CN115529194A - Data management method, system, equipment and storage medium - Google Patents
Data management method, system, equipment and storage medium Download PDFInfo
- Publication number
- CN115529194A CN115529194A CN202211496502.9A CN202211496502A CN115529194A CN 115529194 A CN115529194 A CN 115529194A CN 202211496502 A CN202211496502 A CN 202211496502A CN 115529194 A CN115529194 A CN 115529194A
- Authority
- CN
- China
- Prior art keywords
- data
- user
- secret key
- information
- data sharing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
- H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Storage Device Security (AREA)
Abstract
The application discloses a data management method, a system, a device and a storage medium, in particular to a data management method, which comprises the following steps: judging whether a first user has data sharing permission or not according to a data sharing request of the first user, if so, then: generating data sharing information according to the data sharing request; sending the data sharing information to a second user; acquiring ciphertext data according to the data sharing information; acquiring a first secret key, and decrypting the ciphertext data by using the first secret key to obtain first decrypted data; judging whether the second user has the data acquisition permission, if so, then: acquiring a second secret key, and decrypting the first decrypted data by using the second secret key to obtain second decrypted data; sending the second decrypted data to the second user; according to the scheme, the data can be safely shared on the premise of ensuring the safety of the cloud storage data.
Description
Technical Field
The present application relates to the field of data management technologies, and in particular, to a data management method, system, device, and storage medium.
Background
With the gradual increase of intelligent devices, more and more data are generated every day, and in order to solve the difficult problems of mass data storage and distribution, a cloud storage technology becomes the current mainstream scheme. However, the cloud storage technology has a severe data security problem at present, and the cloud data faces various internal security threats, for example, the possibility of infringement exists between a cloud administrator and other users in the cloud, and the data is leaked in the cloud. When data is shared, when traditional encrypted data is distributed and shared, passwords are easy to leak, data is easy to steal, and data sharing is difficult.
Therefore, how to implement secure sharing of data on the premise of ensuring security of cloud storage data is a technical problem to be urgently solved by those skilled in the art.
Disclosure of Invention
In order to solve the technical problem, the application provides a data management method, which can realize the safe sharing of data on the premise of ensuring the safety of cloud storage data. The application also provides a data management system, equipment and a storage medium, which have the same technical effects.
A first object of the present application is to provide a data management method.
The above object of the present application is achieved by the following technical solutions:
a method of data management, comprising:
judging whether a first user has data sharing authority or not according to a data sharing request of the first user, if so, then:
generating data sharing information according to the data sharing request;
sending the data sharing information to a second user;
acquiring ciphertext data according to the data sharing information;
acquiring a first secret key, and decrypting the ciphertext data by using the first secret key to obtain first decrypted data;
judging whether the second user has the data acquisition permission, if so, then:
acquiring a second secret key, and decrypting the first decrypted data by using the second secret key to obtain second decrypted data;
sending the second decrypted data to the second user;
the ciphertext data is obtained by encrypting first encryption data by using the first secret key, and the first encryption data is obtained by encrypting plaintext data by using the second secret key.
Preferably, in the data management method, before determining whether the first user has the data sharing right according to the data sharing request of the first user, the method further includes:
judging whether a third user has data storage authority or not according to a data storage request of the third user, if so, then:
acquiring hardware information, operating system information, system state information and user information of the third user;
obtaining the second secret key according to the hardware information, the operating system information, the system state information and the user information;
encrypting the plaintext data by using the second secret key to obtain first encrypted data;
acquiring the first secret key, and encrypting the first encrypted data by using the first secret key to obtain the ciphertext data;
storing the ciphertext data;
and the plaintext data is data required to be stored by the third user.
Preferably, in the data management method, after the storing the ciphertext data, the method further includes:
judging whether a fourth user has data acquisition permission or not according to a data acquisition request of the fourth user, if so, then:
acquiring the ciphertext data according to the data acquisition request;
acquiring the first secret key, and decrypting the ciphertext data by using the first secret key to obtain first decrypted data;
acquiring the second secret key, and decrypting the first decrypted data by using the second secret key to obtain second decrypted data;
and sending the second decrypted data to the fourth user.
Preferably, in the data management method, after the ciphertext data is acquired according to the data sharing information, the method further includes:
judging whether the first user has data acquisition permission or not according to the sharing revocation request of the first user, if so, then:
and revoking the data sharing information according to the sharing revoke request.
Preferably, in the data management method, after the sending the second decrypted data to the second user, the method further includes:
responding to the second user to open the second decrypted data, judging whether the second decrypted data is closed, if so, then:
determining that the second secret key is invalid.
Preferably, in the data management method, after it is determined that the first user has the data sharing right, the method further includes:
judging whether the first user and the second user are in the same organization, if so, then:
and generating data sharing information according to the data sharing request.
Preferably, the data management method further includes:
responding to the situation that the first user and the second user are not in the same organization, and generating data sharing information and verification information according to the data sharing request;
sending the data sharing information and the verification information to the second user;
and acquiring ciphertext data according to the data sharing information and the verification information.
Preferably, in the data management method, after the generating data sharing information according to the data sharing request, the method further includes:
judging whether the data sharing information is correct, if so,:
and sending the data sharing information to a second user.
Preferably, in the data management method, after the generating data sharing information and verification information according to the data sharing request, the method further includes:
judging whether the data sharing information is correct or not, if so, then:
and sending the data sharing information and the verification information to the second user.
A second object of the present application is to provide a data management system.
The second application object of the present application is achieved by the following technical scheme:
a data management system, comprising:
the data sharing permission judging unit is used for judging whether a first user has data sharing permission or not according to a data sharing request of the first user;
the data sharing information generating unit is used for generating data sharing information according to the data sharing request when the first user has the data sharing right;
the data sharing information forwarding unit is used for sending the data sharing information to a second user;
the ciphertext data acquisition unit is used for acquiring ciphertext data according to the data sharing information;
the first decryption data acquisition unit is used for acquiring a first secret key and decrypting the ciphertext data by using the first secret key to obtain first decryption data;
the data acquisition permission judging unit is used for judging whether the second user has data acquisition permission;
a second decrypted data obtaining unit, configured to obtain a second secret key when the second user has the data obtaining right, and decrypt the first decrypted data using the second secret key to obtain second decrypted data;
a second decrypted data forwarding unit, configured to send the second decrypted data to the second user;
the ciphertext data is obtained by encrypting first encryption data by using the first secret key, and the first encryption data is obtained by encrypting plaintext data by using the second secret key.
A third object of the present application is to provide a data management apparatus.
The third objective of the present application is achieved by the following technical solutions:
a data management apparatus comprising: a storage medium and a processor;
computer execution instructions are stored in the storage medium;
the processor executes computer-executable instructions stored in the storage medium to implement any one of the above data management methods.
A fourth object of the present application is to provide a computer-readable storage medium.
The fourth application purpose of the present application is achieved by the following technical solutions:
a computer readable storage medium having stored thereon computer executable instructions for implementing any of the above data management methods when executed by a processor.
In the technical scheme, the ciphertext data are obtained by encrypting the first encryption data by using the first secret key, the first encryption data are obtained by encrypting the plaintext data by using the second secret key, and the user cannot directly obtain the plaintext data in two encryption processes, so that the safety of cloud storage data is ensured; the method comprises the steps that a first user is an initiating user for data sharing, plaintext data is target data for data sharing, and a second user is a target user for data sharing; according to the technical scheme, the authority security of the first user can be determined by judging whether the first user has the data sharing authority, and when the first user has the data sharing authority, the data sharing information is generated according to the data sharing request, so that the access to data can be limited, unnecessary or untrusted data sharing requests are eliminated, and the security of data sharing is improved; sending the data sharing information to a second user; acquiring ciphertext data according to the data sharing information; acquiring a first secret key, and decrypting the ciphertext data by using the first secret key to obtain first decrypted data; in the data stream transfer process, the plaintext data still exists in an encrypted form, so that the plaintext data does not need to be worried about leakage; the authority security of the second user can be determined by judging whether the second user has the data acquisition authority, and when the second user has the data acquisition authority, a second secret key is acquired, and the first decrypted data is decrypted by using the second secret key to obtain second decrypted data, so that the access to the data can be further limited, unnecessary or untrusted data acquisition requests are eliminated, and the security of data sharing is improved; and finally, the second decrypted data is sent to a second user, and the data sharing is completed. In conclusion, according to the technical scheme, the data can be safely shared on the premise that the safety of the cloud storage data is guaranteed.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the present application, and other drawings can be obtained by those skilled in the art without creative efforts.
Fig. 1 is a schematic flowchart of a data management method provided in an embodiment of the present application;
fig. 2 is a schematic flow chart of data storage provided in an embodiment of the present application;
fig. 3 is a schematic flow chart of data acquisition provided in an embodiment of the present application;
fig. 4 is a schematic flow chart of data sharing revocation provided in an embodiment of the present application;
fig. 5 is a schematic flow chart illustrating a key revocation process according to an embodiment of the present application;
fig. 6 is a schematic structural diagram of a data management system provided in an embodiment of the present application;
fig. 7 is a schematic structural diagram of a data management device provided in an embodiment of the present application.
Detailed Description
In order to make those skilled in the art better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
In the embodiments provided in the present application, it should be understood that the disclosed method and system may be implemented in other ways. The system embodiments described below are merely illustrative, and for example, a division of a unit is only one logical functional division, and an actual implementation may have another division, such as: multiple units or components may be combined, or may be integrated into another system, or some features may be omitted, or not implemented. In addition, the coupling, direct coupling or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between the devices or modules may be electrical, mechanical or in other forms.
Furthermore, the terms "first", "second" and "first" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the present application, "plurality" or "a plurality" means two or more unless specifically limited otherwise.
The embodiments of the present application are written in a progressive manner.
Referring to fig. 1, an embodiment of the present application provides a data management method, including:
s101, judging whether a first user has a data sharing authority or not according to a data sharing request of the first user, and if so, executing S102;
in S101, the first user is an initiating user for data sharing, and the first user may initiate a corresponding data sharing request according to target data to be shared and a target user to be shared; optionally, when the first user does not have the data acquisition right, an error message may be prompted, which does not affect the implementation of the present example; this step may try to ensure the security of the first user's rights. Specifically, the data sharing authority of the first user can be judged through the local security service module where the first user is located; the local security service module runs in a user space, can judge user authority and the like by running a user mode agent process, the user agent process is registered as a white list process capable of accessing computing resources in a Trusted Execution Environment (TEE) through a built-in mechanism of the Trusted Execution Environment, so that interaction with the Trusted service process is realized, and the local security service module can also run in an executable Trusted Environment and can maintain a user key, encrypt and decrypt user data and the like through the local security service Trusted service process.
S102, generating data sharing information according to the data sharing request;
in S102, the data sharing information may be used to indicate target data to be shared and a target user to be shared in the data sharing request, and optionally, the data sharing information may be a URL, and may also be a file link that can be identified in a hanging disc of the target user to be shared, which is a specific form, which is not limited in this embodiment. Specifically, the data sharing information can be generated through a data security gateway where the first user is located, and the data security gateway where the first user is located is connected with a local security service module where the first user is located; the data security gateway can also be used for maintaining an organization key, providing an interface for accessing data to the outside, and the like.
S103, sending the data sharing information to a second user;
in S103, the second user is a target user that needs to be shared in the data sharing request; specifically, after the data security gateway where the first user is located generates the data sharing information, the data sharing information is sent to the local security service module where the first user is located, and then the local security service module where the first user is located forwards the data sharing information to the second user and the local security service module where the second user is located.
S104, acquiring ciphertext data according to the data sharing information;
in S104, the ciphertext data is obtained by encrypting first encrypted data with the first secret key, and the first encrypted data is obtained by encrypting plaintext data with the second secret key; the plaintext data is target data to be shared in the data sharing request, and the plaintext data can include various data such as a deep learning model, model related parameters, data and documents; specifically, the local security service module where the second user is located initiates a data access request to a data security gateway of a data owner according to the data sharing information, and the data security gateway of the data owner obtains the ciphertext data from a storage module according to the data access request, where the storage module may be a data center or cloud storage, and the data owner may be a user who encrypts the plaintext data to obtain ciphertext data and stores the ciphertext data in the storage module.
S105, obtaining a first secret key, and decrypting the ciphertext data by using the first secret key to obtain first decrypted data;
in S105, specifically, the first key may be a data security gateway maintenance organization key; correspondingly, the first secret key can be obtained through the data security gateway where the data owner is located, and then the ciphertext data is decrypted by using the first secret key to obtain first decrypted data.
S106, judging whether the second user has the data acquisition permission, if so, executing S107;
in S106, optionally, when the second user does not have the data acquisition right, an error message may be prompted, which does not affect the implementation of the present example; the step can ensure the authority security of the second user as much as possible; specifically, after obtaining first decrypted data, the data security gateway where the data owner is located sends the first decrypted data to the local security service module where the second user is located, the local security service module where the second user is located initiates a second secret key acquisition request to the local security service module where the data owner is located, and then the local security service module where the data owner is located judges the data acquisition permission of the second user according to the second secret key acquisition request.
S107, acquiring a second secret key, and decrypting the first decrypted data by using the second secret key to obtain second decrypted data;
in S107, specifically, the second key may be a user key maintained by the local security service module, and the second decryption data may represent plaintext data; when the second user has the data acquisition right, the local security service module where the data owner is located sends the second secret key to the local security service module where the second user is located, and then the local security service module where the second user is located decrypts the first decrypted data by using the second secret key to obtain second decrypted data.
And S108, sending the second decrypted data to the second user.
In S108, specifically, the second decrypted data may be sent to the second user through the local security service module where the second user is located, so as to complete the data sharing.
The existing cloud storage technology has a severe data security problem at present, and cloud data face various internal security threats, such as the possibility of infringement of cloud administrators and other cloud users, data leakage at the cloud end and the like. When data is shared, when traditional encrypted data is distributed and shared, passwords are easy to leak, data is easy to steal, and data sharing is difficult.
In the above embodiment, the ciphertext data is obtained by encrypting the first encrypted data by using the first secret key, the first encrypted data is obtained by encrypting the plaintext data by using the second secret key, and the user cannot directly obtain the plaintext data through two encryption processes, so that the security of the cloud storage data is ensured; the method comprises the steps that a first user is an initiating user for data sharing, plaintext data is target data for data sharing, and a second user is a target user for data sharing; according to the embodiment, the authority security of the first user can be determined by judging whether the first user has the data sharing authority, and when the first user has the data sharing authority, the data sharing information is generated according to the data sharing request, so that the access to the data can be limited, unnecessary or untrusted data sharing requests are eliminated, and the security of data sharing is improved; sending the data sharing information to a second user; acquiring ciphertext data according to the data sharing information; acquiring a first secret key, and decrypting the ciphertext data by using the first secret key to obtain first decrypted data; in the data stream transfer process, the plaintext data still exists in an encrypted form, so that the plaintext data does not need to be worried about leakage; the authority security of the second user can be determined by judging whether the second user has the data acquisition authority, and when the second user has the data acquisition authority, a second secret key is acquired, and the first decrypted data is decrypted by using the second secret key to obtain second decrypted data, so that the access to the data can be further limited, unnecessary or untrusted data acquisition requests are eliminated, and the security of data sharing is improved; and finally, the second decrypted data is sent to a second user, and the data sharing is completed. In summary, according to the embodiment, the data can be safely shared on the premise that the safety of the cloud storage data is guaranteed.
Correspondingly, the data sharing step is executed by introducing the local security service module and the data security gateway, so that the data circulation tracking is effectively implemented in the data sharing process, the data sharing safety is improved, data decryption cannot be completed only by depending on a certain secret key in the data sharing process, data access passes through the data security gateway, the safety of stored data can be further guaranteed, and the platform is prevented from leaking data.
Referring to fig. 2, in another embodiment based on the above embodiment, before determining whether the first user has the data sharing right according to the data sharing request of the first user, the method further includes:
s201, judging whether a third user has a data storage authority or not according to a data storage request of the third user, and if so, executing S202;
in S201, the third user, that is, the initiating user of data storage, may initiate a corresponding data storage request according to the target data to be stored; optionally, when the third user does not have the data storage right, an error message may be prompted, which does not affect the implementation of the present example; this step may ensure the security of the third user's rights as much as possible. Specifically, the third user can log in a local security service module where the third user is located for the first time by using ukey; the local security service module where the third user is located can execute the user mode proxy process and utilize an Access Control List (ACL) to judge the data storage authority of the user; wherein the access control list may be implemented using LDAP.
S202, acquiring hardware information, operating system information, system state information and user information of the third user;
in S202, specifically, the hardware information and the operating system information may be collected by a local security service Module of the third user using a Trusted Platform Module (TPM) chip; calculating the state information of the system by using a Hash algorithm, and storing the state information into a Platform Configuration Register (PCR); and the local safety service module where the third user is located is connected with the third user and collects the user information of the third user.
S203, obtaining the second secret key according to the hardware information, the operating system information, the system state information and the user information;
in S203, the second secret key may be a user secret key maintained by a local security service module where a third user is located; specifically, the second key may be obtained by initializing, by using the hardware information, the operating system information, the system state information, and the user information, a local security service module where a third user is located.
S204, encrypting the plaintext data by using the second secret key to obtain first encrypted data;
in S204, specifically, a secure service trusted service process may be run through a local secure service module where a third user is located, and the plaintext data is encrypted by using the second secret key to obtain first encrypted data, where the plaintext data is data that the third user needs to store.
S205, acquiring the first secret key, and encrypting the first encrypted data by using the first secret key to obtain the ciphertext data;
in S205, the first secret key may be an organization secret key maintained by a data security gateway where a third user is located; specifically, after the local security service module where the third user is located obtains the first encrypted data, the first encrypted data is sent to the data security gateway where the third user is located, and the data security gateway where the third user is located encrypts the first encrypted data by using the first secret key to obtain ciphertext data.
S206, storing the ciphertext data.
In S206, specifically, after obtaining the ciphertext data, the data security gateway where the third user is located stores the ciphertext data into the storage module, where the storage module may be a data center or cloud storage.
In this embodiment, the security of the second key may be improved by acquiring the hardware information, the operating system information, the state information, and the third user information to obtain the second key; the third user can encrypt the plaintext data for the second time under the condition of not trusting the data security gateway, and the plaintext data is submitted to the storage module by the data security gateway without worrying about the data security gateway acquiring the plaintext data, which is beneficial to ensuring the security of data storage.
Referring to fig. 3, in another embodiment based on the above embodiment, after storing the ciphertext data, the method further includes:
s301, judging whether a fourth user has data acquisition permission or not according to a data acquisition request of the fourth user, and if so, executing S302;
in S301, the fourth user, that is, the data acquisition initiating user, may initiate a corresponding data acquisition request according to the target data to be acquired; the plaintext data is the target data required to be acquired in the data acquisition request; optionally, when the fourth user does not have the data storage right, an error message may be prompted, which does not affect the implementation of the present example; specifically, the user mode agent process may be executed through the local security service module where the fourth user is located, and the access control list is used to determine the data acquisition permission for the fourth user.
S302, acquiring the ciphertext data according to the data acquisition request;
in S302, specifically, when the fourth user has the data obtaining permission, the local security service module where the fourth user is located initiates a data access request to the data security gateway where the third user is located according to the data sharing information, and the data security gateway where the third user is located obtains the ciphertext data from the storage module according to the data access request.
S303, acquiring the first secret key, and decrypting the ciphertext data by using the first secret key to obtain first decrypted data;
in S303, specifically, the first secret key may be obtained through the data security gateway where the third user is located, and then the ciphertext data is decrypted by using the first secret key, so as to obtain the first decrypted data.
S304, the second secret key is obtained, and the first decrypted data are decrypted by the second secret key to obtain second decrypted data;
in S304, specifically, after obtaining the first decrypted data, the data security gateway where the third user is located sends the first decrypted data to the local security service module where the fourth user is located, and the local security service module where the fourth user is located initiates a second secret key acquisition request to the local security service module where the third user is located; and the local security service module where the third user is located sends the second secret key to the local security service module where the fourth user is located according to the second secret key acquisition request, and then the local security service module where the fourth user is located decrypts the first decrypted data by using the second secret key to obtain second decrypted data.
S305, sending the second decrypted data to the fourth user.
In S305, specifically, the second decrypted data may be sent to the fourth user through the local security service module where the fourth user is located.
In this embodiment, by determining whether the fourth user has the data acquisition permission, the permission security of the fourth user may be determined, which is beneficial to ensuring the security of data acquisition.
Referring to fig. 4, in another embodiment based on the above embodiment, after obtaining the ciphertext data according to the data sharing information, the method further includes:
s401, according to the sharing cancellation request of the first user, whether the first user has the data acquisition permission or not is judged, if yes, S402 is executed:
in S401, the first user may initiate a data sharing cancellation request according to the data sharing information to be cancelled; optionally, when the first user does not have the data acquisition right, an error message may be prompted, which does not affect the implementation of the present example. Specifically, whether the first user has the data acquisition permission or not can be judged through the local security service module where the first user is located.
S402, canceling the data sharing information according to the sharing canceling request.
In S402, specifically, the data sharing information may be revoked through the data security gateway where the first user is located.
In this embodiment, the safety revocation of the data sharing information can be realized, so that the retention time of the data sharing information in the data sharing process can be reduced, and the safety of data sharing is favorably ensured.
Referring to fig. 5, in another embodiment based on the above embodiment, after the sending the second decrypted data to the second user, the method further includes:
s501, responding to the second user to open the second decryption data, judging whether the second decryption data is closed, if yes, executing S502.
S502, determining that the second secret key is invalid.
Specifically, the second key held by the local security service module where the second user is located is invalid after the second decrypted data is closed, and the second user needs to obtain the second key again if the second user needs to open the second decrypted data again.
In this embodiment, it can be ensured that the second secret key is not retained in other users for a long time, and data can be prevented from being stolen and leaked, which is beneficial to ensuring the security of data sharing.
Based on another embodiment of the foregoing embodiment, after determining that the first user has the data sharing right, the method further includes:
s601, judging whether the first user and the second user are in the same organization, if yes, executing S602.
And S602, generating data sharing information according to the data sharing request.
Specifically, the local security service module where the first user is located and the local security service module where the second user is located may be obtained according to the data sharing request, and then whether the first user and the second user are in the same organization may be determined according to the local security service module where the first user is located and the local security service module where the second user is located. In this embodiment, it may be determined whether the first user and the second user are in the same organization, and data transmission within the organization is more secure relative to data transmission between different organizations.
In another embodiment based on the above embodiment, the method further includes:
s701, responding to the fact that the first user and the second user are not in the same organization, and generating data sharing information and verification information according to the data sharing request;
s702, sending the data sharing information and the verification information to the second user;
and S703, acquiring ciphertext data according to the data sharing information and the verification information.
Specifically, when the first user and the second user are not in the same organization, the data security gateway where the first user is located generates data sharing information and verification information, wherein the verification information may be a verification code; in this embodiment, for a situation that the first user and the second user are not in the same organization, in a transmission process of different organizations, a verification process of verification information is added, which is beneficial to improving security of data sharing.
Based on another embodiment of the foregoing embodiment, after the generating data sharing information according to the data sharing request, the method further includes:
s801, judging whether the data sharing information is correct or not, if so, executing S801.
S801, sending the data sharing information to a second user;
specifically, whether the data sharing information is correct or not can be judged through a data security gateway where a first user is located; in the embodiment, whether the data sharing information is correct or not can be verified, so that the situation that the data sharing information is wrong can be avoided as much as possible, and the accuracy and the safety of data sharing are improved; optionally, when the data sharing information is wrong, an error message may be prompted, which does not affect the implementation of the present example.
In another embodiment based on the foregoing embodiment, after the generating data sharing information and verification information according to the data sharing request, the method further includes:
s901 determines whether the data sharing information is correct, if yes, S902 is executed.
And S902, sending the data sharing information and the verification information to the second user.
Specifically, whether the data sharing information is correct or not can be judged through a data security gateway where a first user is located; in this embodiment, whether the data sharing information is correct is verified for the situation that the first user and the second user are not in the same organization, so that the situation that the data sharing information is wrong can be avoided as much as possible, and the accuracy and the safety of data sharing are improved; optionally, when the data sharing information is wrong, an error message may be prompted, which does not affect the implementation of the present example.
It should be noted that, in the above embodiment, the first user and the third user may be the same user, that is, the user initiating the data sharing request and the user initiating the data storage request are the same user; correspondingly, the local security service modules where the first user and the third user are located may be the same local security service module, and the data security gateways where the first user and the third user are located may be the same data security gateway; in the above embodiment, the fourth user may be any user; in the above embodiment, when the first user and the second user are in the same organization, the first user and the second user may use the same local security service module, and accordingly, the data security gateways where the first user and the second user are located may be the same data security gateway, and accordingly, the data sharing information may be directly sent to the second user.
Referring to fig. 6, in another embodiment of the present application, there is further provided a data management system, including:
the data sharing permission determining unit 10 is configured to determine, according to a data sharing request of a first user, whether the first user has a data sharing permission;
the data sharing information generating unit 11 is configured to generate data sharing information according to the data sharing request when the first user has a data sharing right;
the data sharing information forwarding unit 12 is configured to send the data sharing information to a second user;
the ciphertext data obtaining unit 13 is configured to obtain ciphertext data according to the data sharing information;
a first decrypted data obtaining unit 14, configured to obtain a first secret key, and decrypt the ciphertext data by using the first secret key to obtain first decrypted data;
a data acquisition permission judging unit 15, configured to judge whether the second user has a data acquisition permission;
a second decrypted data obtaining unit 16, configured to obtain a second secret key when the second user has the data obtaining right, and decrypt the first decrypted data with the second secret key to obtain second decrypted data;
a second decrypted data forwarding unit 17, configured to send the second decrypted data to the second user;
the ciphertext data is obtained by encrypting first encryption data by using the first secret key, and the first encryption data is obtained by encrypting plaintext data by using the second secret key.
Referring to fig. 7, in another embodiment of the present application, there is further provided a data management apparatus, including: a storage medium 18 and a processor 19;
computer execution instructions are stored within the storage medium 18;
the processor 19 executes computer-executable instructions stored by the storage medium 18 to implement any of the above-described data management methods.
The processor 19 may include one or more processing cores, among others. The processor 19 invokes data stored in the storage medium 18 by executing or executing instructions, programs, code sets, or instruction sets stored in the storage medium 18 to perform the various functions of the present application and to process the data. The processor 19 may be at least one of an application specific integrated circuit, a digital signal processor, a digital signal processing device, a programmable logic device, a field programmable gate array, a central processing unit, a controller, a microcontroller, and a microprocessor. It will be appreciated that the electronics used to implement the processor functions described above may be other for different devices. The storage medium 18 may be used to store instructions, programs, code, sets of codes or sets of instructions. The storage medium 18 may include a storage program area and a storage data area, wherein the storage program area may store instructions for implementing an operating system, instructions for at least one function, and instructions for implementing any of the above-described data management methods, and the like; the storage data area may store data and the like involved in any of the above-described data management methods.
In another embodiment of the present application, a computer-readable storage medium is further provided, in which computer-executable instructions are stored, and the computer-executable instructions are implemented by a processor to implement any one of the above data management methods.
The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims (12)
1. A method for managing data, comprising:
judging whether a first user has data sharing authority or not according to a data sharing request of the first user, if so, then:
generating data sharing information according to the data sharing request;
sending the data sharing information to a second user;
acquiring ciphertext data according to the data sharing information;
acquiring a first secret key, and decrypting the ciphertext data by using the first secret key to obtain first decrypted data;
judging whether the second user has the data acquisition permission, if so, then:
acquiring a second secret key, and decrypting the first decrypted data by using the second secret key to obtain second decrypted data;
sending the second decrypted data to the second user;
the ciphertext data is obtained by encrypting first encryption data by using the first secret key, and the first encryption data is obtained by encrypting plaintext data by using the second secret key.
2. The method according to claim 1, wherein before determining whether the first user has the data sharing right according to the data sharing request of the first user, the method further comprises:
judging whether a third user has data storage authority or not according to a data storage request of the third user, if so, then:
acquiring hardware information, operating system information, system state information and user information of the third user;
obtaining the second secret key according to the hardware information, the operating system information, the system state information and the user information;
encrypting the plaintext data by using the second secret key to obtain first encrypted data;
acquiring the first secret key, and encrypting the first encrypted data by using the first secret key to obtain the ciphertext data;
storing the ciphertext data;
and the plaintext data is data required to be stored by the third user.
3. The data management method of claim 2, wherein after storing the ciphertext data, further comprising:
judging whether a fourth user has data acquisition permission or not according to a data acquisition request of the fourth user, if so, then:
acquiring the ciphertext data according to the data acquisition request;
acquiring the first secret key, and decrypting the ciphertext data by using the first secret key to obtain first decrypted data;
acquiring the second secret key, and decrypting the first decrypted data by using the second secret key to obtain second decrypted data;
and sending the second decrypted data to the fourth user.
4. The data management method according to claim 1, wherein after obtaining the ciphertext data according to the data sharing information, the method further comprises:
judging whether the first user has data acquisition permission or not according to the sharing revocation request of the first user, if so, then:
and revoking the data sharing information according to the sharing revoke request.
5. The data management method of claim 1, wherein after sending the second decrypted data to the second user, further comprising:
responding to the second user to open the second decrypted data, judging whether the second decrypted data is closed, if so, then:
determining that the second secret key is invalid.
6. The data management method of claim 1, after determining that the first user has the data sharing right, further comprising:
judging whether the first user and the second user are in the same organization, if so, then:
and generating data sharing information according to the data sharing request.
7. The data management method of claim 6, further comprising:
responding to the situation that the first user and the second user are not in the same organization, and generating data sharing information and verification information according to the data sharing request;
sending the data sharing information and the verification information to the second user;
and acquiring ciphertext data according to the data sharing information and the verification information.
8. The data management method according to claim 6, wherein after generating the data sharing information according to the data sharing request, the method further comprises:
judging whether the data sharing information is correct, if so,:
and sending the data sharing information to a second user.
9. The method according to claim 7, wherein after generating the data sharing information and the verification information according to the data sharing request, the method further comprises:
judging whether the data sharing information is correct, if so,:
and sending the data sharing information and the verification information to the second user.
10. A data management system, comprising:
the data sharing permission judging unit is used for judging whether a first user has data sharing permission or not according to a data sharing request of the first user;
the data sharing information generating unit is used for generating data sharing information according to the data sharing request when the first user has the data sharing right;
the data sharing information forwarding unit is used for sending the data sharing information to a second user;
the ciphertext data acquisition unit is used for acquiring ciphertext data according to the data sharing information;
the first decryption data acquisition unit is used for acquiring a first secret key and decrypting the ciphertext data by using the first secret key to obtain first decryption data;
the data acquisition permission judging unit is used for judging whether the second user has data acquisition permission;
a second decrypted data obtaining unit, configured to obtain a second secret key when the second user has the data obtaining right, and decrypt the first decrypted data using the second secret key to obtain second decrypted data;
a second decrypted data forwarding unit, configured to send the second decrypted data to the second user;
the ciphertext data is obtained by encrypting first encryption data by using the first secret key, and the first encryption data is obtained by encrypting plaintext data by using the second secret key.
11. A data management apparatus, characterized by comprising: a storage medium and a processor;
computer execution instructions are stored in the storage medium;
the processor executes computer-executable instructions stored by the storage medium to implement the method of any one of claims 1 to 9.
12. A computer-readable storage medium having computer-executable instructions stored thereon, which when executed by a processor, are configured to implement the method of any one of claims 1 to 9.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211496502.9A CN115529194B (en) | 2022-11-28 | 2022-11-28 | Data management method, system, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211496502.9A CN115529194B (en) | 2022-11-28 | 2022-11-28 | Data management method, system, equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115529194A true CN115529194A (en) | 2022-12-27 |
| CN115529194B CN115529194B (en) | 2023-03-10 |
Family
ID=84705105
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211496502.9A Active CN115529194B (en) | 2022-11-28 | 2022-11-28 | Data management method, system, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115529194B (en) |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102970299A (en) * | 2012-11-27 | 2013-03-13 | 西安电子科技大学 | File safe protection system and method thereof |
| CN103248479A (en) * | 2012-02-06 | 2013-08-14 | 中兴通讯股份有限公司 | Cloud storage safety system, data protection method and data sharing method |
| US20150180661A1 (en) * | 2012-08-08 | 2015-06-25 | Kabushiki Kaisha Toshiba | Re-encryption key generator, re-encryption device, encryption device, decryption device, and program |
| CN104796411A (en) * | 2015-04-01 | 2015-07-22 | 朱威 | Method for safely transmitting, storing and utilizing data in cloud and mobile terminal |
| CN106850656A (en) * | 2017-02-27 | 2017-06-13 | 淮阴工学院 | Multi-user's file-sharing control method under a kind of cloud environment |
| US20180285583A1 (en) * | 2015-10-14 | 2018-10-04 | Finalcode, Inc. | File encrypting apparatus, file decrypting apparatus, system and program |
| CN108810004A (en) * | 2018-06-22 | 2018-11-13 | 西安电子科技大学 | More authorization center access control methods, cloud storage system can be revoked based on agency |
| CN109214201A (en) * | 2018-08-31 | 2019-01-15 | 平安科技（深圳）有限公司 | A kind of data sharing method, terminal device and computer readable storage medium |
| CN113645039A (en) * | 2021-08-04 | 2021-11-12 | 刘爱菊 | Communication information transmission system and method based on different authorities |
-
2022
- 2022-11-28 CN CN202211496502.9A patent/CN115529194B/en active Active
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103248479A (en) * | 2012-02-06 | 2013-08-14 | 中兴通讯股份有限公司 | Cloud storage safety system, data protection method and data sharing method |
| US20150180661A1 (en) * | 2012-08-08 | 2015-06-25 | Kabushiki Kaisha Toshiba | Re-encryption key generator, re-encryption device, encryption device, decryption device, and program |
| CN102970299A (en) * | 2012-11-27 | 2013-03-13 | 西安电子科技大学 | File safe protection system and method thereof |
| CN104796411A (en) * | 2015-04-01 | 2015-07-22 | 朱威 | Method for safely transmitting, storing and utilizing data in cloud and mobile terminal |
| US20180285583A1 (en) * | 2015-10-14 | 2018-10-04 | Finalcode, Inc. | File encrypting apparatus, file decrypting apparatus, system and program |
| CN106850656A (en) * | 2017-02-27 | 2017-06-13 | 淮阴工学院 | Multi-user's file-sharing control method under a kind of cloud environment |
| CN108810004A (en) * | 2018-06-22 | 2018-11-13 | 西安电子科技大学 | More authorization center access control methods, cloud storage system can be revoked based on agency |
| CN109214201A (en) * | 2018-08-31 | 2019-01-15 | 平安科技（深圳）有限公司 | A kind of data sharing method, terminal device and computer readable storage medium |
| CN113645039A (en) * | 2021-08-04 | 2021-11-12 | 刘爱菊 | Communication information transmission system and method based on different authorities |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115529194B (en) | 2023-03-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP3382933B1 (en) | Using a trusted execution environment as a trusted third party providing privacy for attestation | |
| KR102443857B1 (en) | Addressing technique of trusted execution environment using encryption key | |
| JP5860815B2 (en) | System and method for enforcing computer policy | |
| US11218299B2 (en) | Software encryption | |
| EP2115654B1 (en) | Simplified management of authentication credentials for unattended applications | |
| US20210344482A1 (en) | Method of data transfer, a method of controlling use of data and cryptographic device | |
| KR100737628B1 (en) | Attestation using both fixed token and portable token | |
| KR102361884B1 (en) | Use of hardware-based security isolation areas to prevent piracy and piracy of electronic devices | |
| JP2017050023A (en) | System and method of enforcing third party monitoring of anonymous data | |
| US20220114249A1 (en) | Systems and methods for secure and fast machine learning inference in a trusted execution environment | |
| AU2017396531A1 (en) | Addressing a trusted execution environment using signing key | |
| US11943345B2 (en) | Key management method and related device | |
| Fan et al. | Fine-grained access control based on trusted execution environment | |
| US20240039709A1 (en) | Method and apparatus for sharing encrypted data, and device and readable medium | |
| Fuchs et al. | HIP: HSM-based identities for plug-and-charge | |
| CN106992978B (en) | Network security management method and server | |
| CN114942729A (en) | Data safety storage and reading method for computer system | |
| US11438161B2 (en) | Implicit attestation for network access | |
| Kurnikov et al. | Keys in the clouds: auditable multi-device access to cryptographic credentials | |
| CN115529194B (en) | Data management method, system, equipment and storage medium | |
| KR101508439B1 (en) | Method for ensuring data confidentiality, method and system for sharing data for using the same | |
| CN112363800A (en) | Network card memory access method, security processor, network card and electronic equipment | |
| EP3525391A1 (en) | Device and method for key provisioning | |
| CN106992976B (en) | Network security management method and server | |
| CN113162762A (en) | Key authorization method, encryption machine, terminal and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |