CN108199838B - Data protection method and device - Google Patents
Data protection method and device Download PDFInfo
- Publication number
- CN108199838B CN108199838B CN201810097277.9A CN201810097277A CN108199838B CN 108199838 B CN108199838 B CN 108199838B CN 201810097277 A CN201810097277 A CN 201810097277A CN 108199838 B CN108199838 B CN 108199838B
- Authority
- CN
- China
- Prior art keywords
- key
- ciphertext
- receiver
- sub
- data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0877—Generation of secret information including derivation or calculation of cryptographic keys or passwords using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
Abstract
The invention discloses a data protection method, which is applied to a sender client and comprises the following steps: logging in a server, generating and storing a first key in a first hardware array arranged at the server, and generating and storing a first digital license for a first receiver in the first hardware array; and encrypting the data to generate a first data ciphertext, and sending the first data ciphertext to a first receiver, wherein the first key is a key required for decrypting the first data ciphertext. The invention also discloses a data protection method and a data protection device which are respectively applied to the server side and the receiver side. The data protection scheme of the invention can effectively prevent hackers from invading, avoid data leakage and ensure data security.
Description
Technical Field
The present invention relates to the field of information security technologies, and in particular, to a data protection method and apparatus.
Background
With the development of the internet, various cloud office collaboration systems have come into operation. The cloud office mode is essentially that through the cloud computing technology, employees can access a network at any time and any place to work, and meanwhile, enterprises are subjected to cell splitting in human units and are recombined and cooperated at any time.
However, the development of the internet technology increases the risk of data security while bringing convenience and high efficiency, and if the cloud office computing technology based on the internet technology needs to be developed healthily, the security of free data circulation must be continuously improved to meet the requirements of the cloud office era.
Disclosure of Invention
In view of this, embodiments of the present invention provide a data protection method and apparatus capable of improving data security.
Therefore, an embodiment of the present invention provides a data protection method, which is applied to a sender client, and includes: logging in a server, generating and storing a first key in a first hardware array arranged at the server, and generating and storing a first digital license for a first receiver in the first hardware array; and encrypting the data to generate a first data ciphertext, and sending the first data ciphertext to a first receiver, wherein the first key is a key required for decrypting the first data ciphertext.
Preferably, the first data cipher text is obtained by encrypting the data with a second key, and the method further includes: and encrypting the second key by using the first key to obtain a second key first ciphertext, and sending the second key first ciphertext to the first receiver.
Preferably, the first data cipher text is obtained by encrypting the data with a second key, and the method further includes: combining a first sub-secret key and a second sub-secret key into the second secret key, wherein the first secret key is a secret key required for obtaining the second sub-secret key; encrypting the first sub-key by using a first receiver public key to generate a first sub-key first ciphertext; and sending the first sub-key first ciphertext to a first receiver.
Preferably, the second sub-key is the first key.
Preferably, the method further comprises: encrypting the second sub-key by using the first key to generate a second sub-key first ciphertext; and sending the first ciphertext of the second sub-key to the first receiver.
Preferably, the second subkey is a random number generated in the first hardware array.
Preferably, the method further comprises: the identification information for the first digital license is sent to the first recipient.
An embodiment of the present invention further provides a data protection apparatus, including a processor, where the processor executes a predetermined computer instruction to execute the data protection method of the sender client according to any of the above embodiments.
The embodiment of the invention also provides a data protection method which is applied to a server side, wherein the server side is provided with a hardware array, and the method comprises the following steps: generating and storing a first key in a first hardware array based on a first service request received from a sender, and generating and storing a first digital license to the first key in the first hardware array for a first recipient; and when a key use request of a first receiver is received, checking whether a first digital license stored in the first hardware array is in a valid state, if so, allowing the first receiver to use the first key when decrypting a first data ciphertext obtained from the sender, otherwise, forbidding the first receiver to use the first key.
Preferably, allowing the first receiver to use the first key in decrypting the first data cipher text obtained from the sender comprises: and the first key is used in the first hardware array to decrypt a first cipher text of a second key obtained by the first receiver from the sender to obtain a second key for decrypting the first data cipher text, and the second key is encrypted by the first receiver public key in the first hardware array and then is sent to the first receiver.
Preferably, allowing the first receiver to use the first key in decrypting the first data cipher text obtained from the sender comprises: and encrypting the first key by using a first receiver public key in the first hardware array and then sending the encrypted first key to the first receiver so that the first receiver can generate a second key for decrypting the first data ciphertext based on the first key.
Preferably, allowing the first receiver to use the first key in decrypting the first data cipher text obtained from the sender comprises: and the first sub-key is encrypted by using a first receiver public key in the first hardware array and then sent to the first receiver, so that the first receiver generates a second key for decrypting the first data ciphertext based on the second sub-key.
Preferably, the first key is a random number generated in the first hardware array.
Preferably, the key use request includes identification information of the first digital license, the method further comprising: determining the first digital license to check in the first hardware array based on the identification information of the first digital license.
The embodiment of the invention also provides a data protection device, which comprises a processor, wherein the processor executes a preset computer instruction to execute the data protection method of the server side in any embodiment.
The embodiment of the invention also provides a data protection method which is applied to the client of the receiving party and comprises the following steps: when receiving a first data ciphertext from a sender, sending a key use request for a first key to a server to trigger the server to check whether a first digital license for the first key, which is generated for a first receiver by the sender, is in a valid state in a first hardware array arranged in the server based on the key use request; when the server checks that the first digital license in the first hardware array is in a valid state, the first key stored in the first hardware array is used in decrypting a first data cipher text.
Preferably, the method further comprises: receiving a second key first ciphertext from a sender, wherein using the first key stored in the first hardware array in decrypting a first data ciphertext comprises: and sending the first cipher text of the second key to a server and receiving the second cipher text of the second key from the server, and decrypting the second cipher text of the second key by using a private key of a first receiver to obtain a second key for decrypting the first data cipher text, wherein the second cipher text of the second key is obtained by encrypting the second key by using a public key of the first receiver in the first hardware array by the server, and the first cipher text of the second key is obtained by decrypting the first cipher text of the second key by using the first key in the first hardware array by the server.
Preferably, the method further comprises: receiving a first sub-key first ciphertext from a sender, and decrypting the first sub-key first ciphertext with a first receiver private key to obtain a first sub-key, wherein using the first key stored in the first hardware array when decrypting a first data ciphertext comprises: the method comprises the steps of receiving a first secret key first ciphertext from a server, decrypting the first secret key first ciphertext by using a first receiver private key to obtain a first secret key, combining a first sub-secret key and the first secret key into a second secret key for decrypting a first data ciphertext, and encrypting the first secret key first ciphertext by the server in a first hardware array by using a first receiver public key.
Preferably, the method further comprises: receiving a first sub-key first ciphertext and a second sub-key first ciphertext from a sender, and decrypting the first sub-key first ciphertext with a first receiver private key to obtain a first sub-key, wherein using the first key stored in the first hardware array when decrypting a first data ciphertext comprises: and sending the first ciphertext of the second sub-key to a server and receiving a second ciphertext of the second sub-key from the server, decrypting the second ciphertext of the second sub-key by using a private key of a first receiver to obtain a second sub-key, and combining the first sub-key and the second sub-key into a second key for decrypting the first data ciphertext, wherein the second ciphertext of the second sub-key is obtained by encrypting the second sub-key by using a public key of the first receiver in the first hardware array by the server, and the second sub-key is obtained by decrypting the first ciphertext of the second sub-key by using the first key in the first hardware array by the server.
Preferably, the key usage request includes identification information of a first digital license so that the server side determines the first digital license to be checked in the first hardware array based on the identification information of the first digital license.
An embodiment of the present invention further provides a data protection apparatus, which includes a processor, and the processor executes a predetermined computer instruction to execute the data protection method of the receiver client according to any of the above embodiments.
By the data protection scheme of the embodiment of the invention, the invasion of hackers can be effectively prevented, the data leakage is avoided, and the data security is ensured.
Drawings
FIG. 1 is a schematic flow chart diagram illustrating one embodiment of a data protection method of the present invention;
FIG. 2 is a schematic flow chart diagram illustrating another embodiment of a data protection method of the present invention;
FIG. 3 is a schematic flow chart diagram illustrating yet another embodiment of a data protection method of the present invention;
FIG. 4 is a schematic flow chart diagram illustrating one embodiment of a data protection method of the present invention;
FIG. 5 is a schematic flow chart diagram illustrating another embodiment of a data protection method of the present invention;
FIG. 6 is a schematic flow chart diagram illustrating one embodiment of a data protection method of the present invention;
FIG. 7 is a schematic flow chart diagram illustrating another embodiment of a data protection method of the present invention;
FIG. 8 is a schematic flow chart diagram illustrating yet another embodiment of a data protection method of the present invention;
FIG. 9 is a schematic flow chart diagram illustrating yet another embodiment of a data protection method of the present invention.
Detailed Description
Various embodiments of the present invention will be described in detail below with reference to the accompanying drawings.
Fig. 1 is a schematic flow chart of an embodiment of a data protection method of the present invention, which is applied to a sender client.
As shown in fig. 1, the data protection method according to the embodiment of the present invention includes:
s101, logging in a server, generating and storing a first key in a first hardware array arranged at the server, and generating and storing a first digital license for a first key for a first receiver in the first hardware array;
s102, encrypting the data to generate a first data ciphertext, and sending the first data ciphertext to a first receiver, wherein the first key is a key required by decryption of the first data ciphertext.
In the embodiment of the invention, a data sending party carries out encryption processing on data needing to be sent to a first receiving party to generate a first data ciphertext, and key data needed by decryption of the first data ciphertext is forwarded through a server.
The sender uses more than one secret key including the first secret key when encrypting the data, and the encryption mode can be various, for example, the first public key of the receiver is used for encrypting the data first and then the first secret key is used for carrying out second layer encryption on the data ciphertext; the first key is used for encrypting the data, then the first receiver public key is used for carrying out second-layer encryption on the data ciphertext, the first key and the first receiver public key are used for respectively encrypting different parts of the data, and the like.
When a sender user needs to encrypt data by using a first key, the sender user logs in a server providing services such as a forwarding key and the like through a network, and generates the first key in a first hardware array arranged at the server under the condition of keeping logging in the server, wherein the first hardware array is specially arranged at the server for providing the services such as the forwarding key and the like.
The first hardware array may be implemented by, for example, an encryption lock array, and by connecting each encryption lock constituting the encryption lock array to a service data processing device of a server, a key service request received by an access device of the server accessing the internet from a client of a sender may be transmitted to the service data processing device, and the service data processing device assigns a random one of available encryption locks in the encryption lock array to the service request, and the sender making the request may generate a first key in the encryption lock by remote operation, and at the same time, the first hardware array as a whole is a hardware device for the sender, and the sender does not know nor needs to know which unit device in the first hardware array is operated. After the sender generates the first key by performing remote operation on the first hardware array of the server, the server can encrypt the first key by using a public key of the sender and then send the encrypted first key to the sender, and the sender decrypts the first key ciphertext by using a corresponding private key to obtain the first key.
After the sender generates the first key in the first hardware array, the sender continues to operate in the first hardware array where the digital license file for the first key is generated for the first recipient, and for convenience of description, the digital license file generated for the first recipient will be referred to as the first digital license. License information set by the sender for the first recipient may be included in the first digital license file, including an expiration time, time period, number of uses, etc. by which the first recipient may use the first key. The first key and the first digital license are stored in association in a first hardware array.
After the creation of the first key and the first digital license is completed in the first hardware array, the sender encrypts data by using the first key or a plurality of keys including the first key to generate a first data ciphertext and sends the first data ciphertext to the first receiver.
The first receiver may make a key use request to the server after receiving the first data ciphertext from the sender, and the server checks in the first hardware array whether a first digital license of the first receiver for the first key is in a valid state, and determines whether to allow the first receiver to use the first key according to whether the first digital license is in the valid state.
According to the data protection method provided by the embodiment of the invention, the first key used by the sender for encrypting the data for the first receiver and the first digital license issued for the first receiver are both generated and stored in the first hardware array of the server, and the first key and the first digital license are subjected to the first hardware array, so that a hacker can be effectively prevented from invading and stealing sensitive data, the leakage of user sensitive data is avoided, and the safety of user data is ensured.
FIG. 2 is a schematic flow chart diagram illustrating another embodiment of a data protection method of the present invention. In the embodiment of the invention, the first data ciphertext is obtained by encrypting data by using the second key, and the first key is used for encrypting the second key to generate the key ciphertext.
As shown in fig. 2, the data protection method according to the embodiment of the present invention includes:
s201, logging in a server, generating and storing a first key in a first hardware array arranged at the server, and generating and storing a first digital license for a first key for a first receiver in the first hardware array;
s202, encrypting the data by using a second key to generate a first data ciphertext, and encrypting the second key by using the first key to obtain a second key first ciphertext;
s203, sending the first cipher text of the second key and the first data cipher text to the first receiver.
In the embodiment of the invention, when encrypting data to be sent to a first receiver, a sender encrypts the data by using a second key to generate a first data ciphertext, and generates a first key and a first digital license thereof in a first hardware array by logging in a server, encrypts the second key by using the first key returned from the server to generate a second key first ciphertext, and sends the first data ciphertext and the second key first ciphertext to the first receiver.
The first receiver provides a key using request to the server when receiving the first data ciphertext and the second key first ciphertext from the sender, and the server checks whether the first digital license of the first receiver for the first key is in an effective state in the first hardware array, and if the first digital license of the first receiver for the first key is in the effective state, the first key is used as the first receiver to decrypt the second key first ciphertext, so that the first receiver can obtain the second key to decrypt the first data ciphertext.
FIG. 3 is a schematic flow chart diagram illustrating yet another embodiment of a data protection method of the present invention.
As shown in fig. 3, the data protection method according to the embodiment of the present invention includes:
s301, logging in a server, generating and storing a first key in a first hardware array arranged at the server, and generating and storing a first digital license for a first key for a first receiver in the first hardware array;
s302, combining the first sub-secret key and the second sub-secret key into a second secret key, encrypting data by using the second secret key to generate a first data ciphertext, wherein the first secret key is a secret key required for obtaining the second sub-secret key;
s303, encrypting the first sub-secret key by using a public key of a first receiver to generate a first cipher text of the first sub-secret key;
s304, the first data ciphertext and the first sub-key first ciphertext are sent to a first receiver.
In the embodiment of the present invention, the sender also encrypts data using the second key to generate the first data ciphertext, which is different from the embodiment shown in fig. 2 in that the second key in the embodiment of the present invention is composed of two parts, i.e., the first sub-key and the second sub-key. The sender encrypts the first sub-key by using the public key of the first receiver to generate a first sub-key first ciphertext, and the first sub-key first ciphertext and the first data ciphertext are sent to the first receiver.
In the embodiment of the invention, the first key is a key required by the first receiver to obtain the second sub-key, and when the first receiver receives the first data ciphertext and the first sub-key first ciphertext from the sender, the first receiver can decrypt the first sub-key first ciphertext by using the first receiver private key to obtain the first sub-key, but also needs to make a key use request to the server to obtain the second sub-key through the first key. When the server receives the key use request of the first receiver, the server checks whether the first digital license of the first receiver for the first key is in a valid state or not in the first hardware array, if so, the first receiver is allowed to obtain a second sub-key by using the first key, so that a second key is generated through the combination of the first sub-key and the second sub-key, and the first data ciphertext is decrypted by using the second key.
In an embodiment of the present invention, the second sub-secret key may be a first secret key itself, the first secret key may be carried in a secret key usage request sent by the first receiver to the server, and the first sub-secret key carried in the secret key usage request may be encrypted by a server public key, so as to ensure data security during a transmission process. When the server side receives the key use request and checks that the first digital license of the first key is valid for the first receiver side in the first hardware array, the server side can combine the first sub-key extracted and decrypted from the key use request and the first key stored in the first hardware array into the second key, encrypt the second key by the public key of the first receiver side and send the second key to the first receiver side.
In another embodiment of the present invention, the sender encrypts the data with the second key to obtain a first data ciphertext, encrypts the first sub-key with the public key of the first receiver to obtain a first ciphertext of the first sub-key, encrypts the second sub-key with the first key to generate a first ciphertext of the second sub-key, and then sends the first data ciphertext, the first ciphertext of the first sub-key, and the first ciphertext of the second sub-key to the first receiver. After receiving the data, the first receiver sends a key use request to the server, and can carry the first ciphertext of the second sub-key in the key use request. After receiving a key use request of a first receiver, a server firstly confirms whether a first hardware array stores a first digital license of the first receiver to a first key and confirms whether the first digital license is in a valid state, if so, a first ciphertext of a second sub-key is extracted from the key use request, the first key is used for decryption to obtain the second sub-key, and the public key of the first receiver is used for encrypting the second sub-key and then returning the second sub-key to the first receiver. And after the first receiver obtains the second sub-key from the server, the first sub-key and the second sub-key are combined to generate a second key, and the first data ciphertext is decrypted by using the second key.
In the above embodiments of the present invention, the first key or the second sub-key may be a random number generated by the sender in the first hardware array, and the random number generation mechanism may further improve the security of the key data by combining with the hard disk array.
In the embodiments of the present invention, after the sender generates the first digital license for the first receiver in the first hardware array of the server, the sender may send the identification information of the first digital license to the first receiver. When the first receiver sends a key use request to the server to request to use the first key, the first receiver may carry identification information of the first digital license in the key use request, so that the server searches whether the first digital license associated with the first key requested to be used by the first receiver exists in the first hardware array based on the identification information. In addition to this, the server may assign additional identification information to the sender for digital licenses generated by different recipients and return to the sender, and the first recipient may request use of the first key from the server based on this identification information obtained from the sender.
An embodiment of the present invention further provides a data protection apparatus, which may be implemented by a terminal device including a processor and a memory, where the processor may be configured to execute a predetermined computer instruction stored in the memory to execute the data protection method applied to the sender client in any of the above embodiments.
Fig. 4 is a schematic flow chart of an embodiment of a data protection method of the present invention, where the data protection method of the embodiment of the present invention is applied to a server, and a hardware array for providing a key service is disposed at the server.
As shown in fig. 4, the data protection method according to the embodiment of the present invention includes:
s401, generating and storing a first key in a first hardware array based on a first service request received from a sender, and generating and storing a first digital license to the first key for a first receiver in the first hardware array;
s402, when a key use request of a first receiver is received, checking whether a first digital license stored in the first hardware array is in a valid state;
s403, if the first digital license is valid, allowing the first recipient to use the first key in decrypting the first data cipher text obtained from the sender;
s404, if the first digital license fails, forbidding the first recipient to use the first key.
In the embodiment of the invention, when a sender user needs to encrypt data to be sent to a first receiver by using a first key, the sender user logs in a server providing services such as a forwarding key and the like through a network, generates the first key in a first hardware array set by the server in a state of keeping logging in the server, and generates a first digital license for the first key for the first receiver in the first hardware array.
The first receiver may make a key use request to the server after receiving the first data ciphertext from the sender, and the server checks in the first hardware array whether a first digital license of the first receiver for the first key is in a valid state, and determines whether to allow the first receiver to use the first key according to whether the first digital license is in the valid state.
According to the data protection method provided by the embodiment of the invention, the first key used by the sender for encrypting the data for the first receiver and the first digital license issued for the first receiver are both generated and stored in the first hardware array of the server, and the first key and the first digital license are subjected to the first hardware array, so that a hacker can be effectively prevented from invading and stealing sensitive data, the leakage of user sensitive data is avoided, and the safety of user data is ensured.
In an embodiment of the present invention, in S403, the step of allowing the first receiver to use the first key when decrypting the first data ciphertext obtained from the sender may be that the server uses the first key in the first hardware array to decrypt a second key first ciphertext obtained by the first receiver from the sender to obtain a second key used for decrypting the first data ciphertext, and encrypts the second key with the first receiver public key in the first hardware array and sends the second key to the first receiver.
In an embodiment of the present invention, in S403, the first key allowed to be used by the first receiver when decrypting the first data ciphertext obtained from the sender may be that the server encrypts the first key with the first receiver public key in the first hardware array and sends the encrypted first key to the first receiver, so that the first receiver can obtain the second key for decrypting the first data ciphertext based on the first key.
In another embodiment of the present invention, in S403, the step of allowing the first receiver to use the first key when decrypting the first data ciphertext obtained from the sender may be that the server uses the first key in the first hardware array to decrypt a second sub-key first ciphertext obtained by the first receiver from the sender to obtain a second sub-key, encrypts the second sub-key with the first receiver public key in the first hardware array, and sends the encrypted second sub-key to the first receiver, so that the first receiver can generate a second key for decrypting the first data ciphertext based on the second sub-key.
In the above embodiments of the present invention, the first key or the second sub-key may be a random number generated by the sender in the first hardware array, and the random number generation mechanism may further improve the security of the key data by combining with the hard disk array.
FIG. 5 is a schematic flow chart diagram illustrating another embodiment of a data protection method of the present invention.
As shown in fig. 5, the data protection method according to the embodiment of the present invention includes:
s501, generating and storing a first key in a first hardware array based on a first service request received from a sender, and generating and storing a first digital license to the first key for a first receiver in the first hardware array;
s502, when a key use request of a first receiver is received, whether a first digital license in a first hardware array is in a valid state is checked based on digital license identification information in the key use request;
s503, if the first digital license is valid, allowing the first receiver to use the first key in decrypting the first data cipher text obtained from the sender;
s504, if the first digital license fails, forbidding the first recipient to use the first key.
In the embodiment of the present invention, after the sender generates the first digital license for the first receiver in the first hardware array of the server, the sender may send the identification information of the first digital license to the first receiver. When the first receiver sends a key use request to the server to request to use the first key, the first receiver may carry identification information of the first digital license in the key use request, so that the server searches whether the first digital license associated with the first key requested to be used by the first receiver exists in the first hardware array based on the identification information. In addition to this, the server may assign additional identification information to the sender for digital licenses generated by different recipients and return to the sender, and the first recipient may request use of the first key from the server based on this identification information obtained from the sender.
An embodiment of the present invention further provides a data protection apparatus, which may be implemented by a terminal device that includes a processor and a memory and serves as a server, where the processor may be configured to execute a predetermined computer instruction stored in the memory to execute the data protection method applied to the server in any of the foregoing embodiments.
Fig. 6 is a schematic flow chart of an embodiment of a data protection method of the present invention, which is applied to a receiver client.
As shown in fig. 6, the data protection method according to the embodiment of the present invention includes:
s601, when receiving a first data ciphertext from a sender, sending a key use request for a first key to a server to trigger the server to check whether a first digital license for the first key, which is generated for a first receiver by the sender, is in an effective state in a first hardware array arranged at the server based on the key use request;
s602, when the server checks that the first digital license in the first hardware array is in a valid state, the first key stored in the first hardware array is used for decrypting a first data ciphertext.
In the embodiment of the invention, a data sending party carries out encryption processing on data needing to be sent to a first receiving party to generate a first data ciphertext, and first key data needed by decryption of the first data ciphertext is forwarded through a server. The sender needs to generate a first key in a first hardware array set by the server and generate a digital license file for the first key in the first hardware array for the first receiver.
After the creation of the first key and the first digital license is completed in the first hardware array, the sender encrypts data by using the first key or a plurality of keys including the first key to generate a first data ciphertext and sends the first data ciphertext to the first receiver.
The first receiver may make a key use request to the server after receiving the first data ciphertext from the sender, and the server checks in the first hardware array whether a first digital license of the first receiver for the first key is in a valid state, and determines whether to allow the first receiver to use the first key according to whether the first digital license is in the valid state.
According to the data protection method provided by the embodiment of the invention, the first key used by the sender for encrypting the data for the first receiver and the first digital license issued for the first receiver are both generated and stored in the first hardware array of the server, and the first key and the first digital license are subjected to the first hardware array, so that a hacker can be effectively prevented from invading and stealing sensitive data, the leakage of user sensitive data is avoided, and the safety of user data is ensured.
FIG. 7 is a schematic flow chart diagram illustrating another embodiment of a data protection method of the present invention.
As shown in fig. 7, the data protection method according to the embodiment of the present invention includes:
s701, when receiving a first data ciphertext and a second key first ciphertext from a sender, sending a key use request for a first key to a server, so as to trigger the server to check whether a first digital license for the first key, which is generated for a first receiver by the sender, is in an effective state in a first hardware array arranged in the server based on the key use request;
s702, when the server checks that the first digital license in the first hardware array is in a valid state, sending a first cipher text of a second key to the server and receiving a second cipher text of the second key from the server;
s703, decrypting the second cipher text of the second cipher text by using the private key of the first receiver to obtain the second cipher key for decrypting the first data cipher text,
in the embodiment of the invention, when encrypting data to be sent to a first receiver, a sender encrypts the data by using a second key to generate a first data ciphertext, and generates a first key and a first digital license thereof in a first hardware array by logging in a server, encrypts the second key by using the first key returned from the server to generate a second key first ciphertext, and sends the first data ciphertext and the second key first ciphertext to the first receiver.
The first receiver provides a key using request to the server when receiving the first data ciphertext and the second key first ciphertext from the sender, and the server checks whether the first digital license of the first receiver for the first key is in an effective state in the first hardware array, and if the first digital license of the first receiver for the first key is in the effective state, the first key is used as the first receiver to decrypt the second key first ciphertext, so that the first receiver can obtain the second key to decrypt the first data ciphertext.
FIG. 8 is a schematic flow chart diagram illustrating yet another embodiment of a data protection method of the present invention.
As shown in fig. 8, the data protection method according to the embodiment of the present invention includes:
s801, when receiving a first data ciphertext and a first sub-key first ciphertext from a sender, sending a key use request for a first key to a server, so as to trigger the server to check whether a first digital license for the first key, which is generated for a first receiver by the sender, is in an effective state in a first hardware array arranged in the server based on the key use request;
s802, when the server side checks that the first digital license in the first hardware array is in a valid state, receiving a first secret key first ciphertext from the server side;
s803, the first key first ciphertext is decrypted by using the first receiver private key to obtain a first key, and the first sub-key and the first key are combined into a second key for decrypting the first data ciphertext.
In the embodiment of the invention, the sender encrypts data by using a second key to generate a first data ciphertext, and the second key consists of two parts, namely a first sub-key and a second sub-key, wherein the second sub-key is the first key stored in the first hardware array of the server. The sender encrypts the first sub-key by using the public key of the first receiver to generate a first sub-key first ciphertext, and the first sub-key first ciphertext and the first data ciphertext are sent to the first receiver.
In the embodiment of the invention, when receiving the first data ciphertext and the first sub-key first ciphertext from the sender, the first receiver can decrypt the first sub-key first ciphertext by using the first receiver private key to obtain the first sub-key, but needs to make a key use request to the server to obtain the first key serving as the second sub-key. When the server receives the key use request of the first receiver, the server checks whether the first digital license of the first receiver for the first key is in a valid state or not in the first hardware array, if so, the first key can be encrypted and then sent to the first receiver, and the first receiver combines the first sub-key and the first key into a second key to decrypt the first data ciphertext. In addition, the first receiver can also encrypt the first sub-key and send the encrypted first sub-key to the server, when the server checks that the first digital license of the first receiver to the first key in the first hardware array is valid, the server combines the first sub-key and the first key stored in the first hardware array into a second key, encrypts the second key by using the public key of the first receiver, and sends the encrypted second key to the first receiver.
FIG. 9 is a schematic flow chart diagram illustrating yet another embodiment of a data protection method of the present invention.
As shown in fig. 9, the data protection method according to the embodiment of the present invention includes:
s901, when receiving a first data ciphertext, a first sub-key first ciphertext and a second key first ciphertext from a sender, sending a key use request for a first key to a server, so as to trigger the server to check whether a first digital license for the first key, which is generated for a first receiver by the sender, is in an effective state in a first hardware array arranged in the server based on the key use request;
s902, when the server checks that the first digital license in the first hardware array is in an effective state, sending the first ciphertext of the second sub-key to the server and receiving the second ciphertext of the second sub-key from the server;
s903, decrypting the second sub-key and the second ciphertext by using the private key of the first receiver to obtain a second sub-key, and combining the first sub-key and the second sub-key into a second key for decrypting the first data ciphertext.
In the embodiment of the invention, the sender encrypts data by using the second key to generate the first data ciphertext, and the second key consists of two parts, namely a first sub-key and a second sub-key. The sender encrypts the first sub-key by using the public key of the first receiver to generate a first sub-key first ciphertext, encrypts the second sub-key by using the first key to generate a second sub-key first ciphertext, and then sends the first data ciphertext, the first sub-key first ciphertext and the second sub-key first ciphertext to the first receiver.
After receiving the data, the first receiver sends a key use request to the server, and can carry the first ciphertext of the second sub-key in the key use request. After receiving a key use request of a first receiver, a server firstly confirms whether a first hardware array stores a first digital license of the first receiver to a first key and confirms whether the first digital license is in a valid state, if so, a first ciphertext of a second sub-key is extracted from the key use request, the first key is used for decryption to obtain the second sub-key, and the public key of the first receiver is used for encrypting the second sub-key and then returning the second sub-key to the first receiver. And after the first receiver obtains the second sub-key from the server, the first sub-key and the second sub-key are combined to generate a second key, and the first data ciphertext is decrypted by using the second key.
In addition, the first receiver may also check that the first digital license is valid at the server, send the first ciphertext of the second sub-key to the server, decrypt the first ciphertext of the second sub-key with the first key at the server to obtain the second sub-key, encrypt the second sub-key with the public key of the first receiver, and return the encrypted second sub-key to the first receiver.
In the embodiments of the present invention, after the sender generates the first digital license for the first receiver in the first hardware array of the server, the sender may send the identification information of the first digital license to the first receiver. When the first receiver sends a key use request to the server to request to use the first key, the first receiver may carry identification information of the first digital license in the key use request, so that the server searches whether the first digital license associated with the first key requested to be used by the first receiver exists in the first hardware array based on the identification information. In addition to this, the server may assign additional identification information to the sender for digital licenses generated by different recipients and return to the sender, and the first recipient may request use of the first key from the server based on this identification information obtained from the sender.
An embodiment of the present invention further provides a data forwarding apparatus, which may be implemented by a terminal device including a processor and a memory, where the processor may be configured to execute a predetermined computer instruction stored in the memory to execute the data protection method applied to the receiver client in any of the foregoing embodiments.
Claims (13)
1. A data protection method is applied to a client side of a sending party, and the method comprises the following steps:
logging in a server, generating and storing a first key in a first hardware array arranged at the server, and generating and storing a first digital license for a first receiver in the first hardware array;
encrypting data to generate a first data ciphertext, and sending the first data ciphertext to a first receiver, wherein the first key is a key required by decryption of the first data ciphertext;
wherein the first data cipher text is obtained by encrypting the data with a second key, the method further comprising:
combining the first sub-key and the second sub-key into the second key, wherein the second key is used for decrypting the first ciphertext;
encrypting the first sub-key by using a first receiver public key to generate a first sub-key first ciphertext;
sending the first cipher text of the first sub-key to a first receiver;
the second sub-key is the first key.
2. The method of claim 1, wherein the second subkey is a random number generated in the first hardware array.
3. The method of claim 1, further comprising:
the identification information for the first digital license is sent to the first recipient.
4. A data protection apparatus comprising a processor, wherein the processor executes predetermined computer instructions to perform a data protection method according to any one of claims 1 to 3.
5. A data protection method is applied to a server side, the server side is provided with a hardware array, and the method comprises the following steps:
generating and storing a first key in a first hardware array based on a first service request received from a sender, and generating and storing a first digital license to the first key in the first hardware array for a first recipient;
when a key use request of a first receiver is received, checking whether a first digital license stored in the first hardware array is in a valid state, if so, allowing the first receiver to use the first key when decrypting a first data ciphertext obtained from the sender, otherwise, forbidding the first receiver to use the first key;
wherein allowing the first receiver to use the first key in decrypting the first data cipher text obtained from the sender comprises:
and encrypting the first key by using a first receiver public key in the first hardware array and then sending the encrypted first key to the first receiver so that the first receiver combines the first sub-key and the first key into a second key for decrypting the first data ciphertext based on the first key.
6. The method of claim 5, wherein the first key is a random number generated in the first hardware array.
7. The method of claim 5, wherein the key use request includes identification information for the first digital license, the method further comprising:
determining the first digital license to check in the first hardware array based on the identification information of the first digital license.
8. A data protection apparatus comprising a processor, wherein the processor executes predetermined computer instructions to perform a data protection method according to any one of claims 5 to 7.
9. A data protection method is applied to a receiver client, and comprises the following steps:
when receiving a first data ciphertext from a sender, sending a key use request for a first key to a server to trigger the server to check whether a first digital license for the first key, which is generated for a first receiver by the sender, is in a valid state in a first hardware array arranged in the server based on the key use request;
when the server checks that the first digital license in the first hardware array is in a valid state, using the first key stored in the first hardware array in decrypting a first data ciphertext;
receiving a first sub-key first ciphertext from a sender, decrypting the first sub-key first ciphertext with a first receiver private key to obtain a first sub-key,
wherein using the first key stored in the first hardware array in decrypting a first data cipher text comprises: the method comprises the steps of receiving a first secret key first ciphertext from a server, decrypting the first secret key first ciphertext by using a first receiver private key to obtain a first secret key, combining a first sub-secret key and the first secret key into a second secret key for decrypting a first data ciphertext, and encrypting the first secret key first ciphertext by the server in a first hardware array by using a first receiver public key.
10. The method of claim 9, further comprising:
receiving a second key first cipher text from the sender,
wherein using the first key stored in the first hardware array in decrypting a first data cipher text comprises: sending the first ciphertext of the second key to the server and receiving the second ciphertext of the second key from the server, decrypting the second ciphertext of the second key with the private key of the first receiver to obtain a second key for decrypting the first data ciphertext,
the second key second ciphertext is obtained by encrypting a second key by the server side in the first hardware array by using a first receiver public key, and the second key is obtained by decrypting the second key first ciphertext by the server side in the first hardware array by using the first key.
11. The method of claim 9, further comprising:
receiving a first sub-key first ciphertext and a second sub-key first ciphertext from a sender, decrypting the first sub-key first ciphertext with a first receiver private key to obtain a first sub-key,
wherein using the first key stored in the first hardware array in decrypting a first data cipher text comprises: sending the first ciphertext of the second sub-key to the server and receiving the second ciphertext of the second sub-key from the server, decrypting the second ciphertext of the second sub-key with a private key of a first receiver to obtain a second sub-key, combining the first sub-key and the second sub-key into a second key for decrypting the first data ciphertext,
the second sub-key second ciphertext is obtained by encrypting a second sub-key by using a first receiver public key in the first hardware array through the server, and the second sub-key is obtained by decrypting a second sub-key first ciphertext by using the first key in the first hardware array through the server.
12. The method of claim 9, wherein the key use request includes identification information of a first digital license for a server side to determine the first digital license to check in the first hardware array based on the identification information of the first digital license.
13. A data protection apparatus comprising a processor, wherein the processor executes predetermined computer instructions to perform a data protection method as claimed in any one of claims 9 to 12.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810097277.9A CN108199838B (en) | 2018-01-31 | 2018-01-31 | Data protection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810097277.9A CN108199838B (en) | 2018-01-31 | 2018-01-31 | Data protection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108199838A CN108199838A (en) | 2018-06-22 |
| CN108199838B true CN108199838B (en) | 2020-05-05 |
Family
ID=62591706
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810097277.9A Active CN108199838B (en) | 2018-01-31 | 2018-01-31 | Data protection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108199838B (en) |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110536287B (en) * | 2019-02-26 | 2024-04-05 | 中兴通讯股份有限公司 | Forward safety implementation method and device |
| CN109934013B (en) * | 2019-03-21 | 2021-01-08 | 北京纬百科技有限公司 | Data protection method and device |
| CN112671534B (en) * | 2020-12-18 | 2022-02-01 | 北京深思数盾科技股份有限公司 | Service key management method, service terminal and system based on biological characteristics |
| WO2022121940A1 (en) * | 2020-12-09 | 2022-06-16 | 北京深思数盾科技股份有限公司 | Information processing method for service key, and serving end and system |
| CN112597524B (en) * | 2021-03-03 | 2021-05-18 | 支付宝(杭州)信息技术有限公司 | Privacy intersection method and device |
Family Cites Families (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7543140B2 (en) * | 2003-02-26 | 2009-06-02 | Microsoft Corporation | Revocation of a certificate and exclusion of other principals in a digital rights management (DRM) system based on a revocation list from a delegated revocation authority |
| JP5084592B2 (en) * | 2008-04-17 | 2012-11-28 | 株式会社リコー | Information processing device, electronic certificate issuing method, and program |
| US8935528B2 (en) * | 2008-06-26 | 2015-01-13 | Microsoft Corporation | Techniques for ensuring authentication and integrity of communications |
| CN103701594A (en) * | 2014-01-03 | 2014-04-02 | 天地融科技股份有限公司 | Data transmission method and system |
| CN106506470B (en) * | 2016-10-31 | 2018-07-27 | 大唐高鸿信安（浙江）信息科技有限公司 | network data security transmission method |
| CN107070879B (en) * | 2017-02-15 | 2018-12-07 | 北京深思数盾科技股份有限公司 | Data guard method and system |
-
2018
- 2018-01-31 CN CN201810097277.9A patent/CN108199838B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN108199838A (en) | 2018-06-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108199838B (en) | Data protection method and device | |
| US11146391B2 (en) | Orthogonal access control for groups via multi-hop transform encryption | |
| KR100734162B1 (en) | Method and apparatus for secure distribution of public/private key pairs | |
| US11063754B2 (en) | Systems, devices, and methods for hybrid secret sharing | |
| US10594472B2 (en) | Hybrid fully homomorphic encryption (F.H.E.) systems | |
| US7725716B2 (en) | Methods and systems for encrypting, transmitting, and storing electronic information and files | |
| US20170244687A1 (en) | Techniques for confidential delivery of random data over a network | |
| CN103259651B (en) | A kind of method and system to terminal data encryption and decryption | |
| US20120254622A1 (en) | Secure Access to Electronic Devices | |
| US8904195B1 (en) | Methods and systems for secure communications between client applications and secure elements in mobile devices | |
| US20180063105A1 (en) | Management of enciphered data sharing | |
| CN109379345B (en) | Sensitive information transmission method and system | |
| Chidambaram et al. | Enhancing the security of customer data in cloud environments using a novel digital fingerprinting technique | |
| CN114826702A (en) | Database access password encryption method and device and computer equipment | |
| EP2892206B1 (en) | System and method for push framework security | |
| US10699021B2 (en) | Method and a device for secure storage of at least one element of digital information, and system comprising such device | |
| Poduval et al. | Cloud based secure storage of files using hybrid cryptography and image steganography | |
| JP2006279269A (en) | Information management device, information management system, network system, user terminal, and their programs | |
| US20220006795A1 (en) | Secure message passing using semi-trusted intermediaries | |
| Kaushik et al. | Secure cloud data using hybrid cryptographic scheme | |
| KR20190115489A (en) | IOT equipment certification system utilizing security technology | |
| Gharjale et al. | Efficient public key cryptosystem for scalable data sharing in Cloud storage | |
| CA3104787C (en) | Secure message passing using semi-trusted intermediaries | |
| Reddy et al. | Data Storage on Cloud using Split-Merge and Hybrid Cryptographic Techniques | |
| Ghorpade et al. | Notice of Violation of IEEE Publication Principles: Towards Achieving Efficient and Secure Way to Share the Data |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CP01 | Change in the name or title of a patent holder | ||
| CP01 | Change in the name or title of a patent holder |
Address after: 100193 5th floor 510, No. 5 Building, East Yard, No. 10 Wangdong Road, Northwest Haidian District, Beijing Patentee after: Beijing Shendun Technology Co.,Ltd. Address before: 100193 5th floor 510, No. 5 Building, East Yard, No. 10 Wangdong Road, Northwest Haidian District, Beijing Patentee before: BEIJING SENSESHIELD TECHNOLOGY Co.,Ltd. |