, the determined sub-unit includes: a first calculation module, used to calculate a first key using the first data encryption service module based on a preset base, a preset prime number, and the private key corresponding to the first data encryption service module, and send the first key to the second data encryption service module; a second calculation module, used to calculate a second key using the second data encryption service module based on a preset base, a preset prime number, and the private key corresponding to the second data encryption service module, calculate a third key based on the first key and the second key, and send the third key to the third data encryption service module; a third calculation module, used to calculate a fourth key using the third data encryption service module based on a preset base, a preset prime number, and the private key corresponding to the third data encryption service module, calculate a fifth key based on the third key and the fourth key, and send the fifth key to the data decryption service module; a fourth calculation module, used to calculate a sixth key using the data decryption service module based on a preset base, a preset prime number, and the private key corresponding to the data decryption service module, and calculate a target key based on the fifth key and the sixth key.

[0097] Optionally, in the data processing apparatus provided in this application embodiment, the second determining unit 402 includes: a first processing subunit, configured to encrypt target financial data using a target key through each data encryption service module to obtain encrypted financial data corresponding to each data encryption service module, and send the encrypted financial data corresponding to each data encryption service module to the data decryption service module; and a second processing subunit, configured to generate target encrypted financial data through the data decryption service module based on the encrypted financial data corresponding to each data encryption service module.

[0098] Optionally, in the data processing apparatus provided in this application embodiment, the apparatus further includes: a second processing unit, configured to initiate remote authentication challenges between the remote authentication submodules of each data encryption service module and the remote authentication submodule of the data decryption service module before determining the target key through multiple data encryption service modules and data decryption service modules in a trusted execution environment; a third processing unit, configured to determine the target signature value through each remote authentication submodule other than the remote authentication submodule that initiated the challenge, and send the target signature value to the remote authentication submodule that initiated the challenge; and a fourth processing unit, configured to perform security verification of the target signature value based on the certificate through the remote authentication submodule that initiated the challenge.

[0099] Optionally, in the data processing apparatus provided in this application embodiment, the third processing unit includes: a calculation subunit, used to calculate the hash value of the service module to which each remote authentication submodule belongs, except for the remote authentication submodule that initiates the challenge, and to sign the hash value using the chip key of the trusted execution environment to obtain the target signature value.

[0100] Optionally, in the data processing apparatus provided in the embodiments of this application, the apparatus further includes: a fifth processing unit, used to decrypt the target encrypted financial data using the target key through the data decryption service module to obtain the target financial data, and then use a preset large model to process the target financial data and output the processed result data to a preset storage location or application interface.

[0101] It should be noted that the first determining unit 401, the second determining unit 402, and the first processing unit 403 mentioned above correspond to steps S201 to S203 in Embodiment 1. The three units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0102] Example 3

[0103] Embodiments of this application may provide an electronic device. Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 Only one of the components is shown: processor 502, memory 504, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module, and display.

[0104] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0105] The processor can invoke information and applications stored in the memory through the transmission device to perform the following steps: determine the target key through multiple data encryption service modules and data decryption service modules in the trusted execution environment; determine the target encrypted financial data based on the target key and target financial data through multiple data encryption service modules and data decryption service modules; and decrypt the target encrypted financial data using the target key through the data decryption service module to obtain the target financial data.

[0106] The processor can invoke the information and application stored in the memory through the transmission device to perform the following steps: obtaining a preset base and a preset prime number through each data encryption service module and data decryption service module; obtaining the private key corresponding to each data encryption service module through each data encryption service module; obtaining the private key corresponding to the data decryption service module through the data decryption service module; and determining the target key through each data encryption service module and data decryption service module based on the preset base, the preset prime number, the private key corresponding to each data encryption service module, and the private key corresponding to the data decryption service module.

[0107] The processor can invoke information and application programs stored in the memory via the transmission device to execute the following steps: The first data encryption service module calculates a first key based on a preset base, a preset prime number, and the private key corresponding to the first data encryption service module, and sends the first key to the second data encryption service module; the second data encryption service module calculates a second key based on the preset base, a preset prime number, and the private key corresponding to the second data encryption service module, calculates a third key based on the first and second keys, and sends the third key to the third data encryption service module; the third data encryption service module calculates a fourth key based on the preset base, a preset prime number, and the private key corresponding to the third data encryption service module, calculates a fifth key based on the third and fourth keys, and sends the fifth key to the data decryption service module; the data decryption service module calculates a sixth key based on the preset base, a preset prime number, and the private key corresponding to the data decryption service module, and calculates a target key based on the fifth and sixth keys.

[0108] The processor can access the information and application programs stored in the memory via the transmission device to perform the following steps: encrypting the target financial data using the target key through each data encryption service module to obtain the encrypted financial data corresponding to each data encryption service module, and sending the encrypted financial data corresponding to each data encryption service module to the data decryption service module; generating the target encrypted financial data through the data decryption service module based on the encrypted financial data corresponding to each data encryption service module.

[0109] The processor can invoke information and applications stored in memory via a transmission device to perform the following steps: before determining the target key through multiple data encryption service modules and data decryption service modules in a trusted execution environment, remote authentication challenges are initiated between the remote authentication submodules of each data encryption service module and the remote authentication submodule of the data decryption service module; the target signature value is determined by each remote authentication submodule other than the one initiating the challenge, and the target signature value is sent to the remote authentication submodule that initiated the challenge; the remote authentication submodule that initiated the challenge performs a security verification of the target signature value based on the certificate.

[0110] The processor can access the information and application stored in the memory via the transmission device to perform the following steps: calculate the hash value of the service module to which each remote authentication submodule belongs, except for the remote authentication submodule that initiates the challenge, and sign the hash value using the chip key of the trusted execution environment to obtain the target signature value.

[0111] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: after decrypting the target encrypted financial data using the target key through the data decryption service module to obtain the target financial data, the processor uses a preset large model to process the target financial data and outputs the processed result data to a preset storage location or application interface.

[0112] Those skilled in the art will understand that Figure 5 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 5 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 The different configurations shown.

[0113] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0114] Example 4

[0115] Embodiments of this application also provide a computer-readable storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the data processing method provided in Embodiment 1.

[0116] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0117] This application also provides a computer program product, which, when executed on a data processing device, is a program adapted to perform data processing method steps.

[0118] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0119] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0120] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0121] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0122] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0123] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0124] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A data processing method, characterized in that, include: The target key is determined by multiple data encryption and decryption service modules within a trusted execution environment; The target encrypted financial data is determined by the multiple data encryption service modules and the data decryption service module based on the target key and the target financial data. The target encrypted financial data is decrypted using the target key by the data decryption service module to obtain the target financial data.

2. The method according to claim 1, characterized in that, The target key is determined through multiple data encryption and decryption service modules within the trusted execution environment, including: The preset base and preset prime number are obtained through each data encryption service module and the data decryption service module; The private key corresponding to each data encryption service module is obtained through each data encryption service module, and the private key corresponding to the data decryption service module is obtained through the data decryption service module. The target key is determined by each data encryption service module and the data decryption service module based on the preset base, the preset prime number, the private key corresponding to each data encryption service module, and the private key corresponding to the data decryption service module.

3. The method according to claim 2, characterized in that, When the plurality of data encryption service modules include a first data encryption service module, a second data encryption service module, and a third data encryption service module, determining the target key by each data encryption service module and the data decryption service module based on the preset base, the preset prime number, the private key corresponding to each data encryption service module, and the private key corresponding to the data decryption service module includes: The first data encryption service module calculates the first key based on the preset base, the preset prime number and the private key corresponding to the first data encryption service module, and sends the first key to the second data encryption service module. The second data encryption service module calculates a second key based on the preset base, the preset prime number, and the private key corresponding to the second data encryption service module. It then calculates a third key based on the first key and the second key and sends the third key to the third data encryption service module. The third data encryption service module calculates a fourth key based on the preset base, the preset prime number, and the private key corresponding to the third data encryption service module. It then calculates a fifth key based on the third key and the fourth key, and sends the fifth key to the data decryption service module. The data decryption service module calculates the sixth key based on the preset base, the preset prime number, and the private key corresponding to the data decryption service module, and calculates the target key based on the fifth key and the sixth key.

4. The method according to claim 1, characterized in that, The target encrypted financial data is determined by the multiple data encryption service modules and the data decryption service module based on the target key and the target financial data, including: Each data encryption service module encrypts the target financial data using the target key to obtain encrypted financial data corresponding to each data encryption service module, and sends the encrypted financial data corresponding to each data encryption service module to the data decryption service module. The target encrypted financial data is generated by the data decryption service module based on the encrypted financial data corresponding to each data encryption service module.

5. The method according to claim 1, characterized in that, Before determining the target key through multiple data encryption and decryption service modules in a trusted execution environment, the method further includes: Remote authentication challenges are initiated between the remote authentication submodule of each data encryption service module and the remote authentication submodule of the data decryption service module. The target signature value is determined by each remote authentication submodule except the one that initiated the challenge, and the target signature value is sent to the remote authentication submodule that initiated the challenge. The remote authentication submodule that initiates the challenge performs a security verification of the target signature value based on the certificate.

6. The method according to claim 5, characterized in that, The target signature value is determined by each remote authentication submodule other than the one that initiated the challenge, including: The target signature value is obtained by calculating the hash value of the service module to which each remote authentication submodule belongs, except for the remote authentication submodule that initiates the challenge, and signing the hash value using the chip key of the trusted execution environment to which it belongs.

7. The method according to claim 1, characterized in that, After decrypting the target encrypted financial data using the target key through the data decryption service module to obtain the target financial data, the method further includes: The target financial data is processed using a pre-defined large model, and the processed results are output to a pre-defined storage location or application programming interface.

8. A data processing apparatus, characterized in that, include: The first determining unit is used to determine the target key through multiple data encryption service modules and data decryption service modules in the trusted execution environment; The second determining unit is used to determine the target encrypted financial data based on the target key and the target financial data through the plurality of data encryption service modules and the data decryption service module. The first processing unit is used to decrypt the target encrypted financial data using the target key through the data decryption service module to obtain the target financial data.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the computer-readable storage medium is located to perform the data processing method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, performs the data processing method according to any one of claims 1 to 7.

Images