Data access method and device, electronic equipment, storage medium and program product
By combining user authentication and dynamic shift encryption, the problems of easy data leakage and client lag caused by large computational load in 3DTiles model are solved, achieving high-security and high-efficiency data access.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- PCI TECH GRP CO LTD
- Filing Date
- 2025-12-02
- Publication Date
- 2026-05-08
AI Technical Summary
In existing technologies, 3DTiles model data is easily leaked on the client side, resulting in low security, and the large amount of encryption computation causes client lag.
Login tokens are generated using user authentication, and the model data is shift-encrypted using dynamic shift parameters. A dynamic shift key is generated for double protection, and the model data is pre-stored in binary format.
It improves data security, reduces client performance requirements, avoids data leaks caused by dynamic shift parameter leakage, and improves computational efficiency.
Smart Images
Figure CN121997351A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data management technology, and more specifically to data access methods, devices, electronic devices, storage media, and program products. Background Technology
[0002] 3DTiles is an open standard format for large-scale 3D geospatial data, designed to solve the problems of efficient transmission, loading, and real-time rendering of 3D models (such as urban buildings, terrain, BIM models, etc.) in a network environment.
[0003] Because 3DTiles model data is massive, the encryption computation for each model file is enormous, easily causing client lag. Therefore, most 3DTiles model data encryption schemes in related technologies use user authentication to verify client access rights. While this method can limit the number of clients, the 3DTiles model data itself remains unencrypted. Once a user account is leaked, the 3DTiles model data is still at risk of being leaked, resulting in low security. Summary of the Invention
[0004] This invention provides a data access method, apparatus, electronic device, storage medium, and program product to solve the problems of easy leakage and low security of model data in related technologies.
[0005] In a first aspect, the present invention provides a data access method applied to a server, the method comprising: Receive login requests from clients; Perform user authentication based on the login request and issue a login token to the client; Receive a model data access request from a client; the model data access request is generated based on the login token; the model data is pre-stored in binary format; Generate dynamic shift parameters based on the model data access request; The model data is subjected to a shift encryption operation based on the dynamic shift parameters to obtain encrypted model data; An encryption operation is performed on the dynamic shift parameters to obtain the dynamic shift key; The dynamic shift key and the encrypted model data are sent to the client, so that the client can perform an inverse shift decryption operation on the encrypted model data based on the dynamic shift key to obtain the decrypted model data.
[0006] In one optional implementation, the model data access request further includes a model identifier and a request timestamp; The step of generating dynamic shift parameters based on the model data access request includes: Generate a context seed based on the login token, the model identifier, and the request timestamp; Based on the context seed and preset parsing rules, the shift direction, shift number, and shift unit are generated.
[0007] In one optional implementation, the step of performing a shift encryption operation on the model data according to the dynamic shift parameters to obtain encrypted model data includes: The model data is split into multiple model data blocks according to the dynamic block size parameter, and a block number is assigned to each model data block; the dynamic block size parameter is generated based on the context seed; Based on the block number, model identifier, and context seed, generate a block identifier corresponding to each model data block; Divide each model data block according to the shift unit, and perform a shift operation on the data within each shift unit according to the shift direction and the number of shifts to obtain the model data block after each shift operation; Perform an XOR operation on each shifted model data block and its corresponding block identifier to obtain the shifted and encrypted model data block. Each shifted and encrypted model data block is used as the model encrypted data.
[0008] In one optional implementation, the step of performing an encryption operation on the dynamic shift parameters to obtain a dynamic shift key includes: The shift direction, shift number, and shift unit are concatenated and converted into a string in a preset base. Generate an encryption key based on the login token; An XOR encryption operation is performed on the encryption key and the string to obtain a dynamic shift key.
[0009] Secondly, the present invention provides a data access method applied to a client, the method comprising: Send a login request to the server; Receive the login token issued by the server after performing user authentication based on the login request; A model data access request is sent to the server; the model data access request is generated based on the login token; the model data is pre-stored in binary format; The system receives a dynamic shift key and encrypted model data from the server based on the model data access request. The encrypted model data is obtained by the server performing a shift encryption operation on the model data according to the dynamic shift parameters. The dynamic shift key is the encrypted dynamic shift parameters. The encrypted model data is decrypted by performing an inverse shift decryption operation based on the dynamic shift key to obtain the decrypted model data.
[0010] Thirdly, the present invention provides a data access device applied to a server, the device comprising: The first request receiving module is used to receive login requests from clients; The user authentication module is used to perform user authentication operations based on the login request and issue a login token to the client; The second request receiving module is used to receive model data access requests from clients; the model data access requests are generated based on the login token; the model data is pre-stored in binary format; The parameter generation module is used to generate dynamic shift parameters based on the model data access request; The first encryption module is used to perform a shift encryption operation on the model data according to the dynamic shift parameters to obtain encrypted model data. The second encryption module is used to perform an encryption operation on the dynamic shift parameters to obtain the dynamic shift key; The data sending module is used to send the dynamic shift key and the encrypted model data to the client, so that the client can perform an inverse shift decryption operation on the encrypted model data according to the dynamic shift key to obtain the decrypted model data.
[0011] Fourthly, the present invention provides a data access device for use on a client, the device comprising: The first request sending module is used to send login requests to the server; The first receiving module is used to receive the login token issued by the server after performing user authentication operation according to the login request; The second request sending module is used to send a model data access request to the server; the model data access request is generated based on the login token; the model data is pre-stored in binary format; The second receiving module is used to receive the dynamic shift key and model encrypted data sent by the server based on the model data access request; the model encrypted data is obtained by the server performing a shift encryption operation on the model data according to the dynamic shift parameters; the dynamic shift key is the encrypted dynamic shift parameters; The decryption module is used to perform an inverse shift decryption operation on the encrypted model data according to the dynamic shift key to obtain the decrypted model data.
[0012] Fifthly, the present invention provides an electronic device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the data access method described in the first aspect or any corresponding embodiment thereof.
[0013] In a sixth aspect, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to perform the data access method described in the first / second aspect or any corresponding embodiment thereof.
[0014] In a seventh aspect, the present invention provides a computer program product, including computer instructions for causing a computer to execute the data access method described in the first / second aspect or any corresponding embodiment thereof.
[0015] The technical solution provided by this invention may include the following beneficial effects: The data access method provided by this invention ensures the client's access qualification through user authentication by issuing a login token to the client, and protects the model data itself by performing a shift encryption operation on the model data. Combining user authentication and shift encryption operations on the model data provides dual protection for the model data, improving data security. This application also pre-stores the model data in binary format, improving computational efficiency and reducing performance requirements on the client. When performing shift encryption operations on the model data, this application also generates dynamic shift parameters based on the client's model data access request. This model data access request is generated based on the login token, thereby dynamically generating corresponding dynamic shift parameters for each model data access request from each client. This prevents the leakage of a single dynamic shift parameter from affecting the model data corresponding to other model data access requests, further improving data security. Attached Figure Description
[0016] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0017] Figure 1 This is a schematic diagram of an application scenario according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a first type of data access method according to an embodiment of the present invention; Figure 3 This is a schematic diagram of a second type of data access method according to an embodiment of the present invention; Figure 4 This is a schematic diagram of a third data access method according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the process of storing model data according to an embodiment of the present invention; Figure 6 This is a first structural block diagram of a data access device according to an embodiment of the present invention; Figure 7 This is a second structural block diagram of a data access device according to an embodiment of the present invention; Figure 8 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation
[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0019] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.
[0020] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.
[0021] As an optional application scenario of this invention, such as Figure 1 As shown, application 101 is installed in terminal device 110, and user 130 can interact with application 101 through terminal device 110 and / or access device of terminal device 110. Application 101 can be an APP or a web application.
[0022] For example, application 101 could be an application used to provide model data access services. Figure 1 In the application scenario shown, if application 101 is active, the terminal device 110 can display the interface 102 of application 101. The interface 102 may include various pages that application 101 can provide, such as interactive pages, settings pages, query pages, etc.
[0023] In some embodiments, terminal device 110 is communicatively connected to server 120 to provide services to application 101. Terminal device 110 may be a mobile terminal, fixed terminal, or portable terminal, etc., including but not limited to mobile phones, desktop computers, laptop computers, multimedia tablets, or any combination thereof, including accessories and peripherals of these devices, or any combination thereof. In some embodiments, terminal device 110 may also support any type of interface, and server 120 may be various types of computing systems or servers capable of providing computing power, including but not limited to mainframes, edge computing nodes, computing devices in cloud environments, etc.
[0024] It should be noted that, Figure 1 This is merely an example of an application scenario and does not limit the scope of protection of this invention.
[0025] The embodiments of the present invention will now be described with reference to the accompanying drawings. It should be understood that the pages shown in the drawings are merely examples, and various page designs are possible in practice. The graphic elements on the page may have different arrangements and different visual representations; one or more elements may be omitted or replaced; and one or more other elements may also be present. No limitations are imposed in the embodiments of the present invention.
[0026] 3DTiles is an open standard format for large-scale 3D geospatial data, designed to solve the problems of efficient transmission, loading, and real-time rendering of 3D models (such as urban buildings, terrain, BIM models, etc.) in a network environment. It has now become one of the mainstream data formats in the field of 3D geographic information (GIS) and digital twin scenarios.
[0027] Due to the massive size of 3DTiles model data, the encryption computation for each model file is enormous. Furthermore, client performance is limited; performing decryption operations on every model file can easily block the UI thread, causing client lag. Therefore, most 3DTiles model data encryption schemes in related technologies use user authentication to verify client access rights. This requires the requesting client to log in first, and then adds a login token to the request URL (Uniform Resource Locator) or the HTTP headers. While this method limits the number of clients, the 3DTiles model data itself remains unencrypted. If a user account is leaked, the 3DTiles model data is still at risk of being leaked, resulting in low security.
[0028] According to an embodiment of the present invention, a data access method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here. This embodiment provides a data access method applied to a server (such as the aforementioned server 120). Figure 2 This is a flowchart of a data access method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps: Step S201: Receive the client's login request.
[0029] The server's database stores multiple model files, which are pre-converted into binary format to reduce data volume and lower performance requirements on the client. The server communicates with the client; when a user needs to access model data, they send a login request to the server through the relevant application on the client side, and the server receives the login request.
[0030] Step S202: Perform user authentication based on the login request and issue a login token to the client.
[0031] The login request contains relevant client information, allowing the server to perform user authentication to verify the client's eligibility. Upon successful authentication, the server issues a login token to the client for subsequent access to model data. If authentication fails, the server notifies the client of the login failure, prompting the user to re-login through the client, repeating this process until successful authentication.
[0032] Step S203: Receive the client's model data access request.
[0033] After successful user authentication on the client side, the user sends a model data access request to the server through the client. This request is generated based on the login token, thus proving the client's access privileges. The server then receives the model data access request from the client.
[0034] Step S204: Generate dynamic shift parameters based on the model data access request.
[0035] This dynamic shift parameter is used for subsequent shift encryption operations. The server generates the corresponding dynamic shift parameter based on each received model data access request. In other words, a corresponding dynamic shift parameter is generated for each model data access, thereby preventing the cracking of the model encryption data corresponding to other model data access requests through a single dynamic shift parameter and improving data security.
[0036] Step S205: Perform a shift encryption operation on the model data according to the dynamic shift parameter to obtain encrypted model data.
[0037] A shift cipher is a type of substitution cipher that generates ciphertext by shifting or offsetting each letter in the plaintext by a fixed number of positions. In this embodiment, after generating the corresponding dynamic shift parameters based on the model data access request, a preset shift encryption algorithm is used to shift and encrypt the model data corresponding to the model data access request according to the dynamic shift parameters, thereby obtaining encrypted model data.
[0038] Step S206: Perform an encryption operation on the dynamic shift parameter to obtain the dynamic shift key.
[0039] The server needs to provide dynamic shift parameters to the client so that the client can decrypt the encrypted model data based on these parameters. However, directly providing the dynamic shift parameters is easily intercepted, leading to their leakage and consequently, model data leakage. Therefore, before sending the dynamic shift parameters, the server encrypts them using a preset rule to obtain the dynamic shift key, ensuring the security of the dynamic shift parameters.
[0040] Step S207: The dynamic shift key and the encrypted model data are sent to the client so that the client can perform an inverse shift decryption operation on the encrypted model data based on the dynamic shift key to obtain the decrypted model data.
[0041] The server sends the dynamic shift key and the encrypted model data to the client. The client receives the dynamic shift key and the encrypted model data, and uses the inverse shift decryption algorithm corresponding to the server's shift encryption algorithm to perform the inverse shift decryption operation on the encrypted model data according to the dynamic shift key to obtain the decrypted model data. Then, the client can process the model data through the rendering engine to obtain the rendered model data for the user to browse.
[0042] The data access method provided in this embodiment ensures the client's access qualification through user authentication by issuing a login token to the client, and protects the model data itself by performing a shift encryption operation on the model data. Combining user authentication and shift encryption provides dual protection for the model data, improving data security. This application also pre-stores the model data in binary format, improving computational efficiency and reducing performance requirements on the client. When performing shift encryption on the model data, this application also generates dynamic shift parameters based on the client's model data access request. This model data access request is generated based on the login token, thereby dynamically generating corresponding dynamic shift parameters for each model data access request from each client. This prevents the leakage of a single dynamic shift parameter from affecting the model data corresponding to other model data access requests, further improving data security.
[0043] This embodiment provides a data access method applied to a client (such as the aforementioned terminal device 110). Figure 3 This is a flowchart of a data access method according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps: Step S301: Send a login request to the server.
[0044] When a client needs to access model data, it sends a login request to the server through the relevant application in the client.
[0045] Step S302: Receive the login token issued by the server after performing user authentication operation based on the login request.
[0046] The server can perform user authentication based on the login request to verify whether the client is qualified to access the data. If the verification is successful, the server will issue a login token to the client for subsequent access to model data. The client will receive the login token. If the verification fails, the server needs to notify the client of the login failure. After the user is notified of the verification failure through the client, they can try to log in again through the client. This process will be repeated until the verification is successful.
[0047] Step S303: Send a model data access request to the server.
[0048] Upon receiving the login token, the client, in response to the user's request to access model data, sends a model data access request to the server. This request is generated based on the login token, thus proving the client's access eligibility. The model data is pre-stored in binary format in the server's database to reduce data volume and lower performance requirements on the client.
[0049] Step S304: Receive the dynamic shift key and model encryption data sent by the server based on the model data access request.
[0050] The encrypted model data is obtained by the server using a preset shift encryption algorithm, which performs a shift encryption operation on the model data based on dynamic shift parameters generated from the model data access request. The dynamic shift key is the encrypted dynamic shift parameter to prevent leakage of the dynamic shift parameter from leading to model data leakage.
[0051] Step S305: Perform an inverse shift decryption operation on the encrypted model data according to the dynamic shift key to obtain the decrypted model data.
[0052] After receiving the dynamic shift key and the encrypted model data, the client uses the inverse shift decryption algorithm corresponding to the shift encryption algorithm of the server to perform the inverse shift decryption operation on the encrypted model data according to the dynamic shift key, and obtains the decrypted model data. Then, the client can process the model data through the rendering engine to obtain the rendered model data for the user to browse.
[0053] The data access method provided in this embodiment ensures the client's access qualification through user authentication by issuing a login token to the client, and protects the model data itself by performing a shift encryption operation on the model data. Combining user authentication and shift encryption provides dual protection for the model data, improving data security. This application also pre-stores the model data in binary format, improving computational efficiency and reducing performance requirements on the client. When performing shift encryption on the model data, this application also generates dynamic shift parameters based on the client's model data access request. This model data access request is generated based on the login token, thereby dynamically generating corresponding dynamic shift parameters for each model data access request from each client. This prevents the leakage of a single dynamic shift parameter from affecting the model data corresponding to other model data access requests, further improving data security.
[0054] This embodiment provides a data access method that is jointly executed by the server and the client. Figure 4 This is a flowchart of a data access method according to an embodiment of the present invention, such as... Figure 4 As shown, the process includes the following steps: Step S401: The client sends a login request to the server.
[0055] Optionally, the user enters their username and password on the client's web login page, and then sends a login request to the server through the client.
[0056] In step S402, the server receives the client's login request.
[0057] The server's database stores multiple model files, which are pre-converted into binary format before storage to reduce data volume and lower performance requirements on the client. Figure 5 This is a schematic diagram of the process of storing model data according to an embodiment of the present invention, such as... Figure 5 As shown, the server receives the uploaded model file, converts the model file into binary data, and stores it in the database.
[0058] In step S403, the server performs user authentication based on the login request and issues a login token to the client.
[0059] The login request carries the client's account information, so the server can verify the client's access qualification based on the login request. If the verification is successful, the server issues a login token to the client; if the verification fails, the server notifies the client that the login failed, so that the client can resend the login request to the server in response to the user's login operation, until the verification is successful and the client receives the login token.
[0060] Step S404: The client receives the login token issued by the server after performing user authentication based on the login request.
[0061] Please see details Figure 3 Step S302 of the illustrated embodiment will not be described again here.
[0062] Step S405: The client sends a model data access request to the server.
[0063] The model data access request is generated based on the login token; the model data is pre-stored in binary format.
[0064] Please see details Figure 3 Step S303 of the illustrated embodiment will not be described again here.
[0065] Step S406: The server receives the model data access request from the client.
[0066] The model data access request is generated based on the login token; the model data is pre-stored in binary format.
[0067] Please see details Figure 2 Step S203 of the illustrated embodiment will not be described again here.
[0068] Step S407: The server generates dynamic shift parameters based on the model data access request.
[0069] Optionally, the model data access request also includes a model identifier and a request timestamp. The model identifier is used to indicate the uniquely corresponding model data, such as a model ID encoding. The request timestamp indicates the generation time of the model data access request, accurate to the second. When generating dynamic shift parameters based on the model data access request, a context seed is first generated based on the login token, the model identifier, and the request timestamp. This context seed is used to generate the dynamic shift parameters. Then, the dynamic shift parameters are generated based on the context seed and preset parsing rules. The dynamic shift parameters include a shift direction, a shift number of bits, and a shift unit. The shift direction indicates the direction in which the data to be shifted is moved during shift encryption, such as moving to the right; the shift number of bits indicates how many bits the data to be shifted needs to be moved; and the shift unit indicates the smallest unit of shifting the data to be shifted, such as shifting in units of one byte.
[0070] Optionally, first calculate the hash value of the login token, then concatenate the hash value of the login token, the model identifier, and the request timestamp to obtain concatenated data, and then process the concatenated data using the HMAC-MD5 algorithm to generate a 16-byte context seed S.
[0071] For example, the context seed S=0x1A3F5B7D9C2E4F6A8B0D2C4E6F8A0B1C.
[0072] Next, the context seed S is cut according to preset rules, and then the cut context seed S is processed according to preset parsing rules to parse out three dynamic shift parameters, namely shift direction D, shift number N, and shift unit U. Each dynamic shift parameter is set with a valid range to avoid invalid calculations, such as avoiding shift number of 0.
[0073] Optionally, the shift direction can include left and right shifts to break the fixed-direction cracking pattern and improve shift flexibility; the shift unit can include half-words (16 bits) and bytes (8 bits) to change the granularity of data operations and increase cracking complexity; the shift bit range can be 1 to 15 bits, ensuring that the shift bit is randomized each time and bound to the context. By setting the shift direction, shift unit, and shift bit, the randomness of the dynamic shift parameters can be increased, thereby improving the randomness and complexity of the shift encryption operation, increasing the difficulty of cracking the model's encrypted data, and improving the security of the model's encrypted data.
[0074] For example, the 16-byte context seed is divided into three parts: the first byte is used to resolve the shift direction D, the second and third bytes are used to resolve the shift amount N, and the fourth byte is used to resolve the shift unit U. The default resolution rule for the shift direction D is to take the highest bit (bit 7) of the first byte of the context seed; if this bit is 0, it indicates a left shift, and if it is 1, it indicates a right shift. The default resolution rule for the shift amount N is to take the second and third bytes of the context seed, convert them to decimal, and then take the modulo (+1) of 15, i.e., N = (S²³%15) + 1. The default resolution rule for the shift unit U is to take the lowest two bits (bits 1 to 0) of the fourth byte of the context seed; if the lowest two bits are 00, the shift unit is a byte; if the lowest two bits are 01, the shift unit is a half-word.
[0075] For example, if the first byte of the context seed S is 0x1A (binary 00011010), then the shift direction D=0 (shift to the left); if the second and third bytes are 0x3F5B (decimal 16219), then the shift number N=(16219%15)+1=10 (shift 10 bits to the left); if the fourth byte is 0x7D (binary 01111101), and the lowest two bits are 01, then the shift unit U is half a word.
[0076] In step S408, the server performs a shift encryption operation on the model data according to the dynamic shift parameter to obtain encrypted model data.
[0077] Specifically, the model data is first divided into multiple model data blocks according to the dynamic block size parameter, and a block number is assigned to each model data block. The dynamic block size parameter is generated based on the context seed. For example, the total size of the model data is M, and the dynamic block size B = 1MB + (the 5th byte of the context seed S % 1024), that is, the range of the dynamic block size is 1024KB~1034KB, to avoid fixed block size leading to recognition. If the size of the last model data block obtained by splitting is less than B, it is padded with zeros until the size is B.
[0078] Next, a block identifier corresponding to each model data block is generated based on the block number, model identifier, and context seed. For example, if the block number is 0 to k-1, then the block identifier ID_block = block number (0~K-1) + model identifier + the 6th to 8th bytes of the context seed S, to ensure that the block identifier of each model data block is unique.
[0079] Then, each model data block is divided according to the shift unit. The data within each shift unit is shifted according to the shift direction and the number of shifts, resulting in a model data block after each shift operation. For example, if the shift unit U=0, for each byte in the model data block, the shift direction D is shifted by the number of shifts N corresponding to the shift number. The rules for handling the high / low bits exceeding the shift number are as follows: when shifting to the left, the high bits exceeding the byte are discarded, and the low bits are filled with 0; when shifting to the right, the low bits exceeding the byte are discarded, and the high bits are filled with 0, thus achieving unsigned shifting and avoiding interference from the sign bit in subsequent model data parsing. If the shift unit U=1, for every 2 bytes (half-word) in the model data block, the shift direction D is shifted by the number of shifts N corresponding to the shift number. The portion exceeding these 2 bytes is discarded, and the empty bits are filled with 0.
[0080] Furthermore, an XOR operation is performed on each shifted model data block and its corresponding block identifier to obtain the shifted and encrypted model data block. For example, the hash value hash(ID_block) of the block identifier corresponding to each shifted model data block data_block is calculated, and the first 8 bytes of the hash value hash(ID_block)[0:8] are taken. Then, an XOR operation is performed on each shifted model data block and its corresponding block identifier hash value, data_encrypted_block = data_block XOR hash(ID_block)[0:8]. This achieves XOR verification at the model data block level, so that attackers not only need to crack the shift rules of a certain model data block, but also need to crack the XOR key that depends on the block identifier at the same time. Moreover, the cracking result of a single block cannot be reused for other blocks, thus achieving anti-tampering and anti-reverse engineering functions, and obtaining each shifted and encrypted model data block.
[0081] Finally, each shifted and encrypted model data block is used as the model encrypted data.
[0082] In step S409, the server performs an encryption operation on the dynamic shift parameter to obtain the dynamic shift key.
[0083] The client needs to obtain the dynamic shift parameters to perform the reverse shift decryption operation. However, directly transmitting the dynamic shift parameters is easily intercepted. Therefore, encrypted transmission logic for the dynamic shift parameters is set up. Specifically, the server first concatenates the shift direction, shift number, and shift unit, and converts them into a string in a preset base. Then, it generates an encryption key based on the login token. Finally, it performs an XOR encryption operation on the encryption key and the string to obtain the dynamic shift key.
[0084] For example, after the server generates dynamic shift parameters (shift direction D, shift number N, and shift unit U), it converts the dynamic shift parameters into a hexadecimal string. For example, if the shift direction D=0, the shift number N=10, and the shift unit U=1, the string is 0A1. Then, the first 16 bytes of the login token are used as the encryption key, and an XOR encryption operation is performed on the encryption key and the string to obtain the dynamic shift key. This encryption method is lightweight and efficient, so that the client can decrypt quickly.
[0085] In step S410, the server sends the dynamic shift key and the encrypted data of the model to the client.
[0086] Optionally, the server also sends a shift code to the client as an auxiliary verification for parameter decryption; this shift code is the first 8 bits of the hash value of the dynamic shift key.
[0087] Step S411: The client receives the dynamic shift key and model encryption data issued by the server based on the model data access request.
[0088] Optionally, the client receives the dynamic shift key, model encryption data, and shift code sent by the server.
[0089] In step S412, the client performs an inverse shift decryption operation on the encrypted model data based on the dynamic shift key to obtain the decrypted model data.
[0090] The client must strictly follow the server's shift logic to execute the reverse operation symmetrical to the server's shift logic, ensuring accurate data recovery.
[0091] Optionally, the client first verifies the validity of the parameters using the shift code, then decrypts the dynamic shift key using the first 16 bytes of the login token to obtain the dynamic shift parameters, ensuring that the dynamic shift parameters have not been tampered with or intercepted. Then, it performs an XOR inverse operation on each shifted and encrypted model data block, i.e., data_block = data_encrypted_blockXOR hash(ID_block)[0:8], where ID_block is generated by the client according to the same rules. Next, it performs a reverse shift by shift unit U. If the server shifts the shift number N to the left, the client shifts the shift number N to the right, and vice versa, with the padding rules consistent with the server. Finally, all decrypted model data blocks are merged, and the padding zeros of the last model data block are removed to obtain the original model data, which is then parsed by the rendering engine. For example, rendering engines such as Cesium or Three.js can be used.
[0092] The data access method provided in this embodiment breaks the fixed-direction cracking pattern and improves shift flexibility by setting the shift direction; it changes the granularity of data operations and increases cracking complexity by setting the shift unit; and it achieves random shift numbers for each operation, which are bound to the context. Furthermore, by setting the shift direction, shift unit, and shift number, the randomness of the dynamic shift parameters can be increased, thereby improving the randomness and complexity of the shift encryption operation, increasing the difficulty of cracking the model's encrypted data, and enhancing the security of the model's encrypted data.
[0093] This embodiment also provides a data access device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.
[0094] This embodiment provides a data access device applied to a server, such as... Figure 6 As shown, it includes: The first request receiving module 601 is used to receive login requests from clients; User authentication module 602 is used to perform user authentication operations based on the login request and issue a login token to the client; The second request receiving module 603 is used to receive the model data access request from the client; the model data access request is generated based on the login token; the model data is pre-stored in binary format; The parameter generation module 604 is used to generate dynamic shift parameters based on the model data access request. The first encryption module 605 is used to perform a shift encryption operation on the model data according to the dynamic shift parameter to obtain encrypted model data. The second encryption module 606 is used to perform an encryption operation on the dynamic shift parameter to obtain the dynamic shift key; The data sending module 607 is used to send the dynamic shift key and the encrypted model data to the client, so that the client can perform an inverse shift decryption operation on the encrypted model data according to the dynamic shift key to obtain the decrypted model data.
[0095] In some optional implementations, the model data access request also includes a model identifier and a request timestamp; the parameter generation module is also used for: Generate a context seed based on the login token, the model identifier, and the request timestamp; Based on the context seed and the preset parsing rules, the shift direction, shift number, and shift unit are generated.
[0096] In an optional implementation, the first encryption module is further configured to: The model data is split into multiple model data blocks according to the dynamic block size parameter, and a block number is assigned to each model data block; the dynamic block size parameter is generated based on the context seed; Based on the block number, model identifier, and context seed, generate a block identifier corresponding to each model data block; Divide the model data into blocks according to the shift unit, and perform a shift operation on the data in each shift unit according to the shift direction and the number of shifts to obtain the model data block after each shift operation; Perform an XOR operation on each shifted model data block and its corresponding block identifier to obtain the shifted and encrypted model data block. Each shifted and encrypted model data block is used as the model encrypted data.
[0097] In one alternative implementation, the second encryption module is further configured to: Concatenate the shift direction, shift number, and shift unit, and convert them into a string in a preset base; Generate an encryption key based on the login token; Perform an XOR encryption operation on the encryption key and the string to obtain the dynamic shift key. This embodiment provides a data access device applied to a client, such as... Figure 7 As shown, it includes: The first request sending module 701 is used to send a login request to the server; The first receiving module 702 is used to receive the login token issued by the server after performing user authentication operation according to the login request; The second request sending module 703 is used to send a model data access request to the server; the model data access request is generated based on the login token; the model data is pre-stored in binary format. The second receiving module 704 is used to receive the dynamic shift key and model encrypted data sent by the server based on the model data access request; the model encrypted data is obtained by the server performing a shift encryption operation on the model data according to the dynamic shift parameters; the dynamic shift key is the encrypted dynamic shift parameters; The decryption module 705 is used to perform an inverse shift decryption operation on the encrypted model data according to the dynamic shift key to obtain the decrypted model data.
[0098] The data access device provided in this embodiment of the invention can execute the data access method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects for executing the method. Further functional descriptions of the various modules and units described above are the same as in the corresponding embodiments described above, and will not be repeated here.
[0099] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.
[0100] The following is a detailed reference. Figure 8 The diagram illustrates a structural schematic suitable for implementing an electronic device according to embodiments of the present invention. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 801, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 802 or a program loaded from memory 808 into random access memory (RAM) 803. The RAM 803 also stores various programs and data required for the operation of the electronic device. The processor 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.
[0101] Typically, the following devices can be connected to I / O interface 805: input devices 806 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 807 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory devices 808 including, for example, magnetic tapes, hard disks, etc.; and communication devices 809. Communication device 809 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 8 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.
[0102] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 809, or installed from a memory 808, or installed from a ROM 802. When the computer program is executed by the processor 801, it performs the functions defined in the data access method of the embodiments of the present invention.
[0103] Figure 8The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present invention.
[0104] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the data access methods shown in the above embodiments are implemented.
[0105] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.
[0106] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the invention.
Claims
1. A data access method, characterized in that, Applied to the server side, the method includes: Receive login requests from clients; Perform user authentication based on the login request and issue a login token to the client; Receive a model data access request from a client; the model data access request is generated based on the login token; the model data is pre-stored in binary format; Generate dynamic shift parameters based on the model data access request; The model data is subjected to a shift encryption operation based on the dynamic shift parameters to obtain encrypted model data; An encryption operation is performed on the dynamic shift parameters to obtain the dynamic shift key; The dynamic shift key and the encrypted model data are sent to the client, so that the client can perform an inverse shift decryption operation on the encrypted model data based on the dynamic shift key to obtain the decrypted model data.
2. The method according to claim 1, characterized in that, The model data access request also includes the model identifier and the request timestamp; The step of generating dynamic shift parameters based on the model data access request includes: Generate a context seed based on the login token, the model identifier, and the request timestamp; Based on the context seed and preset parsing rules, the shift direction, shift number, and shift unit are generated.
3. The method according to claim 2, characterized in that, The step of performing a shift encryption operation on the model data according to the dynamic shift parameters to obtain encrypted model data includes: The model data is split into multiple model data blocks according to the dynamic block size parameter, and a block number is assigned to each model data block; the dynamic block size parameter is generated based on the context seed; Based on the block number, model identifier, and context seed, generate a block identifier corresponding to each model data block; Divide each model data block according to the shift unit, and perform a shift operation on the data in each shift unit according to the shift direction and the number of shifts to obtain the model data block after each shift operation; Perform an XOR operation on each shifted model data block and its corresponding block identifier to obtain the shifted and encrypted model data block. Each shifted and encrypted model data block is used as the model encrypted data.
4. The method according to claim 2, characterized in that, The step of performing an encryption operation on the dynamic shift parameters to obtain the dynamic shift key includes: The shift direction, shift number, and shift unit are concatenated and converted into a string in a preset base. Generate an encryption key based on the login token; An XOR encryption operation is performed on the encryption key and the string to obtain a dynamic shift key.
5. A data access method, characterized in that, Applied to a client, the method includes: Send a login request to the server; Receive the login token issued by the server after performing user authentication based on the login request; A model data access request is sent to the server; the model data access request is generated based on the login token; the model data is pre-stored in binary format; The system receives a dynamic shift key and encrypted model data from the server based on the model data access request. The encrypted model data is obtained by the server performing a shift encryption operation on the model data according to the dynamic shift parameters. The dynamic shift key is the encrypted dynamic shift parameters. The encrypted model data is decrypted by performing an inverse shift decryption operation based on the dynamic shift key to obtain the decrypted model data.
6. A data access device, characterized in that, Applied to the server side, the device includes: The first request receiving module is used to receive login requests from clients; The user authentication module is used to perform user authentication operations based on the login request and issue a login token to the client; The second request receiving module is used to receive model data access requests from clients; the model data access requests are generated based on the login token; the model data is pre-stored in binary format; The parameter generation module is used to generate dynamic shift parameters based on the model data access request; The first encryption module is used to perform a shift encryption operation on the model data according to the dynamic shift parameters to obtain encrypted model data. The second encryption module is used to perform encryption operations on the dynamic shift parameters to obtain the dynamic shift key; The data sending module is used to send the dynamic shift key and the encrypted model data to the client, so that the client can perform an inverse shift decryption operation on the encrypted model data according to the dynamic shift key to obtain the decrypted model data.
7. A data access device, characterized in that, Applied to a client, the device includes: The first request sending module is used to send login requests to the server; The first receiving module is used to receive the login token issued by the server after performing user authentication operation according to the login request; The second request sending module is used to send a model data access request to the server; the model data access request is generated based on the login token; the model data is pre-stored in binary format; The second receiving module is used to receive the dynamic shift key and model encrypted data sent by the server based on the model data access request; the model encrypted data is obtained by the server performing a shift encryption operation on the model data according to the dynamic shift parameters; the dynamic shift key is the encrypted dynamic shift parameters; The decryption module is used to perform an inverse shift decryption operation on the encrypted model data according to the dynamic shift key to obtain the decrypted model data.
8. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the data access method of any one of claims 1 to 5.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to perform the data access method according to any one of claims 1 to 5.
10. A computer program product, characterized in that, Includes computer instructions for causing a computer to perform the data access method according to any one of claims 1 to 5.