CN112966287A - Method, system, device and computer readable medium for acquiring user data - Google Patents
Method, system, device and computer readable medium for acquiring user data Download PDFInfo
- Publication number
- CN112966287A CN112966287A CN202110340077.3A CN202110340077A CN112966287A CN 112966287 A CN112966287 A CN 112966287A CN 202110340077 A CN202110340077 A CN 202110340077A CN 112966287 A CN112966287 A CN 112966287A
- Authority
- CN
- China
- Prior art keywords
- client
- server
- encryption key
- key
- hardware
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computer Hardware Design (AREA)
- Medical Informatics (AREA)
- Databases & Information Systems (AREA)
- Storage Device Security (AREA)
- Information Transfer Between Computers (AREA)
Abstract
The invention discloses a method, a system, equipment and a computer readable medium for acquiring user data, and relates to the technical field of Internet of things. One embodiment of the method comprises: the client sends a client security hardware identifier, user information and a client encryption key, wherein the client encryption key is sent by the server in advance; the server side obtains personal information based on the successful verification of the user information; the server generates a server verification key based on a server encryption key, the personal information, the client security hardware identifier and the client encryption key; and the server side safety hardware compares the hash value of the server side verification key with the pre-stored hash value, and sends the request data of the client side, wherein the request data is obtained by adopting the server side verification key to decrypt. This embodiment can improve the security of the user data.
Description
Technical Field
The present invention relates to the field of internet of things technology, and in particular, to a method, system, device, and computer readable medium for acquiring user data.
Background
In modern society, protection of user data is receiving more and more attention, and in recent years, lawless persons have a behavior of stealing user data in batches and utilizing or selling the data in a mode of dragging a library and the like at a server side.
In the process of implementing the invention, the inventor finds that at least the following problems exist in the prior art: in the case of a server database being compromised, the security of the user data is poor.
Disclosure of Invention
In view of this, embodiments of the present invention provide a system, a device and a computer readable medium for acquiring user data, which can improve the security of the user data.
To achieve the above object, according to an aspect of an embodiment of the present invention, there is provided a method for acquiring user data, including:
the client sends a client security hardware identifier, user information and a client encryption key, wherein the client encryption key is sent by the server in advance;
the server side obtains personal information based on the successful verification of the user information;
the server generates a server verification key based on a server encryption key, the personal information, the client security hardware identifier and the client encryption key;
and the server side safety hardware compares the hash value of the server side verification key with the pre-stored hash value, and sends the request data of the client side, wherein the request data is obtained by adopting the server side verification key to decrypt.
Before the client sends the client security hardware identifier, the user information and the client encryption key, the method further comprises the following steps:
and establishing a secure connection between the client and the server through an SM2 public and private key pair.
The client encryption key is obtained from client security hardware.
The server generates a server verification key based on the server encryption key, the personal information, the client security hardware identifier and the client encryption key, and the method comprises the following steps:
the server side sends the personal information, the client side safety hardware identification and the client side encryption key to server side safety hardware;
and the server side safety hardware generates a personal key based on the personal information, and generates a server side verification key according to the server side encryption key, the personal key, the client side safety hardware identifier and the client side encryption key.
The server side safety hardware compares the hash value of the server side verification key with the pre-stored hash value to be consistent, and then sends the request data of the client side, wherein the step of sending the request data comprises the following steps:
the server side safety hardware compares the hash value of the server side verification key with the pre-stored hash value to be consistent, and the server side safety hardware loads encryption request data;
and the server side safety hardware decrypts the encrypted request data according to the server side verification key to obtain and send the request data of the client side.
The encrypted request data is user data stored in advance in a database.
The method further comprises the following steps:
and the server side responds to the client side encryption request and feeds back the client side encryption key to the client side, wherein the client side encryption request comprises the random number of the client side security hardware, the client side security hardware identification and the user information.
The server side responds to the client side encryption request and feeds back the client side encryption key to the client side, and the method comprises the following steps:
the client sends the client encryption request;
the server side obtains personal information based on the successful verification of the user information;
the server side safety hardware generates a primary encryption key based on the random number of the client side safety hardware;
and the server side safety hardware generates and feeds back the client side encryption key to the client side according to the server side encryption key, the personal information, the client side safety hardware identification and the primary encryption key.
After the server-side security hardware generates and feeds back the client-side encryption key to the client-side according to the server-side encryption key, the personal information, the client-side security hardware identifier and the primary encryption key, the method further includes:
and the server side safety hardware encrypts user data by adopting the primary encryption key to obtain the encrypted user data, wherein the user data is the request data of the client side.
After the server generates and feeds back the client encryption key to the client according to the server encryption key, the personal information, the client security hardware identifier and the primary encryption key, the method further comprises:
and the server takes the hash value of the primary encryption key as the preset hash value.
Before the client sends the client encryption request, the method further comprises the following steps:
and establishing a secure connection between the client and the server through an SM2 public and private key pair.
The method further comprises the following steps:
and the server side responds to the client side updating request and feeds back the client side updating encryption key to the client side, wherein the client side updating request comprises the client side original encryption key, the client side safety hardware original identification, the client side safety hardware updating identification and the user information.
The server side responds to the client side updating request and feeds back the client side updating encryption key to the client side, and the method comprises the following steps:
the client sends the client updating request;
the server side obtains personal information based on the successful verification of the user information;
the server side safety hardware generates an updating verification key based on a server side encryption key, the personal information, the original equipment identifier and the original client side encryption key;
and if the hash value of the update verification key is consistent with the pre-stored hash value, the server side safety hardware generates and feeds back the client side update encryption key to the client side based on the server side encryption key, the personal information, the equipment update identification and the original encryption key of the client side.
The method further comprises the following steps:
and the client side stores the client side updated encryption key to the new safety hardware of the client side.
After the client updates the client updated encryption key to the client security hardware, the method further includes:
and deleting the original encryption key of the client in the client.
Before the client sends the client update request, the method further includes:
and establishing a secure connection between the client and the server through an SM2 public and private key pair.
The server side encryption key belongs to the SM4 encryption key.
According to a second aspect of the embodiments of the present invention, there is provided a system for acquiring user data, including a client, a server and server security hardware,
the client sends a client security hardware identifier, user information and a client encryption key, wherein the client encryption key is sent by the server in advance;
the server side obtains personal information based on the successful verification of the user information;
the server generates a server verification key based on a server encryption key, the personal information, the client security hardware identifier and the client encryption key;
and the server side safety hardware compares the hash value of the server side verification key with the pre-stored hash value, and sends the request data of the client side, wherein the request data is obtained by adopting the server side verification key to decrypt.
According to a third aspect of the embodiments of the present invention, there is provided an electronic device for acquiring user data, including:
one or more processors;
a storage device for storing one or more programs,
when executed by the one or more processors, cause the one or more processors to implement the method as described above.
According to a fourth aspect of embodiments of the present invention, there is provided a computer readable medium, on which a computer program is stored, which when executed by a processor, implements the method as described above.
One embodiment of the above invention has the following advantages or benefits: the client sends a client security hardware identifier, user information and a client encryption key, wherein the client encryption key is sent by the server in advance; the server side obtains personal information based on the successful verification of the user information; the server generates a server verification key based on a server encryption key, the personal information, the client security hardware identifier and the client encryption key; and the server compares the hash value of the server verification key with a pre-stored hash value, and sends the request data of the client, wherein the request data is obtained by decrypting the server verification key. In the process of verifying the client by the server, the client not only relates to the safety hardware identification, but also relates to the user information, and the verification is carried out from two aspects of equipment and the user. If the device is not compliant or the user is replaced, the user data cannot be acquired, and thus the security of the user data can be improved.
Further effects of the above-mentioned non-conventional alternatives will be described below in connection with the embodiments.
Drawings
The drawings are included to provide a better understanding of the invention and are not to be construed as unduly limiting the invention. Wherein:
fig. 1 is a schematic diagram of a main flow of a method of acquiring user data according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of a system implementing a method of acquiring a user according to an embodiment of the invention;
FIG. 3 is a schematic flow chart of generating a server-side authentication key according to an embodiment of the present invention;
FIG. 4 is a flow chart illustrating a process of sending requested data of a client according to an embodiment of the present invention;
fig. 5 is a schematic flow chart of feeding back a client encryption key to a client according to an embodiment of the present invention;
fig. 6 is a schematic flow chart of feeding back a client updated encryption key to a client according to an embodiment of the present invention;
fig. 7 is a schematic diagram of the main structure of a system for acquiring user data according to an embodiment of the present invention;
FIG. 8 is an exemplary system architecture diagram in which embodiments of the present invention may be employed;
fig. 9 is a schematic structural diagram of a computer system suitable for implementing a terminal device or a server according to an embodiment of the present invention.
Detailed Description
Exemplary embodiments of the present invention are described below with reference to the accompanying drawings, in which various details of embodiments of the invention are included to assist understanding, and which are to be considered as merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.
At present, a common method for encrypting user data of a server is to store a user key of an encryption algorithm of a cloud used by a user resource or a user key symmetrically encrypted by a single encryption device in the server, and decrypt and read the user key when a user uses the server. The symmetric Encryption includes Advanced Encryption Standard (AES).
When an attacker breaks the server database, the user key and the user resource are simultaneously acquired by the attacker, so that the attacker can decrypt and steal the encrypted and protected content of the user by using a decryption algorithm.
The user key is only associated with the server and is not associated with the user and the device used by the user. In other words, if design holes exist in the user protection logic design in the system, the service provider can obtain the user key to decrypt the protected content which needs to be encrypted by the user and utilize the content. Therefore, there is a technical problem that security of user information is poor.
In order to solve the technical problem of poor security of user data, the following technical scheme in the embodiment of the present invention may be adopted.
Referring to fig. 1, fig. 1 is a schematic diagram of a main flow of a method for obtaining user data according to an embodiment of the present invention, and authentication is performed from both an apparatus and a user through a client security hardware identifier and user information. As shown in fig. 1, the method specifically comprises the following steps:
s101, the client sends a client security hardware identifier, user information and a client encryption key, wherein the client encryption key is sent by the server in advance.
In the embodiment of the invention, the client and the server trade information, and then the user acquires the user data stored in the server through the client.
Referring to fig. 2, fig. 2 is a schematic diagram of a system implementing a method of acquiring a user according to an embodiment of the present invention. Fig. 2 includes a client and a server. As an example, the client may be a browser in a computer or a mobile terminal. The client side and the client side exchange information with the security hardware. The server side and the server side exchange information with the safety hardware, and the server side and the database exchange information.
Before the client sends the client security hardware identifier, the user information and the client encryption key to the server, the client and the server can be safely connected.
It should be noted that, if the secure connection between the client and the server is already established, the secure connection does not need to be established again. A secure connection between the client and the server may be established through a SM2 public-private key pair.
Specifically, first, the client initiates a connection request to the server, and the server transmits its public key pubkey to the client. The client generates a public key pubkey sm2 of the communication key to be encrypted and transmitted to the server, and the server decrypts the temporary communication key by using a private key sm 2. Then the server and the client encrypt the mutual communication request by using the communication key sm4 and transmit the encrypted communication request.
And if the client needs to acquire the user data, sending the client security hardware identification, the user information and the client encryption key to the server. The client security hardware identification f is an identification connected to the client for determining the client security device. As one example, the client security hardware may be an encryption card or ubskey.
The user information m is information characterizing the user's individual. And collecting and transmitting user information to the server side through the sensor at the client side. As one example, the user information includes one or more of a fingerprint, face information, iris information, and a finger vein.
The client encryption key k1 is stored in the client security hardware, and the client encryption key is sent by the server in advance.
S102, the server side obtains personal information based on the successful verification of the user information.
The server checks whether the biological information is the user information m of the user himself or calls a public security service to check, and acquires the corresponding personal information p (checkbiomessage (m)).
S103, the server generates a server verification key based on the server encryption key, the personal information, the client security hardware identifier and the client encryption key.
As one example, the server side security hardware may generate the server side authentication key based on the server side encryption key, the personal information, the client side security hardware identification, and the client side encryption key. It should be noted that the server side encryption key belongs to the SM4 encryption key. SM4 is a block cipher standard.
Referring to fig. 3, fig. 3 is a schematic flowchart of a process of generating a server-side verification key according to an embodiment of the present invention, which specifically includes the following steps:
s301, the server side sends the personal information, the client side safety hardware identification and the client side encryption key to the server side safety hardware.
And the server side safety hardware is responsible for generating a server side verification key, and the server side sends the personal information, the client side safety hardware identification and the client side encryption key to the server side safety hardware.
S302, the server side safety hardware generates an individual key based on the individual information, and generates a server side verification key according to the server side encryption key, the individual key, the client side safety hardware identification and the client side encryption key.
After the personal information p is made into sm3, the server side security hardware obtains 128 bits p 1-sm 3 (p). p1 is the personal key.
And the server side safety hardware generates a server side verification key according to the server side encryption key, the personal key, the client side safety hardware identifier and the client side encryption key. Specifically, K2 ═ sm4(K, p1, f, K1). K is a server encryption key, and K is a parameter pre-stored in server security hardware.
And S104, the server side safety hardware compares the hash value of the server side verification key with the pre-stored hash value, and sends request data of the client side, wherein the request data is obtained by adopting the server side key for decryption.
And the server side safety hardware compares the hash value of the server side verification key with the pre-stored hash value to determine whether to send the request data of the client side to the client side.
Referring to fig. 4, fig. 4 is a schematic flowchart of a process of sending request data of a client according to an embodiment of the present invention, which specifically includes the following steps:
s401, the server side safety hardware compares the hash value of the server side verification key with the pre-stored hash value to be consistent, and the server side safety hardware loads the encryption request data.
The server security hardware calculates the hash value h1 of the server authentication key, h1 sm3(k 2). And h is a pre-stored hash value compared with h1 by the server-side security hardware. The server side security hardware loads the encrypted request data d 1. The encrypted request data d1 is stored in the database. The server side security hardware loads the encrypted request data d1 from the database.
S402, the server side safety hardware decrypts the encrypted request data according to the server side verification secret key to obtain and send the request data of the client side.
And the server side safety hardware decrypts the encrypted request data according to the server side verification key. That is, the server side security hardware destroys k2 after decrypting the encrypted request data d2 sm4(k2, d 1). The purpose of destroying k2 is to avoid hacking the leakage of k 2. d2 is the request data of the client. The encryption request data d1 is user data stored in advance in a database.
And the server side safety hardware sends the request data of the client side to the client side through the server side.
In the embodiment of fig. 4, the server security hardware compares the hash values to be consistent, and decrypts the encrypted request data and sends the request data of the client.
In the above S101 to S104, a specific process of the client acquiring the user data is exemplarily described.
Before the client obtains the user data, the client needs to obtain the client encryption key from the server, and an exemplary description is given below on how the client obtains the client encryption key from the server.
In the embodiment of the invention, the client sends a client encryption request to the server, the server responds to the client encryption request and feeds back a client encryption key to the client, and the client encryption request comprises the random number of the client security hardware, the client security hardware identifier and the user information.
Referring to fig. 5, fig. 5 is a schematic flowchart of a process of feeding back a client encryption key to a client according to an embodiment of the present invention, which specifically includes:
s501, the client sends a client encryption request.
Before the client sends the client encryption request to the server, the secure connection between the client and the server can be established.
It should be noted that, if the secure connection between the client and the server is already established, the secure connection does not need to be established again. And establishing a secure connection between the client and the server through the SM2 public-private key pair. SM2 is an elliptic curve public key cryptographic algorithm.
The client encryption request comprises a random number of the client security hardware, a client security hardware identifier and user information.
The client security hardware generates a random number n of the client security hardware and a client security hardware identifier f. And collecting and transmitting the user information m to the server side through the sensor at the client side. As one example, the user information includes one or more of a fingerprint, face information, iris information, and a finger vein.
S502, the server side obtains personal information based on the successful verification of the user information.
The server checks whether the biological information is the user information m of the user himself or calls a public security service to check, and acquires the corresponding personal information p (checkbiomessage (m)).
S503, the server side safety hardware generates a primary encryption key based on the random number of the client side safety hardware.
And the server side sends the personal information p, the random number n of the client side safety hardware and the client side safety hardware identification f to the server side safety hardware. The server side safety hardware generates a primary encryption key based on the random number of the client side safety hardware. Specifically, the server security hardware obtains 128 bits p1 ═ sm3(p) after the personal information p sm 3.
The server side security hardware generates a primary encryption key k by using the random number n of the client side security hardware as a seed.
And S504, the server side safety hardware generates and feeds back the client side encryption key to the client side according to the server side encryption key, the personal information, the client side safety hardware identification and the primary encryption key.
And the server-side security hardware calculates the hash value of the primary encryption exempt k, and h is sm3 (k). The server side security hardware encrypts the key K1 sm4(K, p1, f, K). k1 is the client encryption key.
The server side security hardware sends k, k1 and h back to the server side. And the server stores h, namely the preset hash value. The server sends the encryption key k1 back to the client. The client stores k1 in the client security hardware.
And then, the server side safety hardware encrypts user data by adopting the primary encryption key to obtain the encrypted user data, wherein the user data is the request data of the client side.
Specifically, the server transmits user data d to be protected to the server security hardware. And the server side safety hardware encrypts the user data by adopting the primary encryption key to obtain the encrypted user data. d1 sm4(k, d) to avoid leakage of k. The server security hardware sends d1 back to the server.
In S501 to S504, the server side feeds back the client side encryption key to the client side in response to the client side encryption request, and stores the pre-stored hash value in the server side.
After the client obtains the user data, the client needs to update the client security hardware. The following is an exemplary description of a scheme for updating client security hardware.
In the embodiment of the invention, the server side responds to a client side updating request and feeds back a client side updating encryption key to the client side, and the client side updating request comprises a client side original encryption key, a client side safety hardware original identifier, a client side safety hardware updating identifier and user information.
Referring to fig. 6, fig. 6 is a schematic flowchart of a process of feeding back a client updated encryption key to a client according to an embodiment of the present invention, which specifically includes:
s601, the client sends a client updating request.
Before the client sends the client encryption request to the server, the secure connection between the client and the server can be established.
It should be noted that, if the secure connection between the client and the server is already established, the secure connection does not need to be established again. And establishing a secure connection between the client and the server through the SM2 public-private key pair.
The client updating request comprises a client original encryption key k1, a client security hardware original identifier F, a client security hardware updating identifier F and user information m.
And collecting and transmitting the user information m to the server side through the sensor at the client side. As one example, the user information includes one or more of a fingerprint, face information, iris information, and a finger vein.
S602, the server side obtains personal information based on the successful verification of the user information.
The server checks whether the biological information is the user information m of the user himself or calls a public security service to check, and acquires the corresponding personal information p (checkbiomessage (m)).
S603, the server security hardware generates an updated verification key based on the server encryption key, the personal information, the original equipment identifier and the original client encryption key.
The server side security hardware acquires 128 bits p1 sm3(p) after the personal information p, sm 3. The server security hardware will K2 sm4(K, p1, f, K1).
S604, if the hash value of the updated verification key is consistent with the pre-stored hash value, the server security hardware generates and feeds back the client updated encryption key to the client based on the server encryption key, the personal information, the equipment update identifier and the original encryption key of the client.
The server security hardware calculates the hash value of k2, h2 sm3(k 2). And comparing h2 with h, namely h2, namely updating the hash value of the verification key, and h is a pre-stored hash value.
The server side security hardware encrypts the key K3 sm4(K, p1, F, K2), K3 i.e. the client side updates the encryption key.
The server side safety hardware sends k3 back to the server side, and the server side sends the encryption key k3 back to the client side.
In one embodiment of the invention, the client stores the encryption key k3 to the client's new secure hardware, while deleting k1 in the client.
In the embodiment of fig. 6, the server side responds to the client side update request, and feeds back the client side update encryption key to the client side, so as to adopt the new security hardware of the client side.
In the embodiment, the client sends the client security hardware identifier, the user information and the client encryption key, wherein the client encryption key is sent by the server in advance; the server side obtains personal information based on the successful verification of the user information; the server generates a server verification key based on a server encryption key, the personal information, the client security hardware identifier and the client encryption key; and the server compares the hash value of the server verification key with a pre-stored hash value, and sends the request data of the client, wherein the request data is obtained by decrypting the server verification key. In the process of verifying the client by the server, the client not only relates to the safety hardware identification, but also relates to the user information, and the verification is carried out from two aspects of equipment and the user. If the device is not compliant or the user is replaced, the user data cannot be acquired, and thus the security of the user data can be improved.
In the process of acquiring user data, user information, client safety hardware and a server participate in the process, and the safety is guaranteed to the greatest extent. The user information is highly related to the user himself and is difficult to forge. Even if the user data is stolen under extreme conditions, the user data cannot be stolen if the corresponding client security hardware is not available.
The client encryption key and the user data are stored and kept respectively, and meanwhile, the probability of being stolen and cracked is greatly lower than that of the existing scheme. When the encryption key of the client is stolen independently, an attacker cannot acquire user data; when the user data is stolen independently, the encryption key of the client cannot be obtained.
Referring to fig. 7, fig. 7 is a schematic diagram of a main structure of a system for acquiring user data according to an embodiment of the present invention, where the system for acquiring user data can implement a method for acquiring user data, and as shown in fig. 7, the system for acquiring user data specifically includes: client 701, client security hardware 702, server 703, and server security hardware 704,
the client 701 sends a client security hardware identifier, user information and a client encryption key, wherein the client encryption key is sent by a server in advance;
the server 703 obtains personal information based on the successful verification of the user information;
the server 703 generates a server verification key based on the server encryption key, the personal information, the client security hardware identifier, and the client encryption key;
and the server side safety hardware 704 compares that the hash value of the server side verification key is consistent with the pre-stored hash value, and sends the request data of the client side, wherein the request data is obtained by adopting the server side verification key to decrypt.
In one embodiment of the invention, a secure connection between the client 701 and the server 703 is established through a SM2 public-private key pair.
In one embodiment of the invention, the client encryption key is obtained from client security hardware.
In an embodiment of the present invention, the server 703 sends the personal information, the client security hardware identifier, and the client encryption key to the server security hardware 704;
the server side security hardware 704 generates a personal key based on the personal information, and generates a server side verification key according to the server side encryption key, the personal key, the client side security hardware identifier and the client side encryption key.
In an embodiment of the present invention, if the server-side security hardware 704 compares that the hash value of the server-side verification key is consistent with the pre-stored hash value, the server-side security hardware 704 loads the encryption request data;
the server security hardware 704 decrypts the encrypted request data according to the server verification key to obtain and send the request data of the client.
In one embodiment of the invention, the encrypted request data is user data pre-stored in a database.
In an embodiment of the present invention, the server 703 feeds back the client encryption key to the client 701 in response to the client encryption request, where the client encryption request includes the random number of the client security hardware, the client security hardware identifier, and the user information.
In one embodiment of the present invention, the client 701 sends the client encryption request;
the server 703 obtains personal information based on the successful verification of the user information;
the server side security hardware 704 generates a primary encryption key based on the random number of the client side security hardware;
the server side security hardware 704 generates and feeds back the client side encryption key to the client side 701 according to the server side encryption key, the personal information, the client side security hardware identifier and the primary encryption key.
In an embodiment of the present invention, the server security hardware 704 encrypts user data using the primary encryption key to obtain encrypted user data, where the user data is request data of the client.
In an embodiment of the present invention, the server 703 uses the hash value of the primary encryption key as the preset hash value.
In one embodiment of the invention, a secure connection between the client 701 and the server 703 is established through a SM2 public-private key pair.
In an embodiment of the present invention, the server 703 responds to the client update request, and feeds back the client update encryption key to the client 701, where the client update request includes the client original encryption key, the client secure hardware original identifier, the client secure hardware update identifier, and the user information.
In one embodiment of the present invention, the client 701 sends the client update request;
the server 703 obtains personal information based on the successful verification of the user information;
the server security hardware 704 generates an update verification key based on a server encryption key, the personal information, the device original identifier and the client original encryption key;
if the hash value of the update verification key is consistent with the pre-stored hash value, the server security hardware 704 generates and feeds back the client update encryption key to the client 701 based on the server encryption key, the personal information, the device update identifier, and the client original encryption key.
In one embodiment of the invention, the client 701 stores the client update encryption key to the client's new security hardware 702.
In an embodiment of the present invention, the original encryption key of the client in the client 701 is deleted.
In one embodiment of the invention, a secure connection between the client 701 and the server 703 is established through a SM2 public-private key pair.
In one embodiment of the invention, the server side encryption key belongs to the SM4 encryption key.
Fig. 8 shows an exemplary system architecture 800 of a method of acquiring user data or a system of acquiring user data to which embodiments of the invention may be applied.
As shown in fig. 8, the system architecture 800 may include terminal devices 801, 802, 803, a network 804, and a server 805. The network 804 serves to provide a medium for communication links between the terminal devices 801, 802, 803 and the server 805. Network 804 may include various types of connections, such as wire, wireless communication links, or fiber optic cables, to name a few.
A user may use the terminal devices 801, 802, 803 to interact with a server 805 over a network 804 to receive or send messages or the like. The terminal devices 801, 802, 803 may have installed thereon various communication client applications, such as shopping-like applications, web browser applications, search-like applications, instant messaging tools, mailbox clients, social platform software, etc. (by way of example only).
The terminal devices 801, 802, 803 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop portable computers, desktop computers, and the like.
The server 805 may be a server that provides various services, such as a back-office management server (for example only) that supports shopping-like websites browsed by users using the terminal devices 801, 802, 803. The backend management server may analyze and perform other processing on the received data such as the product information query request, and feed back a processing result (for example, target push information, product information — just an example) to the terminal device.
It should be noted that the method for acquiring user data provided by the embodiment of the present invention is generally executed by the server 805, and accordingly, a system for acquiring user data is generally disposed in the server 805.
It should be understood that the number of terminal devices, networks, and servers in fig. 8 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.
Referring now to FIG. 9, shown is a block diagram of a computer system 900 suitable for use with a terminal device implementing an embodiment of the present invention. The terminal device shown in fig. 9 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present invention.
As shown in fig. 9, the computer system 900 includes a Central Processing Unit (CPU)901 that can perform various appropriate actions and processes in accordance with a program stored in a Read Only Memory (ROM)902 or a program loaded from a storage section 908 into a Random Access Memory (RAM) 903. In the RAM 903, various programs and data necessary for the operation of the system 900 are also stored. The CPU 901, ROM 902, and RAM 903 are connected to each other via a bus 904. An input/output (I/O) interface 905 is also connected to bus 904.
The following components are connected to the I/O interface 905: an input portion 906 including a keyboard, a mouse, and the like; an output section 907 including components such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage portion 908 including a hard disk and the like; and a communication section 909 including a network interface card such as a LAN card, a modem, or the like. The communication section 909 performs communication processing via a network such as the internet. The drive 910 is also connected to the I/O interface 905 as necessary. A removable medium 911 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 910 as necessary, so that a computer program read out therefrom is mounted into the storage section 908 as necessary.
In particular, according to the embodiments of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 909, and/or installed from the removable medium 911. The above-described functions defined in the system of the present invention are executed when the computer program is executed by a Central Processing Unit (CPU) 901.
It should be noted that the computer readable medium shown in the present invention can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present invention, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present invention, however, a computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The modules described in the embodiments of the present invention may be implemented by software or hardware. The described modules may also be provided in a processor, which may be described as: a processor includes a client and a server. Where the names of these modules do not in some cases constitute a limitation on the modules themselves, for example, the client may also be described as "sending client security hardware identification, user information, and client encryption key.
As another aspect, the present invention also provides a computer-readable medium that may be contained in the apparatus described in the above embodiments; or may be separate and not incorporated into the device. The computer readable medium carries one or more programs which, when executed by a device, cause the device to comprise:
the client sends a client security hardware identifier, user information and a client encryption key, wherein the client encryption key is sent by the server in advance;
the server side obtains personal information based on the successful verification of the user information;
the server generates a server verification key based on a server encryption key, the personal information, the client security hardware identifier and the client encryption key;
and the server side safety hardware compares the hash value of the server side verification key with the pre-stored hash value, and sends the request data of the client side, wherein the request data is obtained by adopting the server side verification key to decrypt.
According to the technical scheme of the embodiment of the invention, the client sends the client security hardware identification, the user information and the client encryption key which is sent by the server in advance; the server side obtains personal information based on the successful verification of the user information; the server generates a server verification key based on a server encryption key, the personal information, the client security hardware identifier and the client encryption key; and the server compares the hash value of the server verification key with a pre-stored hash value, and sends the request data of the client, wherein the request data is obtained by decrypting the server verification key. In the process of verifying the client by the server, the client not only relates to the safety hardware identification, but also relates to the user information, and the verification is carried out from two aspects of equipment and the user. If the device is not compliant or the user is replaced, the user data cannot be acquired, and thus the security of the user data can be improved.
The above-described embodiments should not be construed as limiting the scope of the invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions can occur, depending on design requirements and other factors. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims (20)
1. A method for obtaining user data, comprising:
the client sends a client security hardware identifier, user information and a client encryption key, wherein the client encryption key is sent by the server in advance;
the server side obtains personal information based on the successful verification of the user information;
the server generates a server verification key based on a server encryption key, the personal information, the client security hardware identifier and the client encryption key;
and the server side safety hardware compares the hash value of the server side verification key with the pre-stored hash value, and sends the request data of the client side, wherein the request data is obtained by adopting the server side verification key to decrypt.
2. The method of claim 1, wherein before the client sends the client security hardware identifier, the user information, and the client encryption key, the method further comprises:
and establishing a secure connection between the client and the server through an SM2 public and private key pair.
3. The method of claim 1, wherein the client encryption key is obtained from client security hardware.
4. The method of claim 1, wherein the server generates a server authentication key based on a server encryption key, the personal information, the client security hardware identifier, and the client encryption key, comprising:
the server side sends the personal information, the client side safety hardware identification and the client side encryption key to server side safety hardware;
and the server side safety hardware generates a personal key based on the personal information, and generates a server side verification key according to the server side encryption key, the personal key, the client side safety hardware identifier and the client side encryption key.
5. The method of claim 1, wherein the step of sending the request data of the client by the server security hardware comparing the hash value of the server authentication key with the pre-stored hash value is performed, comprises:
the server side safety hardware compares the hash value of the server side verification key with the pre-stored hash value to be consistent, and the server side safety hardware loads encryption request data;
and the server side safety hardware decrypts the encrypted request data according to the server side verification key to obtain and send the request data of the client side.
6. The method for acquiring user data according to claim 5, wherein the encrypted request data is user data pre-stored in a database.
7. The method of claim 1, further comprising:
and the server side responds to the client side encryption request and feeds back the client side encryption key to the client side, wherein the client side encryption request comprises the random number of the client side security hardware, the client side security hardware identification and the user information.
8. The method for obtaining user data according to claim 7, wherein the server side feeds back the client side encryption key to the client side in response to the client side encryption request, and comprises:
the client sends the client encryption request;
the server side obtains personal information based on the successful verification of the user information;
the server side safety hardware generates a primary encryption key based on the random number of the client side safety hardware;
and the server side safety hardware generates and feeds back the client side encryption key to the client side according to the server side encryption key, the personal information, the client side safety hardware identification and the primary encryption key.
9. The method of claim 8, wherein after the server-side security hardware generates and feeds back the client-side encryption key to the client according to the server-side encryption key, the personal information, the client-side security hardware identifier, and the primary encryption key, the method further comprises:
and the server side safety hardware encrypts user data by adopting the primary encryption key to obtain the encrypted user data, wherein the user data is the request data of the client side.
10. The method of claim 8, wherein after the server generates and feeds back the client encryption key to the client according to the server encryption key, the personal information, the client security hardware identifier, and the primary encryption key, the method further comprises:
and the server takes the hash value of the primary encryption key as the preset hash value.
11. The method of claim 8, wherein before the client sends the client encryption request, the method further comprises:
and establishing a secure connection between the client and the server through an SM2 public and private key pair.
12. The method of claim 1, further comprising:
and the server side responds to the client side updating request and feeds back the client side updating encryption key to the client side, wherein the client side updating request comprises the client side original encryption key, the client side safety hardware original identification, the client side safety hardware updating identification and the user information.
13. The method for obtaining user data according to claim 12, wherein the server side feeds back the client side updated encryption key to the client side in response to the client side update request, and includes:
the client sends the client updating request;
the server side obtains personal information based on the successful verification of the user information;
the server side safety hardware generates an updating verification key based on a server side encryption key, the personal information, the original equipment identifier and the original client side encryption key;
and if the hash value of the update verification key is consistent with the pre-stored hash value, the server side safety hardware generates and feeds back the client side update encryption key to the client side based on the server side encryption key, the personal information, the equipment update identification and the original encryption key of the client side.
14. The method of claim 12, further comprising:
and the client side stores the client side updated encryption key to the new safety hardware of the client side.
15. The method for obtaining user data according to claim 14, wherein after the client updates the client updated encryption key to client security hardware, the method further comprises:
and deleting the original encryption key of the client in the client.
16. The method of claim 13, wherein before the client sends the client update request, the method further comprises:
and establishing a secure connection between the client and the server through an SM2 public and private key pair.
17. The method of claim 1, wherein the server-side encryption key belongs to an SM4 encryption key.
18. A system for acquiring user data is characterized by comprising a client, a server and server security hardware,
the client sends a client security hardware identifier, user information and a client encryption key, wherein the client encryption key is sent by the server in advance;
the server side obtains personal information based on the successful verification of the user information;
the server generates a server verification key based on a server encryption key, the personal information, the client security hardware identifier and the client encryption key;
and the server side safety hardware compares the hash value of the server side verification key with the pre-stored hash value, and sends the request data of the client side, wherein the request data is obtained by adopting the server side verification key to decrypt.
19. An electronic device for obtaining user data, comprising:
one or more processors;
a storage device for storing one or more programs,
when executed by the one or more processors, cause the one or more processors to implement the method of any one of claims 1-17.
20. A computer-readable medium, on which a computer program is stored, which, when being executed by a processor, carries out the method according to any one of claims 1-17.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110340077.3A CN112966287B (en) | 2021-03-30 | 2021-03-30 | Method, system, device and computer readable medium for acquiring user data |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110340077.3A CN112966287B (en) | 2021-03-30 | 2021-03-30 | Method, system, device and computer readable medium for acquiring user data |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112966287A true CN112966287A (en) | 2021-06-15 |
| CN112966287B CN112966287B (en) | 2022-12-13 |
Family
ID=76279612
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110340077.3A Active CN112966287B (en) | 2021-03-30 | 2021-03-30 | Method, system, device and computer readable medium for acquiring user data |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112966287B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113704744A (en) * | 2021-07-21 | 2021-11-26 | 阿里巴巴（中国）有限公司 | Data processing method and device |
| CN114095165A (en) * | 2021-11-22 | 2022-02-25 | 中国建设银行股份有限公司 | Key updating method, server device, client device and storage medium |
| CN115913755A (en) * | 2022-12-07 | 2023-04-04 | 重庆紫光华山智安科技有限公司 | Data encryption transmission method, device, equipment and medium |
Citations (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2004147252A (en) * | 2002-10-28 | 2004-05-20 | Tdk Corp | Electronic certificate, forming method therefor, and authentication system by electronic certificate |
| JP2004178565A (en) * | 2002-10-31 | 2004-06-24 | Win One's Way Co Ltd | Server for communication management, communication method and program |
| US20080130899A1 (en) * | 2006-12-04 | 2008-06-05 | Fujitsu Limited | Access authentication system, access authentication method, and program storing medium storing programs thereof |
| JP2009146067A (en) * | 2007-12-12 | 2009-07-02 | Fujitsu Ltd | File access authentication system, file access authentication method, and file access authentication program |
| AU2009295193A1 (en) * | 2008-09-22 | 2010-03-25 | Tefaye, Joseph Elie Mr | Method and system for user authentication |
| CN102315942A (en) * | 2011-09-30 | 2012-01-11 | 福源立信（北京）科技有限公司 | Security terminal with Bluetooth and communication method thereof of security terminal and client end |
| CN103679436A (en) * | 2013-12-17 | 2014-03-26 | 重庆邮电大学 | Electronic contract security system and method based on biological information identification |
| WO2014094468A1 (en) * | 2012-12-17 | 2014-06-26 | 北京奇虎科技有限公司 | System, method and browser client for enabling browser data synchronization |
| CN103995991A (en) * | 2014-05-07 | 2014-08-20 | 华中师范大学 | Method for binding hardware information and secret keys in software copyright protection |
| US20150318998A1 (en) * | 2014-05-05 | 2015-11-05 | Securekey Technologies Inc. | Methods and systems for client-enhanced challenge-response authentication |
| CA3005915A1 (en) * | 2015-12-11 | 2017-06-15 | Amazon Technologies, Inc. | Key exchange through partially trusted third party |
| CN108769007A (en) * | 2018-05-28 | 2018-11-06 | 上海顺舟智能科技股份有限公司 | Gateway security authentication method, server and gateway |
| US20180357432A1 (en) * | 2017-06-07 | 2018-12-13 | Combined Conditional Access Development & Support, LLC | Determining a Session Key Using Session Data |
| CN111193585A (en) * | 2019-09-24 | 2020-05-22 | 腾讯科技（深圳）有限公司 | Communication request management method and device |
| CN111628863A (en) * | 2020-05-29 | 2020-09-04 | 北京海泰方圆科技股份有限公司 | Data signature method and device, electronic equipment and storage medium |
| CN111740844A (en) * | 2020-06-24 | 2020-10-02 | 上海缔安科技股份有限公司 | SSL communication method and device based on hardware cryptographic algorithm |
-
2021
- 2021-03-30 CN CN202110340077.3A patent/CN112966287B/en active Active
Patent Citations (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2004147252A (en) * | 2002-10-28 | 2004-05-20 | Tdk Corp | Electronic certificate, forming method therefor, and authentication system by electronic certificate |
| JP2004178565A (en) * | 2002-10-31 | 2004-06-24 | Win One's Way Co Ltd | Server for communication management, communication method and program |
| US20080130899A1 (en) * | 2006-12-04 | 2008-06-05 | Fujitsu Limited | Access authentication system, access authentication method, and program storing medium storing programs thereof |
| JP2009146067A (en) * | 2007-12-12 | 2009-07-02 | Fujitsu Ltd | File access authentication system, file access authentication method, and file access authentication program |
| AU2009295193A1 (en) * | 2008-09-22 | 2010-03-25 | Tefaye, Joseph Elie Mr | Method and system for user authentication |
| CN102315942A (en) * | 2011-09-30 | 2012-01-11 | 福源立信（北京）科技有限公司 | Security terminal with Bluetooth and communication method thereof of security terminal and client end |
| WO2014094468A1 (en) * | 2012-12-17 | 2014-06-26 | 北京奇虎科技有限公司 | System, method and browser client for enabling browser data synchronization |
| CN103679436A (en) * | 2013-12-17 | 2014-03-26 | 重庆邮电大学 | Electronic contract security system and method based on biological information identification |
| US20150318998A1 (en) * | 2014-05-05 | 2015-11-05 | Securekey Technologies Inc. | Methods and systems for client-enhanced challenge-response authentication |
| CN103995991A (en) * | 2014-05-07 | 2014-08-20 | 华中师范大学 | Method for binding hardware information and secret keys in software copyright protection |
| CA3005915A1 (en) * | 2015-12-11 | 2017-06-15 | Amazon Technologies, Inc. | Key exchange through partially trusted third party |
| US20180357432A1 (en) * | 2017-06-07 | 2018-12-13 | Combined Conditional Access Development & Support, LLC | Determining a Session Key Using Session Data |
| CN108769007A (en) * | 2018-05-28 | 2018-11-06 | 上海顺舟智能科技股份有限公司 | Gateway security authentication method, server and gateway |
| CN111193585A (en) * | 2019-09-24 | 2020-05-22 | 腾讯科技（深圳）有限公司 | Communication request management method and device |
| CN111628863A (en) * | 2020-05-29 | 2020-09-04 | 北京海泰方圆科技股份有限公司 | Data signature method and device, electronic equipment and storage medium |
| CN111740844A (en) * | 2020-06-24 | 2020-10-02 | 上海缔安科技股份有限公司 | SSL communication method and device based on hardware cryptographic algorithm |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113704744A (en) * | 2021-07-21 | 2021-11-26 | 阿里巴巴（中国）有限公司 | Data processing method and device |
| CN114095165A (en) * | 2021-11-22 | 2022-02-25 | 中国建设银行股份有限公司 | Key updating method, server device, client device and storage medium |
| CN114095165B (en) * | 2021-11-22 | 2024-04-26 | 中国建设银行股份有限公司 | Key updating method, server device, client device and storage medium |
| CN115913755A (en) * | 2022-12-07 | 2023-04-04 | 重庆紫光华山智安科技有限公司 | Data encryption transmission method, device, equipment and medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112966287B (en) | 2022-12-13 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US8447970B2 (en) | Securing out-of-band messages | |
| CN112966287B (en) | Method, system, device and computer readable medium for acquiring user data | |
| CN111737366B (en) | Private data processing method, device, equipment and storage medium of block chain | |
| EP4191430A1 (en) | Data processing method and apparatus applied to blockchain system | |
| US10601590B1 (en) | Secure secrets in hardware security module for use by protected function in trusted execution environment | |
| CN110611657A (en) | File stream processing method, device and system based on block chain | |
| CN114024710A (en) | Data transmission method, device, system and equipment | |
| CN112182514A (en) | Method, apparatus, device and computer readable medium for authorization verification | |
| US10063655B2 (en) | Information processing method, trusted server, and cloud server | |
| CN112437044B (en) | Instant messaging method and device | |
| CN115473655B (en) | Terminal authentication method, device and storage medium for access network | |
| CN110022207B (en) | Method, apparatus, device and computer readable medium for key management and data processing | |
| CN114095165B (en) | Key updating method, server device, client device and storage medium | |
| CN110602075A (en) | File stream processing method, device and system for encryption access control | |
| EP4206906A1 (en) | Processing system and method for updating firmware online | |
| CN113992702B (en) | Ceph distributed file system storage state password reinforcement method and system | |
| CN112966286B (en) | Method, system, device and computer readable medium for user login | |
| CN112565156B (en) | Information registration method, device and system | |
| CN115022057A (en) | Security authentication method, device and equipment and storage medium | |
| CN114417309A (en) | Bidirectional identity authentication method, device, equipment and storage medium | |
| CN113872979A (en) | Login authentication method and device, electronic equipment and computer-readable storage medium | |
| CN109639409B (en) | Key initialization method, key initialization device, electronic equipment and computer-readable storage medium | |
| CN113626848A (en) | Sample data generation method and device, electronic equipment and computer readable medium | |
| US10313315B2 (en) | Ensuring information security in data transfers by utilizing proximity keys | |
| CN110166226B (en) | Method and device for generating secret key |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20220928 Address after: 25 Financial Street, Xicheng District, Beijing 100033 Applicant after: CHINA CONSTRUCTION BANK Corp. Address before: 12 / F, 15 / F, No. 99, Yincheng Road, Shanghai pilot Free Trade Zone, 200120 Applicant before: Jianxin Financial Science and Technology Co.,Ltd. |
|
| TA01 | Transfer of patent application right | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |