CN111371813B - Big data network data protection method and system based on edge calculation - Google Patents

Big data network data protection method and system based on edge calculation Download PDF

Info

Publication number
CN111371813B
CN111371813B CN202010465323.3A CN202010465323A CN111371813B CN 111371813 B CN111371813 B CN 111371813B CN 202010465323 A CN202010465323 A CN 202010465323A CN 111371813 B CN111371813 B CN 111371813B
Authority
CN
China
Prior art keywords
client
user
response
encryption
result
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202010465323.3A
Other languages
Chinese (zh)
Other versions
CN111371813A (en
Inventor
胡俊
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hangzhou Canba Technology Co ltd
Original Assignee
Hangzhou Canba Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hangzhou Canba Technology Co ltd filed Critical Hangzhou Canba Technology Co ltd
Priority to CN202010465323.3A priority Critical patent/CN111371813B/en
Publication of CN111371813A publication Critical patent/CN111371813A/en
Priority to JP2020132747A priority patent/JP6893626B1/en
Application granted granted Critical
Publication of CN111371813B publication Critical patent/CN111371813B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/12—Details relating to cryptographic hardware or logic circuitry

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer And Data Communications (AREA)
  • Storage Device Security (AREA)

Abstract

The invention discloses a big data network data protection method and a system based on edge calculation, which comprises the following steps: s1, determining the computing power level of the client; s2, determining the encryption strength of the data; s3, judging whether the computing power level of the client can meet the encryption strength requirement, if so, executing a step S4, and if not, executing a step S5; s4, slowly encrypting the plaintext password to obtain a first temporary password, and executing the step S8; s5, the application server selects a plurality of other connected clients and sends the plaintext passwords, the salt and the encryption strength to the selected clients; s6, the selected client performs slow encryption on the plaintext password to obtain a second temporary password; s7, the application server determines a first temporary password based on the received plurality of second temporary passwords; s8, the server carries out fast encryption on the first temporary password to obtain an encrypted password, and the user name, the salt and the encrypted password are stored. The invention realizes effective balance between safety protection and calculation performance, and has high data security.

Description

Big data network data protection method and system based on edge calculation
Technical Field
The invention relates to the technical field of network security, in particular to a big data network data protection method and system based on edge computing.
Background
With the wider application range of computer network technology, global informatization is rapidly developed, information content is deeply permeated in various fields, the world view of people is changed due to the background environment of big data, the life of people is remarkably changed due to the arrival of the big data era, people have new opinions on the world, particularly the application and effective integrated data of the computer network technology in the data era, the information processing speed is accelerated, and meanwhile, information is obtained through statistics better and faster. With the popularization of computer technology, data security becomes an increasingly prominent problem.
The safety of sensitive data (such as financial statements and the like) and various account numbers (such as mailbox account numbers and passwords, account numbers and passwords of online banks, account numbers and passwords of online stock transactions and the like) and the like are closely related to users, and as the processing capacity of a computer is greatly improved, events such as library dragging, library washing, library collision, library removal and the like are frequent. The database collision is that an attacker generates a corresponding dictionary table by collecting the user and password information which are leaked from the internet, and obtains a series of users which can log in after trying to log in other websites in batch. The database dragging and the database dropping are both behaviors that an attacker invades a valuable network site and steals all the data databases of registered users. After dragging the library, after taking a large amount of user data, an attacker can turn out valuable user data through a series of technical means and black industry chains, which is also commonly referred to as "library washing". Finally, the attacker tries to log in the obtained data on other websites, and the data is called as a database collision.
Obviously, if the system directly stores the plaintext data of the user, if the whole database is downloaded once the database is dragged by an attacker, the attacker can log in any account to perform dangerous operations, even accidents which cannot be compensated. Most websites encrypt and store password information in a database, MD5 is common encryption, the mode is theoretically irreversible, but the mode is still unsafe, the original password can be deduced as long as all common passwords are enumerated and made into an index table, and the plaintext decoding speed is high.
Based on this, the prior art proposes that attacks such as a dragged library and the like are resisted in a salt adding mode, the cracking difficulty of an attacker is increased, an encryption event is improved in a mode of combining slow encryption and fast encryption, and correspondingly, the difficulty and time for the attacker to crack the password are greatly increased.
The method for protecting the network data can greatly improve the security of the data, but the calculation processing amount is large when the data is encrypted, and a large amount of calculation resources are consumed. In addition, the data volume is suddenly increased, and if all the calculations are completed on the basis of the server side, the server is heavy in load, and system crash is easily caused. With the increase of the processing capability of the personal terminal device, it is increasingly feasible to implement encryption processing of data based on edge calculation. However, data protection requirements and computing capabilities of different users and different terminal devices are different, and how to implement edge-computing-based big data network data protection for different protection requirements and terminal devices is a problem to be solved in the field.
Disclosure of Invention
The invention aims to provide a big data network data protection method and system based on edge calculation aiming at the defects of the prior art. According to the invention, different data are slowly encrypted according to different data protection requirements and different operational capacities of different users and different terminal devices, so that effective balance between safety protection and computing performance is realized, and the data security is high.
In order to achieve the purpose, the invention adopts the following technical scheme:
a big data network data protection method based on edge calculation comprises the following steps:
s1, determining the computing capacity level of the client based on the basic information of the client;
s2, determining the encryption strength of the data according to the application type and the encryption strength strategy of the connection;
s3, randomly generating salt, judging whether the computing power level of the client can meet the encryption strength requirement, if so, executing a step S4, and if not, executing a step S5;
s4, slowly encrypting the plaintext password input by the user to obtain a first temporary password, and sending the user name, the salt and the first temporary password to the application server; step S8 is executed;
s5, sending the user name, the plaintext password, the salt and the encryption strength input by the user to an application server side, selecting a plurality of other connected client sides by the application server, and sending the plaintext password, the salt and the encryption strength input by the user to the selected client sides;
s6, the selected client performs slow encryption on the plaintext password input by the user to obtain a second temporary password, and the second temporary password is sent to the application server;
s7, the application server determines a first temporary password based on the received plurality of second temporary passwords;
s8, the server carries out fast encryption on the first temporary password to obtain an encrypted password, and the user name, the salt and the encrypted password are stored.
Further, the step S1 includes:
the weights for setting the clock frequency, the word length, the kernel number and the memory capacity are sequentially
Figure 100002_DEST_PATH_IMAGE001
、
Figure 677777DEST_PATH_IMAGE002
、
Figure 100002_DEST_PATH_IMAGE003
、
Figure 188392DEST_PATH_IMAGE004
Wherein
Figure 100002_DEST_PATH_IMAGE005
the calculation capability value of the client is as follows:
Figure 564534DEST_PATH_IMAGE006
wherein,
Figure 100002_DEST_PATH_IMAGE007
、
Figure 553219DEST_PATH_IMAGE008
、
Figure DEST_PATH_IMAGE009
、
Figure 429908DEST_PATH_IMAGE010
the values of clock frequency, word length, kernel number and memory capacity are respectively;
and classifying the client side to the corresponding computing capacity grade based on the computing capacity value according to the preset computing capacity grade and the corresponding computing capacity value range.
Further, the encryption strength is the number of times of loop iteration encryption, and the encryption strength policy is: setting an encryption intensity range for each type of application by a user; the step S2 includes:
judging the application type of the connection, calling a user encryption strength strategy stored in advance locally at the client, determining a corresponding encryption strength range according to the application type, and randomly selecting any encryption strength value in the encryption strength range as the encryption strength of the data.
Further, the step S7 includes:
the server counts the number of the clients corresponding to the returned second temporary passwords, judges whether the number of the clients corresponding to the second temporary passwords is parallel to the first number, and selects the second temporary password with the largest number of the clients as the first temporary password if the number of the clients corresponding to the second temporary passwords is not parallel to the first number; if so, selecting a second temporary password returned by a client with the highest trust value in the clients corresponding to the parallel first second temporary password as the first temporary password; and when the second temporary password returned by the client is consistent with the first temporary password, the response result of the client is correct, otherwise, the response result of the client is wrong.
Further, the trust value is adjusted by the server according to whether the response result of the client is correct or not; the initial trust value of the client when registering in the server is
Figure 100002_DEST_PATH_IMAGE011
；
For the mth result response of the client, if the response result is correct, the adjustment value of the trust value of the user client is as follows:
Figure 100002_DEST_PATH_IMAGE012
wherein,
Figure 100002_DEST_PATH_IMAGE013
with the adjusted value of the client trust value when the result of the mth response is correct,
Figure 377005DEST_PATH_IMAGE014
the number of times that the response result is correct in the M responses,
Figure 100002_DEST_PATH_IMAGE015
a unit adjustment value of the trust value when the response result is correct;
therefore, the trust value after the user M-th result response is correct is as follows:
Figure 706355DEST_PATH_IMAGE016
wherein,
Figure 100002_DEST_PATH_IMAGE017
for the trust value after the mth result response of the user,
Figure 701993DEST_PATH_IMAGE018
the trust value after the M-1 result response of the user;
for the Mth result response of the user client, if the response result is wrong, the adjustment value of the trust value of the user client is as follows:
Figure DEST_PATH_IMAGE019
wherein,
Figure 433188DEST_PATH_IMAGE020
an adjustment value for the client trust value when the result of the mth response is false,
Figure DEST_PATH_IMAGE021
the number of response result errors in M responses,
Figure 237938DEST_PATH_IMAGE022
a unit adjustment value for the trust value in response to a result error,
Figure DEST_PATH_IMAGE023
；
therefore, the trust value after the user's mth result response error is:
Figure 54584DEST_PATH_IMAGE024
wherein,
Figure 322755DEST_PATH_IMAGE017
for the trust value after the mth result response of the user,
Figure 377298DEST_PATH_IMAGE018
the trust value after the M-1 result response of the user;
for the first response of the user, when the response result is correct, the adjustment value of the client trust value is
Figure DEST_PATH_IMAGE025
Then the adjusted client trust value is
Figure 603880DEST_PATH_IMAGE026
(ii) a When the result of the response is wrong, the adjustment value of the client trust value is
Figure DEST_PATH_IMAGE027
Then the adjusted client trust value is
Figure 173402DEST_PATH_IMAGE028
。
The invention also provides a big data network data protection system based on edge calculation, which comprises:
the first determining module is used for determining the computing capacity level of the client based on the basic information of the client;
the second determining module is used for determining the encryption strength of the data according to the connected application type and the encryption strength strategy;
the judging module is used for randomly generating salt, judging whether the computing capability level of the client can meet the encryption strength requirement, if so, calling the local encryption module, and if not, calling the selecting module;
the local encryption module is used for slowly encrypting a plaintext password input by a user to obtain a first temporary password and sending the user name, the salt and the first temporary password to the application server; calling a storage module;
the selection module is used for sending the user name, the plaintext password, the salt and the encryption strength input by the user to the application server side, the application server selects a plurality of other connected client sides, and the plaintext password, the salt and the encryption strength input by the user are sent to the selected client sides;
the collaborative encryption module is used for the selected client to slowly encrypt the plaintext password input by the user to obtain a second temporary password and send the second temporary password to the application server;
a third determining module, configured to determine, by the application server, the first temporary password based on the received plurality of second temporary passwords;
and the storage module is used for the server to quickly encrypt the first temporary password to obtain an encrypted password and store the user name, the salt and the encrypted password.
Further, the first determining module comprises:
the weights for setting the clock frequency, the word length, the kernel number and the memory capacity are sequentially
Figure 245263DEST_PATH_IMAGE001
、
Figure DEST_PATH_IMAGE029
、
Figure 216630DEST_PATH_IMAGE003
、
Figure 82955DEST_PATH_IMAGE004
Wherein
Figure 343035DEST_PATH_IMAGE030
the calculation capability value of the client is as follows:
Figure 953008DEST_PATH_IMAGE006
wherein,
Figure 716565DEST_PATH_IMAGE007
、
Figure DEST_PATH_IMAGE031
、
Figure 819037DEST_PATH_IMAGE009
、
Figure 300834DEST_PATH_IMAGE010
the values of clock frequency, word length, kernel number and memory capacity are respectively;
and classifying the client side to the corresponding computing capacity grade based on the computing capacity value according to the preset computing capacity grade and the corresponding computing capacity value range.
Further, the encryption strength is the number of times of loop iteration encryption, and the encryption strength policy is: setting an encryption intensity range for each type of application by a user; the second determining module includes:
judging the application type of the connection, calling a user encryption strength strategy stored in advance locally at the client, determining a corresponding encryption strength range according to the application type, and randomly selecting any encryption strength value in the encryption strength range as the encryption strength of the data.
Further, the third determining module comprises:
the server counts the number of the clients corresponding to the returned second temporary passwords, judges whether the number of the clients corresponding to the second temporary passwords is parallel to the first number, and selects the second temporary password with the largest number of the clients as the first temporary password if the number of the clients corresponding to the second temporary passwords is not parallel to the first number; if so, selecting a second temporary password returned by a client with the highest trust value in the clients corresponding to the parallel first second temporary password as the first temporary password; and when the second temporary password returned by the client is consistent with the first temporary password, the response result of the client is correct, otherwise, the response result of the client is wrong.
Further, the trust value is adjusted by the server according to whether the response result of the client is correct or not; the initial trust value of the client when registering in the server is
Figure 714498DEST_PATH_IMAGE032
；
For the mth result response of the client, if the response result is correct, the adjustment value of the trust value of the user client is as follows:
Figure 598140DEST_PATH_IMAGE012
wherein,
Figure DEST_PATH_IMAGE033
with the adjusted value of the client trust value when the result of the mth response is correct,
Figure 603006DEST_PATH_IMAGE034
the number of times that the response result is correct in the M responses,
Figure 572099DEST_PATH_IMAGE035
a unit adjustment value of the trust value when the response result is correct;
therefore, the trust value after the user M-th result response is correct is as follows:
Figure 258295DEST_PATH_IMAGE036
wherein,
Figure 262023DEST_PATH_IMAGE017
for the trust value after the mth result response of the user,
Figure 172210DEST_PATH_IMAGE018
the trust value after the M-1 result response of the user;
for the Mth result response of the user client, if the response result is wrong, the adjustment value of the trust value of the user client is as follows:
Figure 363020DEST_PATH_IMAGE019
wherein,
Figure 118486DEST_PATH_IMAGE020
an adjustment value for the client trust value when the result of the mth response is false,
Figure 711142DEST_PATH_IMAGE021
the number of response result errors in M responses,
Figure 526651DEST_PATH_IMAGE022
a unit adjustment value for the trust value in response to a result error,
Figure DEST_PATH_IMAGE037
；
therefore, the trust value after the user's mth result response error is:
Figure 4424DEST_PATH_IMAGE024
wherein,
Figure 563582DEST_PATH_IMAGE017
for the trust value after the mth result response of the user,
Figure 10744DEST_PATH_IMAGE018
the trust value after the M-1 result response of the user;
for the first response of the user, when the response result is correct, the adjustment value of the client trust value is
Figure 731575DEST_PATH_IMAGE038
Then the adjusted client trust value is
Figure DEST_PATH_IMAGE039
(ii) a When the result of the response is wrong, the adjustment value of the client trust value is
Figure 693715DEST_PATH_IMAGE040
Then the adjusted client trust value is
Figure 100002_DEST_PATH_IMAGE041
。
Compared with the prior art, the invention has the following advantages:
1. the invention provides a data protection method and a data protection system based on edge calculation, aiming at the problem of large data calculation amount in a big data network. The client is used as an edge node, the computing capacity of the client is fully utilized, slow encryption is carried out by adopting the client in the data protection process, and the problems that the server is large in computing burden and easy to crash are effectively avoided;
2. different users set different encryption strengths according to different application types, so that the problem of unnecessary calculation processing expense caused by overhigh encryption strength is avoided, and effective balance between data security and system expense is realized;
3. the computing capacity of the client is quantitatively evaluated, whether the local client performs slow encryption is determined according to the encryption strength requirement and whether the computing capacity is matched, and the local slow encryption is performed only during matching, so that the problems of too low processing speed and too much reduced client performance are avoided;
4. the method screens results returned by other clients, quantitatively evaluates the trust value of the client, and simultaneously, the influence of the trust value caused by wrong response is larger than that caused by correct response, thereby avoiding malicious users from returning wrong results and further improving the safety of data; meanwhile, an incentive mechanism corresponding to the trust value is set, so that the enthusiasm of the user for participating in slow encryption calculation is improved, the response behavior of the user is restrained, and the safety of the system is improved;
5. the method is based on the modes of slow encryption at the client side and fast encryption at the server side, so that the attack cost of an attacker for acquiring data is greatly increased, and the data protection is strong.
Drawings
FIG. 1 is a flowchart of a big data network data protection method based on edge computing according to an embodiment;
fig. 2 is a block diagram of a big data network data protection system based on edge computing according to the second embodiment.
Detailed Description
The embodiments of the present invention are described below with reference to specific embodiments, and other advantages and effects of the present invention will be easily understood by those skilled in the art from the disclosure of the present specification. The invention is capable of other and different embodiments and of being practiced or of being carried out in various ways, and its several details are capable of modification in various respects, all without departing from the spirit and scope of the present invention. It is to be noted that the features in the following embodiments and examples may be combined with each other without conflict.
It should be noted that the drawings provided in the following embodiments are only for illustrating the basic idea of the present invention, and the components related to the present invention are only shown in the drawings rather than drawn according to the number, shape and size of the components in actual implementation, and the type, quantity and proportion of the components in actual implementation may be changed freely, and the layout of the components may be more complicated.
The invention is further described with reference to the following drawings and specific examples, which are not intended to be limiting.
Example one
As shown in fig. 1, the present embodiment provides a method for protecting big data network data based on edge computing, and in particular, a method for encrypting private data such as a user password, including:
s1, determining the computing capacity level of the client based on the basic information of the client;
in order to overcome the problem of server overload in the data protection method based on the server, the data protection method based on the client side performs partial data protection calculation so as to effectively reduce the processing expense of the server side. With the popularization of terminal equipment and the development of the future internet of things, the terminal equipment is becoming more and more diversified, and the performance on a client is stronger and stronger, so that the migration of part of computing tasks from a server to a mobile terminal is possible. Therefore, the client serves as an edge node, partial data protection calculation is realized by utilizing edge calculation, and the client and the server realize protection of user data together. The edge calculation is a distributed calculation structure, which moves the calculation of application program, data and service from the central node of the network to the edge node of the network logic for processing.
The client includes a personal computer, a mobile phone, a personal palm computer, etc., which is not limited herein. When a client is used as an edge node to perform data protection encryption calculation, the calculation capacities of different clients are different, and when the calculation capacity of a user cannot meet the corresponding encryption requirement, encryption protection cannot be performed based on the client obviously. Therefore, the invention firstly determines the computing capacity of the client based on the basic information of the client to decide whether to carry out data encryption protection based on the edge node.
Client configuration information related to computing power typically includes clock frequency, word length, number of cores, memory capacity, and the like. The clock frequency refers to the number of pulses sent by a computer CPU in unit time, the word length refers to the number of bits of binary data which can be simultaneously processed by an arithmetic element of the computer, the number of cores refers to the number of arithmetic units and controllers for executing instructions in the CPU, and the memory capacity refers to the total number of bytes of information stored in an internal memory. Generally, the higher the clock frequency, the larger the word length, the larger the number of cores, and the larger the memory capacity, the faster the operation speed of the client, and the stronger the corresponding computing capability.
In order to determine the computing power of the client, the invention sets different weights for the client configuration information related to the computing power, for example, the weights of the clock frequency, the word length, the kernel number and the memory capacity are set to
Figure 56563DEST_PATH_IMAGE001
、
Figure 889390DEST_PATH_IMAGE029
、
Figure 781122DEST_PATH_IMAGE003
、
Figure 699400DEST_PATH_IMAGE004
Wherein
Figure 600360DEST_PATH_IMAGE030
the calculation capability value of the client is as follows:
Figure 22114DEST_PATH_IMAGE006
wherein,
Figure 84748DEST_PATH_IMAGE007
、
Figure 224742DEST_PATH_IMAGE031
、
Figure 929393DEST_PATH_IMAGE009
、
Figure 471233DEST_PATH_IMAGE042
the values of clock frequency, word length, kernel number, and memory capacity are provided. Different configuration information may have different weights, for example, the clock frequency largely determines the computing power of the client, and thus the clock frequency has the greatest weight.
Further, based on the calculated computing power values, the present invention classifies different clients into corresponding computing power levels, for example, the present invention sets the computing power levels of the clients to I level, II level, III level, IV level, and V level. Different calculation capability levels correspond to different calculation capability value ranges, and in general, the higher the calculation capability value is, the higher the corresponding calculation capability level is, and the faster the calculation speed is.
It should be noted that the computation power calculation based on the clock frequency, word length, kernel number and memory capacity is only an exemplary illustration, and the computation power calculation including the basic information of other clients is similar and not limited herein. In addition, in order to reduce the processing expense of the client, the computing power level of the client is only calculated once, after the first calculation is completed, the computing power level is stored in the client as public information, and when the client is required to be used as an edge node to perform encryption protection calculation, the corresponding computing power level is directly obtained at the client.
S2, determining the encryption strength of the data according to the application type and the encryption strength strategy of the connection;
in the process of data encryption protection, the greater the encryption strength is, the higher the data security is, but the greater the corresponding processing cost is. Therefore, the present invention effectively balances safety and processing costs. In practical applications, users need different security for cryptographic data in different applications. For example, for login passwords for online banking, high security is generally required to protect the property of the user. And for the login password on the video website, high security is not required. Therefore, in the invention, different users set different encryption strengths for different application types.
Specifically, the application types are divided into finance types, shopping types, medical health types, video types, life service types and the like, and the user sets corresponding encryption strength for each type of application according to the requirement of the user. The finance category comprises a payment treasure, a mobile phone bank, an online bank and the like, the shopping category comprises a treasure, a Jingdong and the like, the video category comprises an Tengcong video, an Aiqiyi video, a Youkou video and the like, the life service category comprises a drip, a Mei take-out and the like, and the medical health category comprises a hospital registration platform, an online medical consultation platform and the like.
In the invention, the encrypted result is re-encrypted at the edge node, and the cyclic iteration is performed for m times, so that the difficulty of brute force cracking of an attacker is improved. That is, the strength of data encryption is related to the number of times the iterative encryption is cycled. Therefore, the data encryption strength applied by each category corresponds to the corresponding cycle iteration number range.
For example, the user sets an encryption strength policy in advance, and sets the encryption strength corresponding to the financial application to [100000,90000], the encryption strength corresponding to the shopping application to [80000,70000], the encryption strength corresponding to the medical and health application to [75000,60000], the encryption strength corresponding to the video application to [20000,10000], and the encryption strength corresponding to the life service application to [50000,40000 ].
When a user registers or logs in to use a certain application through a website or an application program, firstly, the application type of the website or the application program is judged, a user encryption intensity strategy locally stored in advance at a client side is called, a corresponding encryption intensity range is determined according to the application type, and any encryption intensity value in the encryption intensity range is randomly selected to serve as the encryption intensity of the data.
S3, randomly generating salt, judging whether the computing power level of the client can meet the encryption strength requirement, if so, executing a step S4, and if not, executing a step S5;
in order to resist cracking methods such as a violent exhaustive dictionary, different salt values are introduced for different users in the encryption process. By inserting a specific character string at an arbitrarily fixed position of the privacy password, the hashed result is not matched with the hashed result using the original password, and the process is called salting. Therefore, before the data protection encryption is performed on the edge node, each user client randomly generates a salt at first, so that the security of the data encryption is improved.
As described above, when the computing power of the user cannot meet the corresponding encryption requirement, it is obviously impossible to perform encryption protection based on the client, because when the computing power does not meet the encryption strength requirement, a large amount of time is required to complete the corresponding encryption strength, the user has a long waiting time, and the user experience is greatly reduced. Therefore, in the edge node data protection process provided by the invention, whether the computing capability of the current client can meet the encryption strength requirement is judged, if so, the current client directly performs protection encryption computation, and if not, the local client does not perform protection encryption computation any more, so that poor user experience is avoided.
The encryption strength range which can be realized by each computing power level is firstly determined, specifically, the encryption strength range can be realized by counting a large number of clients, and can also be realized by a machine learning mode, and the encryption strength range is not limited herein. And determining the encryption strength range which can be realized by the client according to the computing power level of the client, and when the data encryption strength of the time belongs to the encryption strength range which can be realized by the client, indicating that the computing power of the current client can meet the encryption requirement, otherwise, not meeting the encryption requirement.
S4, slowly encrypting the plaintext password input by the user to obtain a first temporary password, and sending the user name, the salt and the first temporary password to the application server; step S8 is executed;
the invention adopts PBKDF2 or bcrypt and other slow encryption algorithms to encrypt the plaintext password. The slow hash encryption is to increase the encryption time to correspondingly increase the cracking time and difficulty. The time for password cracking and the encryption algorithm are directly related, for example, the MD5 encryption is very fast, the encryption takes 1 microsecond, when the code is cracked, a phrase is guessed at anytime, only 1 microsecond is needed, and an attacker can guess 100 ten thousand in one second. If the encryption is increased to 10 milliseconds at a time, an attacker can only guess 100 in a second, and the cracking speed is ten thousand times slower. There are two methods for increasing the encryption time, namely, multiple encryption and increasing the complexity of the encryption algorithm.
Taking PBKDF2 as an example, the PBKDF2 function is defined as DK = PBKDF2(PRF, Password, Salt, c, dkLen), where PRF is a pseudo-random function, such as a HASH _ HMAC function, that outputs a result of length hLen. Password is the plaintext cipher used to generate the key. Salt is a Salt value for encryption. c is the number of times of repeated calculation, which is the determined encryption strength of the data this time in the invention. dkLen is the length of the key that is expected to be obtained. The DK is the last generated key.
When the computing capacity of the current client can meet the requirement of encryption strength, the client generates a first temporary password through loop iteration according to the salt and the encryption strength which are generated randomly and the password of the website or the application program input by the user, and sends the user name, the salt and the first temporary password to the application server so that the server can verify the next login of the user. At the moment, the server side does not receive and store the plaintext password, only can acquire the first temporary password after slow encryption, and can effectively resist the attacks such as library dragging and the like.
S5, sending the user name, the plaintext password, the salt and the encryption strength input by the user to an application server side, selecting a plurality of other connected client sides by the application server, and sending the plaintext password, the salt and the encryption strength input by the user to the selected client sides;
when the computing power of the current client cannot meet the encryption strength requirement, no protection encryption calculation is carried out at the client. At this time, the current client sends the user name, the plaintext password, the salt and the encryption strength corresponding to the user to the application server. Meanwhile, in order to avoid the excessive processing burden of the server, after receiving the plaintext password of the user, the server does not perform corresponding slow encryption, but selects a plurality of clients connected with the server to perform slow encryption. Because malicious edge nodes may exist, the invention selects a plurality of edge clients to perform encryption calculation at the same time, thereby avoiding the problems that the malicious edge nodes do not return results, the estimation calculation is wrong and the like.
Specifically, the server determines the computing power level corresponding to the encryption strength according to the encryption strength, and the computing power level of the client is public, so that the application server selects a plurality of clients of which the computing power levels meet the computing power level requirement corresponding to the encryption strength, and the selected clients provide corresponding slow encryption services. Correspondingly, the plaintext password, the salt and the encryption strength input by the user are sent to the selected client side, so that the selected client side can provide slow encryption service for improvement.
It is worth noting that when the server transmits the plaintext password information to the selected client, the server discards the plaintext password of the user and does not store the plaintext password in the server, so as to effectively avoid the attack of an attacker. For the client, although the client acquires the plaintext password, the client does not use the username information, so that the plaintext password cannot be effectively associated with the user, and the password information of the user cannot be cracked.
S6, the selected client performs slow encryption on the plaintext password input by the user to obtain a second temporary password, and the second temporary password is sent to the application server;
after receiving the encryption request sent by the server, the selected client can autonomously select whether to respond to the encryption request. When the encryption request is not responded to, the encryption request is ignored and the request is not responded to. And when the encryption request is responded, slow encryption is carried out by adopting a slow encryption algorithm which is the same as that of the local client side, so that a second temporary password is obtained. The process of slow encryption is similar to step S4 and will not be described in detail herein.
S7, the application server determines a first temporary password based on the received plurality of second temporary passwords;
as described above, an edge client may have a malicious node, and thus, the returned results of the clients may be different. Therefore, when the server receives a plurality of second temporary passwords, the server needs to filter the second temporary passwords to determine the last first temporary password.
Specifically, the server counts the number of clients corresponding to each returned second temporary password, and selects the second temporary password with the largest number of clients as the first temporary password. For example, when the second temporary passwords selected by the 6 clients A, B, C, D, E, F are respectively X1、X2、X3、X2、X3、X3The server counts X1The number of corresponding clients is 1, X2The number of corresponding clients is 2, X3The corresponding client number is 3, and X is returned3Is the largest, so X is3As the first temporary password to be finally determined.
And when the number of the clients corresponding to the plurality of second temporary passwords is parallel to the first number, selecting the second temporary password returned by the client with the highest trust value in the clients as the first temporary password. Specifically, in order to improve the security of the system and avoid malicious users from damaging the security of data, the invention manages users connected with the server side.
Specifically, the user connects to the server and needs to register and log in the server. Therefore, the invention sets an initial trust value for each user registered at the server side
Figure 704768DEST_PATH_IMAGE044
. And when the user client responds to the second temporary password calculation requests of other users, the server adjusts the trust value according to whether the response result is correct or not. When the second temporary password returned by the client is consistent with the finally determined first temporary password, the client respondsAnd the result is correct, otherwise, the client response result is wrong.
For the mth result response of the user client, if the response result is correct, the adjustment value of the trust value of the user client is as follows:
Figure 600567DEST_PATH_IMAGE012
wherein,
Figure 577750DEST_PATH_IMAGE046
with the adjusted value of the client trust value when the result of the mth response is correct,
Figure 974097DEST_PATH_IMAGE047
the number of times that the response result is correct in the M responses,
Figure 644112DEST_PATH_IMAGE049
the unit adjustment value of the trust value when the response result is correct.
Correspondingly, the trust value after the mth result response of the user is as follows:
Figure 758699DEST_PATH_IMAGE036
wherein,
Figure 539573DEST_PATH_IMAGE051
for the trust value after the mth result response of the user,
Figure 56005DEST_PATH_IMAGE052
and (4) responding to the result of the M-1 th time for the user.
For the Mth result response of the user client, if the response result is wrong, the adjustment value of the trust value of the user client is as follows:
Figure 896922DEST_PATH_IMAGE054
wherein,
Figure 498805DEST_PATH_IMAGE055
an adjustment value for the client trust value when the result of the mth response is false,
Figure 83370DEST_PATH_IMAGE057
the number of response result errors in M responses,
Figure 454308DEST_PATH_IMAGE022
the value is adjusted in units of trust value in response to a result error.
Correspondingly, the trust value after the mth result response of the user is as follows:
Figure 466127DEST_PATH_IMAGE058
wherein,
Figure 289726DEST_PATH_IMAGE059
for the trust value after the mth result response of the user,
Figure 677982DEST_PATH_IMAGE052
and (4) responding to the result of the M-1 th time for the user.
For the first response of the user, when the response result is correct, the adjustment value of the client trust value is
Figure 903427DEST_PATH_IMAGE025
Then the adjusted client trust value is
Figure DEST_PATH_IMAGE061
. When the result of the response is wrong, the adjustment value of the client trust value is
Figure DEST_PATH_IMAGE063
Then the adjusted client trust value is
Figure DEST_PATH_IMAGE065
。
It is worth noting thatThe invention effectively protects the data and improves the safety of the data, and the invention
Figure 670833DEST_PATH_IMAGE037
。
For the trust value of the client, the server may provide a corresponding incentive measure to actively participate in the process of cooperatively computing the second temporary password. For example, for video-like applications, a range of trust values may enjoy complimentary member services, member fee discounts, etc.; for shopping-like applications, users who reach a trust value within a threshold range may be exempted from a shipping fee, etc.
S8, the server carries out fast encryption on the first temporary password to obtain an encrypted password, and the user name, the salt and the encrypted password are stored.
And after receiving the first temporary password, the server carries out fast encryption on the first temporary password and the salt together to obtain an encrypted password corresponding to the plaintext password input by the user finally. Fast encryption includes MD5 encryption and the like, and is not limited herein. And the server stores the user name, the salt and the encrypted password so as to verify the identity of the user. Because the server only stores the encrypted password, even if an attacker cracks the encrypted password, the server can only obtain the first temporary password, and the plaintext password of the user needs to be further cracked, so that the processing difficulty is great, the security of network data is greatly improved, and the user data is effectively protected.
When the user performs login verification, the user inputs a plaintext password, the corresponding encryption process is consistent with the above, the server side judges whether the calculated encryption password is consistent with the pre-stored encryption password, and if so, the user is a legal user. In addition, in order to further improve the data security, the generated salt can be continuously updated, the newly generated salt is sent while logging in, and the corresponding first temporary password is calculated, so that the salt is updated without being perceived by a user, and the user experience is improved.
Example two
As shown in fig. 2, the present embodiment provides a big data network data protection system based on edge computing, in particular, a system for encrypting private data such as a user password, including:
the first determining module is used for determining the computing capacity level of the client based on the basic information of the client;
in order to overcome the problem of server overload in the data protection method based on the server, the data protection method based on the client side performs partial data protection calculation so as to effectively reduce the processing expense of the server side. With the popularization of terminal equipment and the development of the future internet of things, the terminal equipment is becoming more and more diversified, and the performance on a client is stronger and stronger, so that the migration of part of computing tasks from a server to a mobile terminal is possible. Therefore, the client serves as an edge node, partial data protection calculation is realized by utilizing edge calculation, and the client and the server realize protection of user data together. The edge calculation is a distributed calculation structure, which moves the calculation of application program, data and service from the central node of the network to the edge node of the network logic for processing.
The client includes a personal computer, a mobile phone, a personal palm computer, etc., which is not limited herein. When a client is used as an edge node to perform data protection encryption calculation, the calculation capacities of different clients are different, and when the calculation capacity of a user cannot meet the corresponding encryption requirement, encryption protection cannot be performed based on the client obviously. Therefore, the invention firstly determines the computing capacity of the client based on the basic information of the client to decide whether to carry out data encryption protection based on the edge node.
Client configuration information related to computing power typically includes clock frequency, word length, number of cores, memory capacity, and the like. The clock frequency refers to the number of pulses sent by a computer CPU in unit time, the word length refers to the number of bits of binary data which can be simultaneously processed by an arithmetic element of the computer, the number of cores refers to the number of arithmetic units and controllers for executing instructions in the CPU, and the memory capacity refers to the total number of bytes of information stored in an internal memory. Generally, the higher the clock frequency, the larger the word length, the larger the number of cores, and the larger the memory capacity, the faster the operation speed of the client, and the stronger the corresponding computing capability.
In order to determine the computing power of the client, the invention sets different weights for the client configuration information related to the computing power, for example, the weights of the clock frequency, the word length, the kernel number and the memory capacity are set to
Figure 247308DEST_PATH_IMAGE001
、
Figure 173676DEST_PATH_IMAGE029
、
Figure 988048DEST_PATH_IMAGE003
、
Figure 607248DEST_PATH_IMAGE004
Wherein
Figure 405440DEST_PATH_IMAGE030
the calculation capability value of the client is as follows:
Figure DEST_PATH_IMAGE067
wherein,
Figure 666657DEST_PATH_IMAGE007
、
Figure 601115DEST_PATH_IMAGE031
、
Figure 391216DEST_PATH_IMAGE009
、
Figure 411125DEST_PATH_IMAGE042
the values of clock frequency, word length, kernel number, and memory capacity are provided. Different configuration information may have different weights, for example, the clock frequency largely determines the computing power of the client, and thus the clock frequency has the greatest weight.
Further, based on the calculated computing power values, the present invention classifies different clients into corresponding computing power levels, for example, the present invention sets the computing power levels of the clients to I level, II level, III level, IV level, and V level. Different calculation capability levels correspond to different calculation capability value ranges, and in general, the higher the calculation capability value is, the higher the corresponding calculation capability level is, and the faster the calculation speed is.
It should be noted that the computation power calculation based on the clock frequency, word length, kernel number and memory capacity is only an exemplary illustration, and the computation power calculation including the basic information of other clients is similar and not limited herein. In addition, in order to reduce the processing expense of the client, the computing power level of the client is only calculated once, after the first calculation is completed, the computing power level is stored in the client as public information, and when the client is required to be used as an edge node to perform encryption protection calculation, the corresponding computing power level is directly obtained at the client.
The second determining module is used for determining the encryption strength of the data according to the connected application type and the encryption strength strategy;
in the process of data encryption protection, the greater the encryption strength is, the higher the data security is, but the greater the corresponding processing cost is. Therefore, the present invention effectively balances safety and processing costs. In practical applications, users need different security for cryptographic data in different applications. For example, for login passwords for online banking, high security is generally required to protect the property of the user. And for the login password on the video website, high security is not required. Therefore, in the invention, different users set different encryption strengths for different application types.
Specifically, the application types are divided into finance types, shopping types, medical health types, video types, life service types and the like, and the user sets corresponding encryption strength for each type of application according to the requirement of the user. The finance category comprises a payment treasure, a mobile phone bank, an online bank and the like, the shopping category comprises a treasure, a Jingdong and the like, the video category comprises an Tengcong video, an Aiqiyi video, a Youkou video and the like, the life service category comprises a drip, a Mei take-out and the like, and the medical health category comprises a hospital registration platform, an online medical consultation platform and the like.
In the invention, the encrypted result is re-encrypted at the edge node, and the cyclic iteration is performed for m times, so that the difficulty of brute force cracking of an attacker is improved. That is, the strength of data encryption is related to the number of times the iterative encryption is cycled. Therefore, the data encryption strength applied by each category corresponds to the corresponding cycle iteration number range.
For example, the user sets an encryption strength policy in advance, and sets the encryption strength corresponding to the financial application to [100000,90000], the encryption strength corresponding to the shopping application to [80000,70000], the encryption strength corresponding to the medical and health application to [75000,60000], the encryption strength corresponding to the video application to [20000,10000], and the encryption strength corresponding to the life service application to [50000,40000 ].
When a user registers or logs in to use a certain application through a website or an application program, firstly, the application type of the website or the application program is judged, a user encryption intensity strategy locally stored in advance at a client side is called, a corresponding encryption intensity range is determined according to the application type, and any encryption intensity value in the encryption intensity range is randomly selected to serve as the encryption intensity of the data.
The judging module is used for randomly generating salt, judging whether the computing capability level of the client can meet the encryption strength requirement, if so, calling the local encryption module, and if not, calling the selecting module;
in order to resist cracking methods such as a violent exhaustive dictionary, different salt values are introduced for different users in the encryption process. By inserting a specific character string at an arbitrarily fixed position of the privacy password, the hashed result is not matched with the hashed result using the original password, and the process is called salting. Therefore, before the data protection encryption is performed on the edge node, each user client randomly generates a salt at first, so that the security of the data encryption is improved.
As described above, when the computing power of the user cannot meet the corresponding encryption requirement, it is obviously impossible to perform encryption protection based on the client, because when the computing power does not meet the encryption strength requirement, a large amount of time is required to complete the corresponding encryption strength, the user has a long waiting time, and the user experience is greatly reduced. Therefore, in the edge node data protection process provided by the invention, whether the computing capability of the current client can meet the encryption strength requirement is judged, if so, the current client directly performs protection encryption computation, and if not, the local client does not perform protection encryption computation any more, so that poor user experience is avoided.
The encryption strength range which can be realized by each computing power level is firstly determined, specifically, the encryption strength range can be realized by counting a large number of clients, and can also be realized by a machine learning mode, and the encryption strength range is not limited herein. And determining the encryption strength range which can be realized by the client according to the computing power level of the client, and when the data encryption strength of the time belongs to the encryption strength range which can be realized by the client, indicating that the computing power of the current client can meet the encryption requirement, otherwise, not meeting the encryption requirement.
The local encryption module is used for slowly encrypting a plaintext password input by a user to obtain a first temporary password and sending the user name, the salt and the first temporary password to the application server; calling a storage module;
the invention adopts PBKDF2 or bcrypt and other slow encryption algorithms to encrypt the plaintext password. The slow hash encryption is to increase the encryption time to correspondingly increase the cracking time and difficulty. The time for password cracking and the encryption algorithm are directly related, for example, the MD5 encryption is very fast, the encryption takes 1 microsecond, when the code is cracked, a phrase is guessed at anytime, only 1 microsecond is needed, and an attacker can guess 100 ten thousand in one second. If the encryption is increased to 10 milliseconds at a time, an attacker can only guess 100 in a second, and the cracking speed is ten thousand times slower. There are two methods for increasing the encryption time, namely, multiple encryption and increasing the complexity of the encryption algorithm.
Taking PBKDF2 as an example, the PBKDF2 function is defined as DK = PBKDF2(PRF, Password, Salt, c, dkLen), where PRF is a pseudo-random function, such as a HASH _ HMAC function, that outputs a result of length hLen. Password is the plaintext cipher used to generate the key. Salt is a Salt value for encryption. c is the number of times of repeated calculation, which is the determined encryption strength of the data this time in the invention. dkLen is the length of the key that is expected to be obtained. The DK is the last generated key.
When the computing capacity of the current client can meet the requirement of encryption strength, the client generates a first temporary password through loop iteration according to the salt and the encryption strength which are generated randomly and the password of the website or the application program input by the user, and sends the user name, the salt and the first temporary password to the application server so that the server can verify the next login of the user. At the moment, the server side does not receive and store the plaintext password, only can acquire the first temporary password after slow encryption, and can effectively resist the attacks such as library dragging and the like.
The selection module is used for sending the user name, the plaintext password, the salt and the encryption strength input by the user to the application server side, the application server selects a plurality of other connected client sides, and the plaintext password, the salt and the encryption strength input by the user are sent to the selected client sides;
when the computing power of the current client cannot meet the encryption strength requirement, no protection encryption calculation is carried out at the client. At this time, the current client sends the user name, the plaintext password, the salt and the encryption strength corresponding to the user to the application server. Meanwhile, in order to avoid the excessive processing burden of the server, after receiving the plaintext password of the user, the server does not perform corresponding slow encryption, but selects a plurality of clients connected with the server to perform slow encryption. Because malicious edge nodes may exist, the invention selects a plurality of edge clients to perform encryption calculation at the same time, thereby avoiding the problems that the malicious edge nodes do not return results, the estimation calculation is wrong and the like.
Specifically, the server determines the computing power level corresponding to the encryption strength according to the encryption strength, and the computing power level of the client is public, so that the application server selects a plurality of clients of which the computing power levels meet the computing power level requirement corresponding to the encryption strength, and the selected clients provide corresponding slow encryption services. Correspondingly, the plaintext password, the salt and the encryption strength input by the user are sent to the selected client side, so that the selected client side can provide slow encryption service for improvement.
It is worth noting that when the server transmits the plaintext password information to the selected client, the server discards the plaintext password of the user and does not store the plaintext password in the server, so as to effectively avoid the attack of an attacker. For the client, although the client acquires the plaintext password, the client does not use the username information, so that the plaintext password cannot be effectively associated with the user, and the password information of the user cannot be cracked.
The collaborative encryption module is used for the selected client to slowly encrypt the plaintext password input by the user to obtain a second temporary password and send the second temporary password to the application server;
after receiving the encryption request sent by the server, the selected client can autonomously select whether to respond to the encryption request. When the encryption request is not responded to, the encryption request is ignored and the request is not responded to. And when the encryption request is responded, slow encryption is carried out by adopting a slow encryption algorithm which is the same as that of the local client side, so that a second temporary password is obtained. The process of slow encryption is similar to step S4 and will not be described in detail herein.
A third determining module, configured to determine, by the application server, the first temporary password based on the received plurality of second temporary passwords;
as described above, an edge client may have a malicious node, and thus, the returned results of the clients may be different. Therefore, when the server receives a plurality of second temporary passwords, the server needs to filter the second temporary passwords to determine the last first temporary password.
Specifically, the server counts the number of clients corresponding to each returned second temporary password, and selects the second temporary password with the largest number of clients as the first temporary password. For example, when the second temporary passwords selected by the 6 clients A, B, C, D, E, F are respectively X1、X2、X3、X2、X3、X3Time, serverStatistics of X1The number of corresponding clients is 1, X2The number of corresponding clients is 2, X3The corresponding client number is 3, and X is returned3Is the largest, so X is3As the first temporary password to be finally determined.
And when the number of the clients corresponding to the plurality of second temporary passwords is parallel to the first number, selecting the second temporary password returned by the client with the highest trust value in the clients as the first temporary password. Specifically, in order to improve the security of the system and avoid malicious users from damaging the security of data, the invention manages users connected with the server side.
Specifically, the user connects to the server and needs to register and log in the server. Therefore, the invention sets an initial trust value for each user registered at the server side
Figure 679295DEST_PATH_IMAGE044
. And when the user client responds to the second temporary password calculation requests of other users, the server adjusts the trust value according to whether the response result is correct or not. And when the second temporary password returned by the client is consistent with the finally determined first temporary password, the response result of the client is correct, otherwise, the response result of the client is wrong.
For the mth result response of the user client, if the response result is correct, the adjustment value of the trust value of the user client is as follows:
Figure 733839DEST_PATH_IMAGE012
wherein,
Figure DEST_PATH_IMAGE068
with the adjusted value of the client trust value when the result of the mth response is correct,
Figure 960421DEST_PATH_IMAGE047
the number of times that the response result is correct in the M responses,
Figure DEST_PATH_IMAGE069
the unit adjustment value of the trust value when the response result is correct.
Correspondingly, the trust value after the mth result response of the user is as follows:
Figure 1714DEST_PATH_IMAGE036
wherein,
Figure 73575DEST_PATH_IMAGE059
for the trust value after the mth result response of the user,
Figure 248204DEST_PATH_IMAGE052
and (4) responding to the result of the M-1 th time for the user.
For the Mth result response of the user client, if the response result is wrong, the adjustment value of the trust value of the user client is as follows:
Figure DEST_PATH_IMAGE070
wherein,
Figure 176846DEST_PATH_IMAGE055
an adjustment value for the client trust value when the result of the mth response is false,
Figure DEST_PATH_IMAGE071
the number of response result errors in M responses,
Figure 968085DEST_PATH_IMAGE022
the value is adjusted in units of trust value in response to a result error.
Correspondingly, the trust value after the mth result response of the user is as follows:
Figure 578058DEST_PATH_IMAGE058
wherein,
Figure 607193DEST_PATH_IMAGE059
for the trust value after the mth result response of the user,
Figure 644420DEST_PATH_IMAGE052
and (4) responding to the result of the M-1 th time for the user.
For the first response of the user, when the response result is correct, the adjustment value of the client trust value is
Figure 391796DEST_PATH_IMAGE025
Then the adjusted client trust value is
Figure DEST_PATH_IMAGE072
. When the result of the response is wrong, the adjustment value of the client trust value is
Figure DEST_PATH_IMAGE073
Then the adjusted client trust value is
Figure DEST_PATH_IMAGE074
。
It is worth noting that in order to effectively protect data and improve the safety of the data, the invention
Figure 933023DEST_PATH_IMAGE037
。
For the trust value of the client, the server may provide a corresponding incentive measure to actively participate in the process of cooperatively computing the second temporary password. For example, for video-like applications, a range of trust values may enjoy complimentary member services, member fee discounts, etc.; for shopping-like applications, users who reach a trust value within a threshold range may be exempted from a shipping fee, etc.
And the storage module is used for the server side to quickly encrypt the first temporary password to obtain an encrypted password and store the user name, the salt and the encrypted password.
And after receiving the first temporary password, the server carries out fast encryption on the first temporary password and the salt together to obtain an encrypted password corresponding to the plaintext password input by the user finally. Fast encryption includes MD5 encryption and the like, and is not limited herein. And the server stores the user name, the salt and the encrypted password so as to verify the identity of the user. Because the server only stores the encrypted password, even if an attacker cracks the encrypted password, the server can only obtain the first temporary password, and the plaintext password of the user needs to be further cracked, so that the processing difficulty is great, the security of network data is greatly improved, and the user data is effectively protected.
When the user performs login verification, the user inputs a plaintext password, the corresponding encryption process is consistent with the above, the server side judges whether the calculated encryption password is consistent with the pre-stored encryption password, and if so, the user is a legal user. In addition, in order to further improve the data security, the generated salt can be continuously updated, the newly generated salt is sent while logging in, and the corresponding first temporary password is calculated, so that the salt is updated without being perceived by a user, and the user experience is improved.
The invention provides a big data network data protection method and system based on edge calculation, and provides a data protection method and system based on edge calculation aiming at the problem of large data calculation amount in a big data network. The client is used as an edge node, the computing capacity of the client is fully utilized, slow encryption is carried out by adopting the client in the data protection process, and the problems that the server is large in computing burden and easy to crash are effectively avoided; different users set different encryption strengths for different application types, so that the problem of unnecessary calculation processing expense caused by overhigh encryption strength is avoided, and effective balance between data security and system expense is realized; the computing capacity of the client is quantitatively evaluated, whether slow encryption is performed on the local client is determined according to the encryption strength requirement and whether the computing capacity is matched, and the local slow encryption is performed only during matching, so that the problems of too low processing speed and too much performance reduction of the client are solved; the results returned by other clients are screened, the trust value of the client is quantitatively evaluated, meanwhile, the influence of the trust value caused by wrong response is greater than that caused by correct response, so that a malicious user is prevented from returning wrong results, and the safety of data is further improved; meanwhile, an incentive mechanism corresponding to the trust value is set, so that the enthusiasm of the user for participating in slow encryption calculation is improved, the response behavior of the user is restrained, and the safety of the system is improved; based on the slow encryption mode of the client and the fast encryption mode of the server, the attack cost of an attacker for obtaining data is greatly improved, and the data protection strength is strong.
It is to be noted that the foregoing is only illustrative of the preferred embodiments of the present invention and the technical principles employed. It will be understood by those skilled in the art that the present invention is not limited to the particular embodiments described herein, but is capable of various obvious changes, rearrangements and substitutions as will now become apparent to those skilled in the art without departing from the scope of the invention. Therefore, although the present invention has been described in greater detail by the above embodiments, the present invention is not limited to the above embodiments, and may include other equivalent embodiments without departing from the spirit of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims (8)

1. A big data network data protection method based on edge calculation is characterized by comprising the following steps:
s1, determining the computing capacity level of the client based on the basic information of the client;
s2, determining the encryption strength of the data according to the application type and the encryption strength strategy of the connection;
s3, randomly generating salt, judging whether the computing power level of the client can meet the encryption strength requirement, if so, executing a step S4, and if not, executing a step S5;
s4, slowly encrypting the plaintext password input by the user to obtain a first temporary password, and sending the user name, the salt and the first temporary password to the application server; step S8 is executed;
s5, sending the user name, the plaintext password, the salt and the encryption strength input by the user to an application server side, selecting a plurality of other connected client sides by the application server, and sending the plaintext password, the salt and the encryption strength input by the user to the selected client sides;
s6, the selected client performs slow encryption on the plaintext password input by the user to obtain a second temporary password, and the second temporary password is sent to the application server;
s7, the application server determines a first temporary password based on the received plurality of second temporary passwords;
s8, the application server carries out fast encryption on the first temporary password to obtain an encrypted password, and the user name, the salt and the encrypted password are stored;
the step S7 includes:
the application server counts the number of the clients corresponding to the returned second temporary passwords, judges whether the number of the clients corresponding to the second temporary passwords is parallel to the first number, and selects the second temporary password with the largest number of the clients as the first temporary password if the number of the clients corresponding to the second temporary passwords is not parallel to the first number; if so, selecting a second temporary password returned by a client with the highest trust value in the clients corresponding to the parallel first second temporary password as the first temporary password; and when the second temporary password returned by the client is consistent with the first temporary password, the response result of the client is correct, otherwise, the response result of the client is wrong.
2. The big data network data protection method according to claim 1, wherein the step S1 includes:
the weights for setting the clock frequency, the word length, the kernel number and the memory capacity are sequentially
Figure DEST_PATH_IMAGE001
、
Figure DEST_PATH_IMAGE002
、
Figure DEST_PATH_IMAGE003
、
Figure DEST_PATH_IMAGE004
Wherein
Figure DEST_PATH_IMAGE005
the calculation capability value of the client is as follows:
Figure DEST_PATH_IMAGE006
wherein,
Figure DEST_PATH_IMAGE007
、
Figure DEST_PATH_IMAGE008
、
Figure 336590DEST_PATH_IMAGE009
、
Figure DEST_PATH_IMAGE010
the values of clock frequency, word length, kernel number and memory capacity are respectively;
and classifying the client side to the corresponding computing capacity grade based on the computing capacity value according to the preset computing capacity grade and the corresponding computing capacity value range.
3. The big data network data protection method according to claim 1, wherein the encryption strength is a number of times of loop iteration encryption, and the encryption strength policy is: setting an encryption intensity range for each type of application by a user; the step S2 includes:
judging the application type of the connection, calling a user encryption strength strategy stored in advance locally at the client, determining a corresponding encryption strength range according to the application type, and randomly selecting any encryption strength value in the encryption strength range as the encryption strength of the data.
4. The big data network data protection method according to claim 1, wherein the trust value is performed by the application server according to whether the response result of the client is correct or notAdjusting; the initial trust value of the client when registering in the application server is
Figure DEST_PATH_IMAGE011
；
For the mth result response of the client, if the response result is correct, the adjustment value of the trust value of the user client is as follows:
Figure DEST_PATH_IMAGE012
wherein,
Figure DEST_PATH_IMAGE013
the adjusted value of the user client trust value when the result of the mth response is correct,
Figure DEST_PATH_IMAGE014
the number of times that the response result is correct in the M responses,
Figure DEST_PATH_IMAGE015
a unit adjustment value of the trust value when the response result is correct;
therefore, the trust value after the user M-th result response is correct is as follows:
Figure DEST_PATH_IMAGE016
wherein,
Figure DEST_PATH_IMAGE017
for the trust value after the mth result response of the user,
Figure DEST_PATH_IMAGE018
the trust value after the M-1 result response of the user;
for the Mth result response of the user client, if the response result is wrong, the adjustment value of the trust value of the user client is as follows:
Figure 224037DEST_PATH_IMAGE019
wherein,
Figure DEST_PATH_IMAGE020
the adjusted value of the user client trust value when the result of the mth response is an error,
Figure 66091DEST_PATH_IMAGE021
the number of response result errors in M responses,
Figure DEST_PATH_IMAGE022
the value is adjusted in units of trust value in response to a result error, wherein,
Figure 995388DEST_PATH_IMAGE023
；
therefore, the trust value after the user's mth result response error is:
Figure DEST_PATH_IMAGE024
wherein,
Figure 465553DEST_PATH_IMAGE017
for the trust value after the mth result response of the user,
Figure 756857DEST_PATH_IMAGE018
the trust value after the M-1 result response of the user;
for the first response of the user, when the response result is correct, the adjustment value of the client trust value is
Figure 882945DEST_PATH_IMAGE025
Then the adjusted client trust value is
Figure DEST_PATH_IMAGE026
(ii) a When the result of the response is wrong, the adjustment value of the client trust value is
Figure 347424DEST_PATH_IMAGE027
Then the adjusted client trust value is
Figure DEST_PATH_IMAGE028
。
5. A big data network data protection system based on edge computing is characterized by comprising:
the first determining module is used for determining the computing capacity level of the client based on the basic information of the client;
the second determining module is used for determining the encryption strength of the data according to the connected application type and the encryption strength strategy;
the judging module is used for randomly generating salt, judging whether the computing capability level of the client can meet the encryption strength requirement, if so, calling the local encryption module, and if not, calling the selecting module;
the local encryption module is used for slowly encrypting a plaintext password input by a user to obtain a first temporary password and sending the user name, the salt and the first temporary password to the application server; calling a storage module;
the selection module is used for sending the user name, the plaintext password, the salt and the encryption strength input by the user to the application server side, the application server selects a plurality of other connected client sides, and the plaintext password, the salt and the encryption strength input by the user are sent to the selected client sides;
the collaborative encryption module is used for the selected client to slowly encrypt the plaintext password input by the user to obtain a second temporary password and send the second temporary password to the application server;
a third determining module, configured to determine, by the application server, the first temporary password based on the received plurality of second temporary passwords;
the storage module is used for the application server to quickly encrypt the first temporary password to obtain an encrypted password and store the user name, the salt and the encrypted password;
the third determining module is further configured to:
the application server counts the number of the clients corresponding to the returned second temporary passwords, judges whether the number of the clients corresponding to the second temporary passwords is parallel to the first number, and selects the second temporary password with the largest number of the clients as the first temporary password if the number of the clients corresponding to the second temporary passwords is not parallel to the first number; if so, selecting a second temporary password returned by a client with the highest trust value in the clients corresponding to the parallel first second temporary password as the first temporary password; and when the second temporary password returned by the client is consistent with the first temporary password, the response result of the client is correct, otherwise, the response result of the client is wrong.
6. The big data network data protection system of claim 5, wherein the first determination module is further configured to:
the weights for setting the clock frequency, the word length, the kernel number and the memory capacity are sequentially
Figure 344199DEST_PATH_IMAGE029
、
Figure DEST_PATH_IMAGE030
、
Figure 399880DEST_PATH_IMAGE003
、
Figure 950947DEST_PATH_IMAGE004
Wherein, the calculation ability value of the client is as follows:
Figure 284364DEST_PATH_IMAGE006
wherein,
Figure 276590DEST_PATH_IMAGE007
、
Figure 299910DEST_PATH_IMAGE031
、
Figure 10377DEST_PATH_IMAGE009
、
Figure 144555DEST_PATH_IMAGE010
the values of clock frequency, word length, kernel number and memory capacity are respectively;
and classifying the client side to the corresponding computing capacity grade based on the computing capacity value according to the preset computing capacity grade and the corresponding computing capacity value range.
7. The big data network data protection system according to claim 5, wherein the encryption strength is a number of iterative rounds of encryption, and the encryption strength policy is: setting an encryption intensity range for each type of application by a user; the second determination module is further to:
judging the application type of the connection, calling a user encryption strength strategy stored in advance locally at the client, determining a corresponding encryption strength range according to the application type, and randomly selecting any encryption strength value in the encryption strength range as the encryption strength of the data.
8. The big data network data protection system according to claim 5, wherein the trust value is adjusted by the application server according to whether the response result of the client is correct; the initial trust value of the client when registering in the application server is
Figure DEST_PATH_IMAGE032
；
For the mth result response of the client, if the response result is correct, the adjustment value of the trust value of the user client is as follows:
Figure 53605DEST_PATH_IMAGE033
wherein,
Figure 982247DEST_PATH_IMAGE013
the adjusted value of the user client trust value when the result of the mth response is correct,
Figure 180010DEST_PATH_IMAGE014
the number of times that the response result is correct in the M responses,
Figure 852300DEST_PATH_IMAGE015
a unit adjustment value of the trust value when the response result is correct;
therefore, the trust value after the user M-th result response is correct is as follows:
Figure DEST_PATH_IMAGE034
wherein,
Figure 678173DEST_PATH_IMAGE035
for the trust value after the mth result response of the user,
Figure DEST_PATH_IMAGE036
the trust value after the M-1 result response of the user;
for the Mth result response of the user client, if the response result is wrong, the adjustment value of the trust value of the user client is as follows:
Figure 512137DEST_PATH_IMAGE037
wherein,
Figure DEST_PATH_IMAGE038
the adjusted value of the user client trust value when the result of the mth response is an error,
Figure 516304DEST_PATH_IMAGE039
the number of response result errors in M responses,
Figure 867651DEST_PATH_IMAGE022
the value is adjusted in units of trust value in response to a result error, wherein,
Figure DEST_PATH_IMAGE040
；
therefore, the trust value after the user's mth result response error is:
Figure 610347DEST_PATH_IMAGE024
wherein,
Figure 21737DEST_PATH_IMAGE035
for the trust value after the mth result response of the user,
Figure 53147DEST_PATH_IMAGE036
the trust value after the M-1 result response of the user;
for the first response of the user, when the response result is correct, the adjustment value of the client trust value is
Figure 942606DEST_PATH_IMAGE025
Then the adjusted client trust value is
Figure DEST_PATH_IMAGE041
(ii) a When the result of the response is wrong, the adjustment value of the client trust value is
Figure DEST_PATH_IMAGE042
Then the adjusted client trust value is
Figure 336547DEST_PATH_IMAGE028
。
CN202010465323.3A 2020-05-28 2020-05-28 Big data network data protection method and system based on edge calculation Active CN111371813B (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202010465323.3A CN111371813B (en) 2020-05-28 2020-05-28 Big data network data protection method and system based on edge calculation
JP2020132747A JP6893626B1 (en) 2020-05-28 2020-08-05 Big data and network data protection methods and systems by edge computing

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010465323.3A CN111371813B (en) 2020-05-28 2020-05-28 Big data network data protection method and system based on edge calculation

Publications (2)

Publication Number Publication Date
CN111371813A CN111371813A (en) 2020-07-03
CN111371813B true CN111371813B (en) 2020-10-02

Family

ID=71211111

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010465323.3A Active CN111371813B (en) 2020-05-28 2020-05-28 Big data network data protection method and system based on edge calculation

Country Status (2)

Country Link
JP (1) JP6893626B1 (en)
CN (1) CN111371813B (en)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113468565B (en) * 2021-06-30 2023-11-28 杭州博联智能科技股份有限公司 Intelligent door lock control method and system
CN113935068A (en) * 2021-10-21 2022-01-14 深圳市瑞云科技有限公司 Data desensitization method for mass file transmission system
CN114244521B (en) * 2021-12-06 2024-02-13 南京南瑞信息通信科技有限公司 Encryption system implementation method applied to edge calculation
CN114547690B (en) * 2022-02-24 2024-05-14 深圳市裕熙科技有限公司 Information security risk management system based on big data and edge calculation
CN114979717B (en) * 2022-07-25 2022-11-08 广州万协通信息技术有限公司 Differential video encryption method based on equipment decoding capability and security chip device
CN116506507A (en) * 2023-06-29 2023-07-28 天津市城市规划设计研究总院有限公司 Data processing method based on client characteristics

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110651463A (en) * 2017-05-22 2020-01-03 联邦科学和工业研究组织 Encryption of cloud-based data

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2002319935A (en) * 2001-01-19 2002-10-31 Matsushita Electric Ind Co Ltd Data processor
JP2003304227A (en) * 2002-04-08 2003-10-24 Matsushita Electric Ind Co Ltd Cryptographic communication apparatus, its method and cryptographic communication system
JP2015014962A (en) * 2013-07-05 2015-01-22 株式会社リコー Arithmetic device, arithmetic method, and program
US10091170B2 (en) * 2016-03-31 2018-10-02 Cisco Technology, Inc. Method and apparatus for distributing encryption and decryption processes between network devices
CN105827395A (en) * 2016-04-29 2016-08-03 上海斐讯数据通信技术有限公司 Network user authentication method
CN106657267B (en) * 2016-11-15 2019-10-08 华中科技大学 Cloud storage system based on Edge Server
CN108243246A (en) * 2017-12-25 2018-07-03 北京市天元网络技术股份有限公司 A kind of edge calculations resource regulating method, edge device and system
CN111130956B (en) * 2018-10-30 2022-05-03 九阳股份有限公司 Data transmission method of intelligent household appliance and intelligent household appliance
US11669368B2 (en) * 2019-09-28 2023-06-06 Intel Corporation Multi-tenant data protection in edge computing environments
CN110933118B (en) * 2020-02-20 2020-09-11 深圳市城市交通规划设计研究中心股份有限公司 Edge computing gateway secure communication method, system, terminal equipment and server

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110651463A (en) * 2017-05-22 2020-01-03 联邦科学和工业研究组织 Encryption of cloud-based data

Also Published As

Publication number Publication date
CN111371813A (en) 2020-07-03
JP6893626B1 (en) 2021-06-23
JP2021190978A (en) 2021-12-13

Similar Documents

Publication Publication Date Title
CN111371813B (en) Big data network data protection method and system based on edge calculation
US11108752B2 (en) Systems and methods for managing resetting of user online identities or accounts
US10223524B1 (en) Compromised authentication information clearing house
US8819769B1 (en) Managing user access with mobile device posture
JP6585301B2 (en) Dynamic update of CAPTCHA challenge
US7908645B2 (en) System and method for fraud monitoring, detection, and tiered user authentication
US8930708B2 (en) Web-based security authentication
US9824207B1 (en) Authentication information update based on fraud detection
US9122866B1 (en) User authentication
US10171495B1 (en) Detection of modified requests
US9639689B1 (en) User authentication
Andola et al. A secure searchable encryption scheme for cloud using hash-based indexing
US20180101831A1 (en) System and method for performing secure online banking transactions
Tian et al. Achieving flatness: Graph labeling can generate graphical honeywords
Chan et al. Intrusion detection and prevention of web service attacks for software as a service: Fuzzy association rules vs fuzzy associative patterns
Bhingarkar et al. A survey: Securing cloud infrastructure against edos attack
US20220237482A1 (en) Feature randomization for securing machine learning models
Jain et al. A literature review on machine learning for cyber security issues
US20220400108A1 (en) Tokenizing authentication information
CN116846555A (en) Data access methods and devices
CN113888165A (en) Block chain address reconstruction and identity authentication method, equipment and storage medium
CN108494805B (en) CC attack processing method and device
Adil et al. A review on phishing website detection
Parveen et al. Cookie Hijacking: Privacy Risk
Qian Applying Combined One-Time Passwords to Prevent Phishing Attacks in Electronic Banking

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant