WO2016146046A1 - 数据访问方法及装置 - Google Patents

数据访问方法及装置 Download PDF

Info

Publication number
WO2016146046A1
WO2016146046A1 PCT/CN2016/076304 CN2016076304W WO2016146046A1 WO 2016146046 A1 WO2016146046 A1 WO 2016146046A1 CN 2016076304 W CN2016076304 W CN 2016076304W WO 2016146046 A1 WO2016146046 A1 WO 2016146046A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
data
access
encrypted data
access request
Prior art date
Application number
PCT/CN2016/076304
Other languages
English (en)
French (fr)
Inventor
阳翰凌
袁磊
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016146046A1 publication Critical patent/WO2016146046A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Definitions

  • the present invention relates to the field of terminal information processing technologies, and in particular, to a data access method and apparatus.
  • the remotely locked mobile phone can send a pre-set code to the lost mobile phone through the third-party mobile phone after accidentally losing the mobile phone, and the lost mobile phone completes the locking of the mobile phone according to the code, prohibiting the access and operation of the mobile phone.
  • this locking mode after the computer is used to brush the mobile phone, these protective functions will be ineffective, and the company confidential data will leak;
  • Setting remote wipe data is to set up Exchange mailbox synchronization in the smart phone.
  • all the data of the mobile phone device can be remotely cleared on the post office management panel, and the mobile phone device can be restored to the factory setting state to prevent data leakage.
  • remote data erasing can only clear the data in the phone's memory, and can't clear the data saved on the memory card.
  • the main purpose of the present invention is to provide a data access method and device, which are intended to solve the problem that the data access cannot be actively controlled under the existing data security protection mode, and the data leakage may occur when the terminal is lost or intercepted by a third-party software.
  • the problem of making data security poor is to provide a data access method and device, which are intended to solve the problem that the data access cannot be actively controlled under the existing data security protection mode, and the data leakage may occur when the terminal is lost or intercepted by a third-party software.
  • a data access method includes the steps of: detecting whether a terminal is within a preset location range when receiving an access request for encrypted data; and detecting that the terminal is within a preset location range And establishing a connection with the terminal; after establishing a connection with the terminal, acquiring the encrypted data and the key corresponding to the access request; sending the encrypted data and the key to the terminal, for the terminal to The key decrypts the encrypted data and displays the decrypted encrypted data.
  • the step of detecting whether the terminal is in the preset location range comprises: detecting whether the terminal accesses a preset hotspot; determining that the terminal is in a preset location when detecting that the terminal accesses the preset hotspot Within the scope.
  • the step of establishing a connection with the terminal includes: determining, when the terminal is within the preset location range, determining whether the user corresponding to the access request is The login succeeds; when the user corresponding to the access request successfully logs in, the identity information of the user is determined; and the connection is established with the terminal by using the identity information.
  • the method further includes: when detecting that the terminal is not within the preset location range, the control terminal clears the cache data corresponding to the identity information; After the terminal clears the cached data corresponding to the identity information, the terminal disconnects from the terminal.
  • the step of acquiring the encrypted data and the key corresponding to the access request includes: acquiring the access authority information of the encrypted data corresponding to the access request when establishing a connection with the terminal; determining, according to the obtained access authority Whether the terminal has the access authority of the encrypted data; when the terminal has the access authority of the encrypted data, acquiring the encrypted data and the key corresponding to the access request; if the terminal does not have the encrypted data When the access authority is accessed, the prompt information that the terminal does not have permission to access the encrypted data is issued.
  • an embodiment of the present invention further provides a data access apparatus, including: a detecting module, configured to detect whether a terminal is within a preset location range when receiving an access request for encrypted data; establishing a module, setting When the terminal is in the preset location range, the connection is established with the terminal; the acquiring module is configured to acquire the encrypted data and the key corresponding to the access request after establishing the connection with the terminal; and the processing module, It is arranged to send the encrypted data and the key to the terminal, so that the terminal decrypts the encrypted data according to the key and displays the decrypted encrypted data.
  • the detecting module includes a detecting unit and a determining unit, the detecting unit is configured to detect whether the terminal accesses a preset hotspot; the determining unit is configured to detect that the terminal accesses a preset hot spot At the time, it is determined that the terminal is within a preset position range.
  • the establishing module includes a determining unit and an establishing unit, and the determining unit is further configured to: determine, when the terminal is within the preset location range, whether the user corresponding to the access request is successfully logged in; And determining, when the user corresponding to the access request is successfully logged in, the identity information of the user, where the establishing unit is configured to establish a connection with the terminal by using the identity information.
  • the data access device further includes: a control module, configured to: when detecting that the terminal is not within the preset location range, the control terminal clears the cache data corresponding to the identity information; and the disconnecting module is configured to detect After the terminal clears the cached data corresponding to the identity information, the connection with the terminal is disconnected.
  • a control module configured to: when detecting that the terminal is not within the preset location range, the control terminal clears the cache data corresponding to the identity information
  • the disconnecting module is configured to detect After the terminal clears the cached data corresponding to the identity information, the connection with the terminal is disconnected.
  • the obtaining module includes an obtaining unit, a prompting unit, and a determining unit, and the obtaining unit is configured to acquire an access right of the encrypted data corresponding to the access request when establishing a connection with the terminal; And setting, when the terminal does not have the access permission of the encrypted data, sending the prompt information that the terminal does not have permission to access the encrypted data; the determining unit is configured to determine the terminal according to the acquired access right Whether there is the encryption The access unit is further configured to acquire the encrypted data and the key corresponding to the access request when the terminal has the access permission of the encrypted data.
  • the embodiment of the present invention detects the access request of the encrypted data in the preset location range, establishes a connection with the terminal, and acquires the encrypted data and the key corresponding to the access request, and the encrypted data is obtained. And transmitting a key to the terminal for the terminal to decrypt and display the encrypted data according to the key. It effectively avoids the problem of uncontrollable data access in the existing data security protection mode.
  • the terminal is lost or intercepted by third-party software, data leakage is easily caused, resulting in poor data security.
  • the terminal is detected within the preset location range, the data is actively controlled to be accessed, and the data is not easily leaked when the terminal is lost or intercepted by the third-party software, thereby improving data security.
  • FIG. 1 is a schematic flowchart of a first embodiment of a data access method according to the present invention
  • FIG. 2 is a schematic flow chart of an embodiment of step S10 of FIG. 1;
  • FIG. 3 is a schematic flowchart of a second embodiment of a data access method according to the present invention.
  • FIG. 4 is a schematic flowchart diagram of a third embodiment of a data access method according to the present invention.
  • FIG. 5 is a schematic diagram of functional modules of a first embodiment of a data access device according to the present invention.
  • FIG. 6 is a schematic diagram of a refinement function module of an embodiment of the detection module of FIG. 5;
  • FIG. 7 is a schematic diagram of a refinement function module of an embodiment of building a module in FIG. 5;
  • FIG. 8 is a schematic diagram of functional modules of a second embodiment of a data access device according to the present invention.
  • FIG. 9 is a schematic diagram of a refinement function module of an embodiment of the acquisition module of FIG. 5.
  • FIG. 9 is a schematic diagram of a refinement function module of an embodiment of the acquisition module of FIG. 5.
  • the main solution of the embodiment of the present invention is: detecting whether the terminal is within a preset location range when receiving the access request for the encrypted data; establishing a connection with the terminal when detecting that the terminal is within the preset location range; After establishing a connection with the terminal, acquiring the encrypted data and the key corresponding to the access request; sending the encrypted data and the key to the terminal, so that the terminal decrypts the encrypted data according to the key and displays Decrypted encrypted data.
  • Receiving an access request for the encrypted data by detecting that the terminal is within the preset location range, establishing a connection with the terminal, acquiring the encrypted data and the key corresponding to the access request, and transmitting the encrypted data and the key to the terminal for providing
  • the terminal decrypts the encrypted number according to the key According to and show. Effectively avoiding the data security protection mode, it is impossible to actively control the access of data, which leads to the data leakage when the terminal is lost or intercepted by third-party software, which makes the data security poor.
  • the terminal is detected within the preset location range, the data is actively controlled to be accessed, and the data is not easily leaked when the terminal is lost or intercepted by the third-party software, thereby improving data security.
  • the present invention provides a data access method.
  • FIG. 1 is a schematic flowchart diagram of a first embodiment of a data access method according to the present invention.
  • the data access method comprises:
  • Step S10 When receiving an access request for the encrypted data, detecting whether the terminal is within a preset location range;
  • the special data includes, but is not limited to, encrypted data, confidential data or private data or enterprise data, trade secrets and the like.
  • the server saves the encrypted data corresponding to the access request, the basic information of the user, the authority of the user, records the data when and where the user accesses, and saves the key related to the user identity, in order to ensure the security of the key. Sex, you can deploy the server that manages the keys separately.
  • the process of detecting whether the terminal is within a preset location range includes:
  • Step S11 detecting whether the terminal accesses a preset hot spot
  • Step S12 When the terminal accesses the preset hotspot, it is determined that the terminal is within the preset location range.
  • the preset hotspot may be a hotspot for the user to access the hotspot and the Internet for communication, such as a Wi-Fi hotspot, and the coverage of the preset hotspot may be set according to the needs of the user.
  • the access mode of the preset hotspot may adopt a connection manner such as Wi-Fi, Bluetooth, or NFC.
  • the access of the preset hotspot in the embodiment is preferably Bluetooth or NFC. For example, when an NFC-enabled terminal is connected to a preset Wi-Fi hotspot, when an NFC-enabled terminal is placed on a preset NFC intelligent terminal bay, the NFC-enabled terminal passes the NFC on the sensing bay. A tag that is connected to the preset Wi-Fi hotspot.
  • the server determines that the terminal is not within the preset location range, that is, the access request corresponds to the user not being in a specific location that allows access to the data.
  • the process of detecting whether the terminal is within a preset location range includes: pre-preserving a preset location, for example, a location of a company, acquiring a location of the terminal, and setting the location of the terminal with the preset When the location is matched, it is determined that the terminal is within a preset location range; when the location of the terminal does not match the preset location, it is determined that the terminal is not within the preset location range. It is also possible to determine whether the terminal is within a preset location range in a manner well known to those skilled in the art, and will not be exemplified herein.
  • Step S20 when detecting that the terminal is within the preset location range, establishing a connection with the terminal;
  • the connection may be a heartbeat connection, and the data transmission channel between the server and the terminal is opened by establishing a TCP protocol or a UDP protocol.
  • Receiving, by the server, the data packet sent by the terminal if the server responds to the data packet sent by the terminal within a certain time (2 seconds or 3 seconds), determining that the server establishes a connection with the terminal successfully, and opening the terminal with the terminal Data transmission channel.
  • other protocols may also be employed to establish the connection and open a data transmission channel with the terminal.
  • Step S30 Acquire encrypted data and a key corresponding to the access request when establishing a connection with the terminal;
  • the key is associated with the identity information of the user corresponding to the access request, and the identity information may be, for example, an account of the user, an access timestamp, etc., and is set according to the needs of the user.
  • the timestamp is the time when the file is created, modified, and accessed in the file attribute.
  • the timestamp is an encrypted document file, and the file that needs to be time-stamped is first encrypted with a hash code to form a digest, and then the digest is sent to the DTS, and the DTS joins the date and time information of the received file digest.
  • the hash code is a hash coding algorithm, that is, a hash coding algorithm, which maps binary values of arbitrary length into shorter fixed-length binary values, and this small binary value is called a hash value.
  • a hash value is a unique and extremely compact numerical representation of a piece of data. If you hash a plaintext and even change only one letter of the paragraph, the subsequent hash encoding algorithm will produce different values. It is computationally impossible to find two different inputs that are hashed to the same value, so the hash of the data can verify the integrity of the data. Can be used for fast lookup and encryption algorithms.
  • Step S40 Send the encrypted data and the key to the terminal, so that the terminal decrypts the encrypted data according to the key and displays the decrypted encrypted data.
  • the server After obtaining the encrypted data and the key, the server sends the encrypted data and the key to the terminal, and the terminal decrypts the encrypted data according to the key to obtain target data, and displays the displayed on the terminal screen.
  • Target data The manner of encrypting and decrypting data may adopt other public encryption and decryption algorithms such as SHA, RSA algorithm, data encryption standard DES, etc., according to system performance settings.
  • the control terminal clears the buffered encrypted data, and disconnects the terminal, and cancels the terminal access.
  • the permission to encrypt data that is, the access to the encrypted data only when the terminal is in the preset location range, can access the encrypted data.
  • the terminal detects the access request of the encrypted data in the preset location range, establishes a connection with the terminal, acquires the encrypted data and the key corresponding to the access request, and sends the encrypted data and the key to the terminal. And the terminal decrypts the encrypted data according to the key and displays it. It effectively avoids the problem of uncontrollable data access in the existing data security protection mode.
  • the terminal is lost or intercepted by third-party software, data leakage is easily caused, resulting in poor data security.
  • the terminal is detected within the preset location range, the data is actively controlled to be accessed, and the data is not easily leaked when the terminal is lost or intercepted by the third-party software, thereby improving data security.
  • FIG. 3 is a schematic flowchart diagram of a second embodiment of a data access method according to the present invention. Based on the first embodiment of the data access method, the step S20 includes:
  • Step S21 when it is detected that the terminal is within a preset location range, determine whether the user corresponding to the access request is login successful;
  • the server determines whether the user corresponding to the access request is successfully logged in, and the user can complete the login operation by using the following login manner, for example, by receiving a password, voice, or Login of a login method such as face recognition login, which is set according to the needs of the user and/or performance setting of the system.
  • the login mode is exemplified by the face recognition login.
  • the camera of the terminal is opened for the terminal to acquire the face image of the user corresponding to the access request, and the face image is matched with the pre-stored face image to determine the face image.
  • the degree of similarity with the pre-stored face image determines whether the similarity reaches a preset threshold. When the similarity reaches a preset threshold, it is determined that the user corresponding to the access request successfully logs in.
  • the preset threshold may be 80%, 90%, etc. according to the needs of the user and/or the performance setting of the system.
  • the control terminal When the similarity does not reach the preset threshold, the prompt information of the user login failure corresponding to the access request is sent, the control terminal enters the lock mode, the operation interface of the current working client is locked, and the access operation of the client data is cut off to prevent Data loss or leakage, etc., further improve the security of the data.
  • Step S22 determining, when the user corresponding to the access request successfully logs in, the identity information of the user
  • Step S23 establishing a connection with the terminal by using the identity information.
  • the establishing the connection is that the server determines the identity information of the user when the user corresponding to the access request is successfully logged in, and establishes a connection with the terminal by using the identity information.
  • the method further includes:
  • Step S24 when detecting that the terminal is not within the preset location range, the control terminal clears the cache data corresponding to the identity information
  • Step S25 After detecting that the terminal clears the cache data corresponding to the identity information, disconnect the connection with the terminal.
  • the control terminal When the server detects that the terminal is not in the preset location range, that is, after the user corresponding to the access request leaves the coverage of the hotspot, the control terminal clears the cached data corresponding to the identity information, and automatically disconnects the device. The connection of the terminal. After the terminal leaves the preset location range, the control terminal clears the data stored locally in the terminal, prevents the terminal from accessing the unsecured hotspot at other locations, and causes data loss, thereby further improving the security of data access.
  • the method determines whether the user corresponding to the access request successfully logs in, and establishes a connection with the terminal when the user corresponding to the access request successfully logs in.
  • the control terminal clears the cached data corresponding to the identity information. The identity of the user who accesses the encrypted data is accurately and effectively confirmed, and the terminal is automatically cleared of the cached data to prevent data leakage, thereby further improving the security of data access.
  • FIG. 4 is a schematic flowchart diagram of a third embodiment of a data access method according to the present invention. Based on the second embodiment of the data access method, the step S30 includes:
  • Step S31 Acquire access rights of the encrypted data corresponding to the access request when establishing a connection with the terminal;
  • Step S32 determining, according to the authority, whether the terminal has the access authority of the encrypted data
  • Step S33 when the terminal has the access permission of the encrypted data, acquire the encrypted data and the key corresponding to the access request;
  • Step S34 When the terminal does not have the access permission of the encrypted data, issue prompt information that the terminal does not have permission to access the encrypted data.
  • the access rights include which terminals or which users can access the encrypted data, that is, including a whitelist that can access the encrypted data. , or blacklist.
  • the access rights include which terminals or which users can access the encrypted data, that is, including a whitelist that can access the encrypted data. , or blacklist.
  • the process of determining whether the terminal has the access right of the encrypted data may also be: determining whether the terminal is in the blacklist of the access right according to the obtained access right, and if in the blacklist, Determining that the terminal does not have the access authority of the encrypted data; if not in the blacklist, determining that the terminal has the access authority of the encrypted data.
  • the process of determining whether the terminal has the access permission of the encrypted data may also be: determining whether to respond to the access request within a preset time according to the permission information, and responding to the access request within a preset time, Determining that the terminal has the access authority of the encrypted data; if the access request is not responded within the preset time, determining that the terminal does not have the access permission of the encrypted data, and issuing the terminal without permission to access the terminal
  • the prompt information of the encrypted data may also be: determining whether to respond to the access request within a preset time according to the permission information, and responding to the access request within a preset time, Determining that the terminal has the access authority of the encrypted data; if the access request is not responded within the preset time, determining that the terminal does not have the access permission of the encrypted data, and issuing the terminal without permission to access the terminal
  • the prompt information of the encrypted data may be 3 seconds, 4 seconds, etc., and the prompting manner may be voice, text, picture, and the like.
  • the invention further provides a data access device.
  • FIG. 5 is a schematic diagram of functional modules of a first embodiment of a data access device according to the present invention.
  • the data access device includes: a detection module 10, an establishment module 20, an acquisition module 30, and a processing module 40.
  • the detecting module 10 is configured to detect, when receiving an access request for the encrypted data, whether the terminal is within a preset location range;
  • the special data includes, but is not limited to, encrypted data, confidential data or private data or enterprise data, trade secrets and the like.
  • the server saves the encrypted data corresponding to the access request, the basic information of the user, the authority of the user, records the data when and where the user accesses, and saves the key related to the user identity, in order to ensure the security of the key. Sex, you can deploy the server that manages the keys separately.
  • the detecting module 10 includes a detecting unit 11 and a determining unit 12,
  • the detecting unit 11 is configured to detect whether the terminal accesses a preset hot spot
  • the determining unit 12 is configured to determine that the terminal is within a preset location range when the terminal accesses a preset hotspot.
  • the preset hotspot may be a hotspot for the user to access the hotspot and the Internet for communication, such as a Wi-Fi hotspot, and the coverage of the preset hotspot may be set according to the needs of the user.
  • the access mode of the preset hotspot may adopt a connection manner such as Wi-Fi, Bluetooth, or NFC.
  • the access of the preset hotspot in the embodiment is preferably Bluetooth or NFC. For example, when an NFC-enabled terminal is connected to a preset Wi-Fi hotspot, when an NFC-enabled terminal is placed on a preset NFC intelligent terminal bay, the NFC-enabled terminal passes the NFC on the sensing bay. A tag that is connected to the preset Wi-Fi hotspot.
  • the server determines that the terminal is not within the preset location range, that is, the access request corresponds to the user not being in a specific location that allows access to the data.
  • the process of detecting whether the terminal is within a preset location range includes: pre-preserving a preset location, for example, a location of a company, acquiring a location of the terminal, and setting the location of the terminal with the preset When the location is matched, it is determined that the terminal is within a preset location range; when the location of the terminal does not match the preset location, it is determined that the terminal is not within the preset location range. It is also possible to determine whether the terminal is within a preset location range in a manner well known to those skilled in the art, and will not be exemplified herein.
  • the establishing module 20 is configured to establish a connection with the terminal when detecting that the terminal is within a preset location range
  • the connection may be a heartbeat connection, and the data transmission channel between the server and the terminal is opened by establishing a TCP protocol or a UDP protocol.
  • Receiving, by the server, the data packet sent by the terminal if the server responds to the data packet sent by the terminal within a certain time (2 seconds or 3 seconds), determining that the server establishes a connection with the terminal successfully, and opening the terminal with the terminal Data transmission channel.
  • other protocols may also be employed to establish the connection and open a data transmission channel with the terminal.
  • the obtaining module 30 is configured to acquire the encrypted data and the key corresponding to the access request when establishing a connection with the terminal;
  • the key is associated with the identity information of the user corresponding to the access request, and the identity information may be, for example, an account of the user, an access timestamp, etc., and is set according to the needs of the user.
  • the timestamp is the time when the file is created, modified, and accessed in the file attribute.
  • the timestamp is an encrypted document file, and the file that needs to be time-stamped is first encrypted with a hash code to form a digest, and then the digest is sent to the DTS, and the DTS is added.
  • the hash code is a hash coding algorithm, that is, a hash coding algorithm, which maps binary values of arbitrary length into shorter fixed-length binary values, and this small binary value is called a hash value.
  • a hash value is a unique and extremely compact numerical representation of a piece of data. If you hash a plaintext and even change only one letter of the paragraph, the subsequent hash encoding algorithm will produce different values. It is computationally impossible to find two different inputs that are hashed to the same value, so the hash of the data can verify the integrity of the data. Can be used for fast lookup and encryption algorithms.
  • the processing module 40 is configured to send the encrypted data and the key to the terminal, so that the terminal decrypts the encrypted data according to the key and displays the decrypted encrypted data.
  • the server After obtaining the encrypted data and the key, the server sends the encrypted data and the key to the terminal, and the terminal decrypts the encrypted data according to the key to obtain target data, and displays the Target data.
  • other secure encryption and decryption algorithms such as the disclosed secure hash algorithm SHA, RSA algorithm, data encryption standard DES, etc. may be adopted according to the performance setting of the system.
  • the control terminal clears the buffered encrypted data, and disconnects the terminal, and cancels the terminal access.
  • the permission to encrypt data that is, the access to the encrypted data only when the terminal is in the preset location range, can access the encrypted data.
  • the terminal detects the access request of the encrypted data in the preset location range, establishes a connection with the terminal, acquires the encrypted data and the key corresponding to the access request, and sends the encrypted data and the key to the terminal. And the terminal decrypts the encrypted data according to the key and displays it. It effectively avoids the problem of uncontrollable data access in the existing data security protection mode.
  • the terminal is lost or intercepted by third-party software, data leakage is easily caused, resulting in poor data security.
  • the terminal is detected within the preset location range, the data is actively controlled to be accessed, and the data is not easily leaked when the terminal is lost or intercepted by the third-party software, thereby improving data security.
  • the establishing module 20 includes a determining unit 21 and an establishing unit 22; referring to FIG. 8, the data access device further includes a control module 50 and a disconnecting module 60.
  • the determining unit 21 is configured to: determine, when the terminal is within the preset location range, whether the user corresponding to the access request is successfully logged in;
  • the server determines whether the user corresponding to the access request is successfully logged in, and the user can complete the login operation by using the following login manner, for example, by receiving a password, voice, or Login of a login method such as face recognition login, which is set according to the needs of the user and/or performance setting of the system.
  • the login mode is exemplified by the face recognition login.
  • the camera of the terminal is opened for the terminal to acquire the face image of the user corresponding to the access request, and the face image is matched with the pre-stored face image to determine the face image.
  • the degree of similarity with the pre-stored face image determines whether the similarity reaches a preset threshold. When the similarity reaches a preset threshold, it is determined that the user corresponding to the access request successfully logs in.
  • the preset threshold may be 80%, 90%, etc. according to the needs of the user and/or the performance setting of the system.
  • the control terminal enters the lock mode, locks the operation interface of the current working client, and cuts off the access operation of the client data to prevent data loss or leakage, thereby further improving data security.
  • the determining unit 21 is further configured to determine identity information of the user when the user corresponding to the access request successfully logs in;
  • the establishing unit 22 is configured to establish a connection with the terminal according to the identity information
  • the establishing the connection is that the server determines the identity information of the user when the user corresponding to the access request is successfully logged in, and establishes a connection with the terminal by using the identity information.
  • the control module 50 is configured to: when detecting that the terminal is not within the preset location range, the control terminal clears the cache data corresponding to the identity information;
  • the disconnecting module 60 is configured to disconnect the connection with the terminal after detecting that the terminal clears the cached data corresponding to the identity information.
  • the control terminal When the server detects that the terminal is not in the preset location range, that is, after the user corresponding to the access request leaves the coverage of the hotspot, the control terminal clears the cached data corresponding to the identity information, and automatically disconnects the device. The connection of the terminal. After the terminal leaves the preset location range, the control terminal clears the data stored locally in the terminal, prevents the terminal from accessing the unsecured hotspot at other locations, and causes data loss, thereby further improving the security of data access.
  • the method determines whether the user corresponding to the access request successfully logs in, and establishes a connection with the terminal when the user corresponding to the access request successfully logs in.
  • the control terminal clears the cached data corresponding to the identity information. The identity of the user who accesses the encrypted data is accurately and effectively confirmed, and the terminal is automatically cleared of the cached data to prevent data leakage, thereby further improving the security of data access.
  • the obtaining module 30 includes an obtaining unit 31, a determining unit 32, and a prompting unit 33,
  • the obtaining unit 31 is configured to acquire an access right of the encrypted data corresponding to the access request when establishing a connection with the terminal;
  • the determining unit 32 is configured to determine, according to the acquired access rights, whether the terminal has the access authority of the encrypted data;
  • the obtaining unit 31 is further configured to: when the terminal has the access permission of the encrypted data, acquire the encrypted data and the key corresponding to the access request;
  • the prompting unit 33 is configured to, when the terminal does not have the access authority of the encrypted data, issue prompt information that the terminal does not have permission to access the encrypted data.
  • the process of determining whether the terminal has the access right of the encrypted data may also be: determining whether the terminal is in the blacklist of the access right according to the obtained access right, and if in the blacklist, Determining that the terminal does not have the access authority of the encrypted data; if not in the blacklist, determining that the terminal has the access authority of the encrypted data.
  • the process of determining whether the terminal has the access permission of the encrypted data may also be: determining whether to respond to the access request within a preset time according to the permission information, and responding to the access request within a preset time, Determining that the terminal has the access authority of the encrypted data; if the access request is not responded within the preset time, determining that the terminal does not have the access permission of the encrypted data, and issuing the terminal without permission to access the terminal
  • the prompt information of the encrypted data may also be: determining whether to respond to the access request within a preset time according to the permission information, and responding to the access request within a preset time, Determining that the terminal has the access authority of the encrypted data; if the access request is not responded within the preset time, determining that the terminal does not have the access permission of the encrypted data, and issuing the terminal without permission to access the terminal
  • the prompt information of the encrypted data may be 3 seconds, 4 seconds, etc., and the prompting manner may be voice, text, picture, and the like.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • a storage medium such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.
  • the embodiment of the present invention detects the access request of the encrypted data in the preset location range, establishes a connection with the terminal, acquires the encrypted data and the key corresponding to the access request, and sends the encrypted data and the key to the a terminal for the terminal to decrypt and display the encrypted data according to the key. It effectively avoids the problem of uncontrollable data access in the existing data security protection mode.
  • the terminal is lost or intercepted by third-party software, data leakage is easily caused, resulting in poor data security.
  • the terminal is detected within the preset location range, the data is actively controlled to be accessed, and the data is not easily leaked when the terminal is lost or intercepted by the third-party software, thereby improving data security.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Power Engineering (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Telephonic Communication Services (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了一种数据访问方法，包括步骤：在接收到加密数据的访问请求时，检测终端是否在预设位置范围内；当检测到终端在预设位置范围内时，与所述终端建立连接；在与所述终端建立连接后，获取所述访问请求对应的加密数据及密钥；将所述加密数据及所述密钥发送至终端，以供终端根据所述密钥解密所述加密数据并显示解密后的加密数据。本发明还公开了一种数据访问装置。本发明实现主动控制数据的访问，提高数据的安全性。

Description

数据访问方法及装置 技术领域
本发明涉及终端信息处理技术领域，尤其涉及数据访问方法及装置。
背景技术
随着移动互联网技术和智能手机的快速发展，移动办公因其具有方便携带资料、灵活办公，可行性高的优点，越来越普及，使得智能手机中储存的企业机密数据逐渐增多。一旦手机丢失或通过手机访问企业机密数据被第三方软件拦截，会造成企业机密数据的泄露，给企业带来不必要的损失。
现在很多企业对移动办公有着严格的策略，比如要求远程锁定手机、设置远程擦除数据等。其中：
远程锁定手机可以在不小心丢失手机后，通过第三方手机发一个预先设定好的代码给遗失的手机，遗失手机根据所述代码完成手机的锁定，禁止对手机的访问和操作。但在这种锁定方式下，用电脑对手机进行刷机后，这些防护功能都将形同虚设，企业机密数据就会泄漏；
设置远程擦除数据是在智能手机中设置了Exchange邮箱同步，在手机丢失时，可在邮局管理面板上远程清除手机设备的所有数据，把手机设备恢复到出厂设置状态，防止数据外泄。但是远程数据擦除只能清除手机内存中的数据，不能清除存储卡上保存的数据。
在现有的数据安全防护方式下，无法主动控制数据的访问，在终端丢失或被第三方软件拦截时容易导致数据泄露，使得数据的安全性差。
上述内容仅用于辅助理解本发明的技术方案，并不代表承认上述内容是现有技术。
发明内容
本发明的主要目的在于提供一种数据访问方法及装置，旨在解决在现有的数据安全防护方式下，无法主动控制数据的访问，在终端丢失或被第三方软件拦截时容易导致数据泄露，使得数据的安全性差的问题。
为实现上述目的，本发明实施例提供的一种数据访问方法，包括步骤：在接收到加密数据的访问请求时，检测终端是否在预设位置范围内；当检测到终端在预设位置范围内时，与所述终端建立连接；在与所述终端建立连接后，获取所述访问请求对应的加密数据及密钥；将所述加密数据及所述密钥发送至终端，以供终端根据所述密钥解密所述加密数据并显示解密后的加密数据。
优选地，所述检测终端是否在预设位置范围内的步骤包括：检测所述终端是否接入预设热点；在检测到所述终端接入预设热点时，判定所述终端在预设位置范围内。
优选地，所述当检测到终端在预设位置范围内时，与所述终端建立连接的步骤包括：当检测到所述终端在预设位置范围内时，确定所述访问请求对应的用户是否登录成功；在所述访问请求对应的用户登录成功时，确定所述用户的身份信息；通过所述身份信息与所述终端建立连接。
优选地，所述根据所述身份信息与终端建立连接的步骤之后，还包括：当检测到终端未在预设位置范围内时，控制终端清除与所述身份信息对应的缓存数据；在检测到终端清除与所述身份信息对应的缓存数据后，断开与所述终端的连接。
优选地，获取所述访问请求对应的加密数据及密钥的步骤包括：在与所述终端建立连接时，获取所述访问请求对应的加密数据的访问权限信息；根据所获取的访问权限判断所述终端是否具有所述加密数据的访问权限；在所述终端具有所述加密数据的访问权限时，获取所述访问请求对应的加密数据及密钥；在所述终端未具有所述加密数据的访问权限时，发出所述终端无权限访问所述加密数据的提示信息。
此外，为实现上述目的，本发明实施例还提供一种数据访问装置，包括：检测模块，设置为在接收到加密数据的访问请求时，检测终端是否在预设位置范围内；建立模块，设置为当检测到终端在预设位置范围内时，与所述终端建立连接；获取模块，设置为在与所述终端建立连接后，获取所述访问请求对应的加密数据及密钥；处理模块，设置为将所述加密数据及所述密钥发送至终端，以供终端根据所述密钥解密所述加密数据并显示解密后的加密数据。
优选地，所述检测模块包括检测单元和判断单元，所述检测单元，设置为检测所述终端是否接入预设热点；所述判定单元，设置为在检测到所述终端接入预设热点时，判定所述终端在预设位置范围内。
优选地，所述建立模块包括确定单元和建立单元，所述确定单元，还设置为当检测到所述终端在预设位置范围内时，确定所述访问请求对应的用户是否登录成功；还设置为在所述访问请求对应的用户登录成功时，确定所述用户的身份信息；所述建立单元，设置为通过所述身份信息与所述终端建立连接。
优选地，数据访问装置还包括：控制模块，设置为当检测到终端未在预设位置范围内时，控制终端清除与所述身份信息对应的缓存数据；所述断开模块，设置为在检测到终端清除与所述身份信息对应的缓存数据后，断开与所述终端的连接。
优选地，所述获取模块包括获取单元、提示单元和判断单元，所述获取单元，设置为在与所述终端建立连接时，获取所述访问请求对应的加密数据的访问权限；所述提示单元，设置为在所述终端未具有所述加密数据的访问权限时，发出所述终端无权限访问所述加密数据的提示信息；所述判断单元，设置为根据所获取的访问权限判断所述终端是否具有所述加密 数据的访问权限；所述获取单元，还设置为在所述终端具有所述加密数据的访问权限时，获取所述访问请求对应的加密数据及密钥。
相对现有技术，本发明实施例通过检测终端在预设位置范围内，接收加密数据的访问请求，与终端建立连接，并获取所述访问请求对应的加密数据及密钥，将所述加密数据及密钥发送至终端，以供终端根据所述密钥解密所述加密数据并显示。有效避免在现有的数据安全防护方式下，无法主动控制数据的访问，在终端丢失或被第三方软件拦截时容易导致数据泄露，使得数据的安全性差的问题。使得在检测到终端在预设位置范围内时，主动控制数据的访问，在终端丢失或被第三方软件拦截时数据不易泄露，提高了数据的安全性。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1为本发明数据访问方法的第一实施例的流程示意图；
图2为图1中步骤S10一实施例的流程示意图；
图3为本发明数据访问方法的第二实施例的流程示意图；
图4为本发明数据访问方法的第三实施例的流程示意图；
图5为本发明数据访问装置的第一实施例的功能模块示意图；
图6为图5中检测模块一实施例的细化功能模块示意图；
图7为图5中建立模块一实施例的细化功能模块示意图；
图8为本发明数据访问装置的第二实施例的功能模块示意图；
图9为图5中获取模块一实施例的细化功能模块示意图。
具体实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
本发明实施例的主要解决方案是：在接收到加密数据的访问请求时，检测终端是否在预设位置范围内；当检测到终端在预设位置范围内时，与所述终端建立连接；在与所述终端建立连接后，获取所述访问请求对应的加密数据及密钥；将所述加密数据及所述密钥发送至终端，以供终端根据所述密钥解密所述加密数据并显示解密后的加密数据。通过检测终端在预设位置范围内，接收加密数据的访问请求，与终端建立连接，并获取所述访问请求对应的加密数据及密钥，将所述加密数据及密钥发送至终端，以供终端根据所述密钥解密所述加密数 据并显示。有效避免在现有的数据安全防护方式下，无法主动控制数据的访问，导致终端在丢失或被第三方软件拦截时容易导致数据泄露，使得数据的安全性差的问题。使得在检测到终端在预设位置范围内时，主动控制数据的访问，在终端丢失或被第三方软件拦截时数据不易泄露，提高了数据的安全性。
由于在现有的数据安全防护方式下，无法主动控制数据的访问，在终端丢失或被第三方软件拦截时容易导致数据泄露，使得数据的安全性差。
基于上述问题，本发明提供一种数据访问方法。
参照图1，图1为本发明数据访问方法的第一实施例的流程示意图。
在一实施例中，所述数据访问方法包括：
步骤S10，在接收到加密数据的访问请求时，检测终端是否在预设位置范围内；
为了保证特殊数据的安全，在特定地点对数据进行访问可以提高数据的安全性。所述特殊数据包括但不限于加密数据、机密数据或私人数据或企业数据、商业秘密等数据。在需要访问加密数据时，检测访问加密数据的用户是否在特定地点，即服务器在接收到加密数据的访问请求时，检测终端是否在预设位置范围内。
所述服务器保存所述访问请求对应的加密数据、用户的基本信息、用户所具有的权限，记录用户在何时何地访问的数据，保存与用户身份相关的密钥，为了保证密钥的安全性，可以将管理密钥的服务器单独部署。
具体的，参照图2，所述检测终端是否在预设位置范围内的过程包括：
步骤S11，检测所述终端是否接入预设热点；
步骤S12，在所述终端接入预设热点时，判定所述终端在预设位置范围内。
所述预设热点可以是Wi-Fi热点等供用户接入该热点与互联网通信的热点，预设热点的覆盖范围可以根据用户的需要设置。所述预设热点的接入方式可以采用Wi-Fi、蓝牙、NFC等连接方式。在本实施例所述预设热点的接入优选为蓝牙、NFC。以采用NFC的接入方式接入预设的Wi-Fi热点为例，当具有NFC功能的终端放在预设的NFC智能终端托架上时，具有NFC功能的终端通过感应托架上的NFC标签，与所述预设的Wi-Fi热点连接。
所述服务器在侦测到所述终端未接入所述预设热点时，判定终端未在预设位置范围内，即所述访问请求对应用户未在允许访问数据的特定地点内。在本发明其他实施例中，所述检测终端是否在预设位置范围内的过程包括：提前预存预设位置，例如，公司的位置等，获取终端的位置，在终端的位置与所述预设位置匹配时，判定所述终端在预设位置范围内；在终端的位置与所述预设位置不匹配时，判定所述终端不在预设位置范围内。也还可以采取其他本领域技术人员公知的方式来判定所述终端是否在预设位置范围内，在此不再一一举例。
步骤S20，当检测到终端在预设位置范围内时，与所述终端建立连接；
所述连接可以是心跳连接，通过建立TCP协议或UDP协议来打通服务器与所述终端的数据传输通道。所述服务器接收终端发送的数据包，若所述服务器在一定时间内(2秒或3秒)响应终端发送的数据包，则判断所述服务器与所述终端建立连接成功，打通与所述终端的数据传输通道。在本发明的其他实施例中，也可以采用其他协议来建立所述连接，打通与所述终端的数据传输通道。
步骤S30，在与所述终端建立连接时，获取所述访问请求对应的加密数据及密钥；
在与所述终端建立连接时，获取所述访问请求对应的加密数据及所述加密数据的密钥，通过所述密钥解密所述加密数据。所述密钥与所述访问请求对应的用户的身份信息关联，所述身份信息可以是：例如，用户的帐号、访问时间戳等，根据用户的需要设置。所述时间戳是文件属性里创建、修改、访问文件的时间。所述时间戳是一个经加密后形成的凭证文档，先将需要加时间戳的文件用Hash编码加密形成摘要，然后将该摘要发送到DTS，DTS在加入了收到文件摘要的日期和时间信息后，再对该文件加密(数字签名)。所述Hash编码是Hash编码算法，即哈希编码算法，哈希编码算法将任意长度的二进制值映射为较短的固定长度的二进制值，这个小的二进制值称为哈希值。哈希值是一段数据唯一且极其紧凑的数值表示形式。如果散列一段明文而且哪怕只更改该段落的一个字母，随后的哈希编码算法都将产生不同的值。要找到散列为同一个值的两个不同的输入，在计算上是不可能的，所以数据的哈希值可以检验数据的完整性。可以用于快速查找和加密算法。
步骤S40，将所述加密数据及所述密钥发送至终端，以供终端根据所述密钥解密所述加密数据并显示解密后的加密数据。
所述服务器在获取到所述加密数据及密钥后，将所述加密数据及密钥发送终端，所述终端根据所述密钥解密所述加密数据得到目标数据，并在终端屏幕上显示所述目标数据。所述加密解密数据的方式可以采用公开的安全散列算法SHA、RSA算法、数据加密标准DES等其他加密解密算法，根据系统的性能设置。在本发明其他实施例中，当通过终端访问加密数据后，若终端不在预设位置范围内，则控制终端清除缓存的加密数据，并断开与所述终端的连接，取消所述终端访问所述加密数据的权限，即，只有在终端处于预设位置范围内时才有访问加密数据的权限，才可访问加密数据。
本实施例通过检测终端在预设位置范围内，接收加密数据的访问请求，与终端建立连接，并获取所述访问请求对应的加密数据及密钥，将所述加密数据及密钥发送至终端，以供终端根据所述密钥解密所述加密数据并显示。有效避免在现有的数据安全防护方式下，无法主动控制数据的访问，在终端丢失或被第三方软件拦截时容易导致数据泄露，使得数据的安全性差的问题。使得在检测到终端在预设位置范围内时，主动控制数据的访问，在终端丢失或被第三方软件拦截时数据不易泄露，提高了数据的安全性。
参照图3，图3为本发明数据访问方法的第二实施例的流程示意图。基于上述数据访问方法的第一实施例，所述步骤S20包括：
步骤S21，当检测到所述终端在预设位置范围内时，确定所述访问请求对应的用户是否 登录成功；
当检测到所述终端在预设位置范围内时，所述服务器确定所述访问请求对应的用户是否登录成功，所述用户可以通过如下登录方式完成登录操作，例如，可以通过接收密码、语音或人脸识别登录等登录方式的登录，所述登录方式根据用户的需要设置及/或系统的性能设置。所述登录方式以人脸识别登录为例，所述服务器当检测到所述终端在预设位置范围内时，开启终端的工作客户端，所述工作客户端包含用户日常工作需要用到的功能，包括邮件、通讯录、文件查看、功能审批等。在开启终端的工作客户端时，开启终端的相机，以供终端获取所述访问请求对应的用户的人脸图像，将所述人脸图像与预存的人脸图像匹配，确定所述人脸图像与预存的人脸图像的相似度，确定所述相似度是否达到预设阈值。在所述相似度达到预设阈值时，确定所述访问请求对应的用户成功登录。所述预设阈值可以是80％、90％等根据用户的需要及/或系统的性能设置。在所述相似度未达到预设阈值时，发出所述访问请求对应的用户登录失败的提示信息，控制终端进入锁定模式，锁定当前工作客户端的操作界面，并截止客户端数据的访问操作，防止数据的丢失或泄露等，进一步提高数据的安全性。
步骤S22，在所述访问请求对应的用户登录成功时，确定所述用户的身份信息；
步骤S23，通过所述身份信息与所述终端建立连接。
所述建立连接是所述服务器在所述访问请求对应的用户登录成功时，确定所述用户的身份信息，通过所述身份信息建立与所述终端的连接。
进一步地，为了进一步有效防止数据的丢失，提高数据的安全性，在所述步骤S23之后还包括：
步骤S24，当检测到终端未在预设位置范围内时，控制终端清除与所述身份信息对应的缓存数据；
步骤S25，在检测到终端清除与所述身份信息对应的缓存数据后，断开与所述终端的连接。
所述服务器在检测到终端未在预设位置范围内时，即所述访问请求对应的用户离开热点的覆盖范围后，控制终端清除与所述身份信息对应的缓存数据，并自动断开与所述终端的连接。通过在终端离开预设位置范围后，控制终端清除在终端本地保存的数据，防止终端在其他位置接入不安全热点时，导致数据丢失的问题，进一步提高了数据访问的安全性。
本实施例在检测到所述终端在预设位置范围内时，判断所述访问请求对应的用户是否成功登录，在所述访问请求对应的用户成功登录时，与所述终端建立连接，所述终端未在预设位置范围内时，控制终端清除与所述身份信息对应的缓存数据。实现准确、有效地确认访问加密数据用户的身份，并且侦测到所述终端在离开热点覆盖范围内，自动清除缓存数据，防止数据的泄漏，进一步地提高了数据访问的安全性。
参照图4，图4为本发明数据访问方法的第三实施例的流程示意图。基于上述数据访问方法的第二实施例，所述步骤S30包括：
步骤S31，在与所述终端建立连接时，获取所述访问请求对应的加密数据的访问权限；
步骤S32，根据所述权限判断所述终端是否具有所述加密数据的访问权限；
步骤S33，在所述终端具有所述加密数据的访问权限时，获取所述访问请求对应的加密数据及密钥；
步骤S34，在所述终端未具有所述加密数据的访问权限时，发出所述终端无权限访问所述加密数据的提示信息。
在与所述终端建立连接时，获取所述访问请求对应的加密数据的访问权限，所述访问权限包括哪些终端或哪些用户可以访问所述加密数据，即包括可以访问所述加密数据的白名单，或者黑名单。在获取所述加密数据的访问权限后，根据所获取的访问权限确定所述终端是否在所述访问权限的白名单内，若在所述白名单内，则判断所述终端具有所述加密数据的访问权限；若不在所述白名单内，则判断所述终端不具有所述加密数据的访问权限。判断所述终端是否具有所述加密数据的访问权限的过程也还可以是：根据所获取的访问权限确定所述终端是否在所述访问权限的黑名单内，若在所述黑名单内，则判断所述终端不具有所述加密数据的访问权限；若不在所述黑名单内，则判断所述终端具有所述加密数据的访问权限。判断所述终端是否具有所述加密数据的访问权限的过程也还可以是：根据所述权限信息判断在预设时间内是否响应所述访问请求，若在预设时间内响应所述访问请求，则判断所述终端具有所述加密数据的访问权限；若在预设时间内未响应所述访问请求，则判断所述终端未具有所述加密数据的访问权限，发出所述终端无权限访问所述加密数据的提示信息。所述预设时间可以是3秒、4秒等，所述提示方式可以是语音、文字、图片等方式。
本实施例在与所述终端建立连接时，获取所述访问请求对应的加密数据的访问权限信息，并判断所述终端是否具有所述加密数据的访问权限，在所述终端具有所述加密数据的访问权限时，获取所述访问请求对应的加密数据及密钥。通过获取访问权限和密钥能够切实保证数据的安全。
本发明进一步提供一种数据访问装置。
参照图5，图5为本发明数据访问装置的第一实施例的功能模块示意图。
在一实施例中，所述数据访问装置包括：检测模块10、建立模块20、获取模块30及处理模块40。
所述检测模块10，设置为在接收到加密数据的访问请求时，检测终端是否在预设位置范围内；
为了保证特殊数据的安全，在特定地点对数据进行访问可以提高数据的安全性。所述特殊数据包括但不限于加密数据、机密数据或私人数据或企业数据、商业秘密等数据。在需要 访问加密数据时，检测访问加密数据的用户是否在特定地点，即服务器在接收到加密数据的访问请求时，检测终端是否在预设位置范围内。
所述服务器保存所述访问请求对应的加密数据、用户的基本信息、用户所具有的权限，记录用户在何时何地访问的数据，保存与用户身份相关的密钥，为了保证密钥的安全性，可以将管理密钥的服务器单独部署。
具体的，参照图6，所述检测模块10包括检测单元11和判定单元12，
所述检测单元11，设置为检测所述终端是否接入预设热点；
所述判定单元12，设置为在所述终端接入预设热点时，判定所述终端在预设位置范围内。
所述预设热点可以是Wi-Fi热点等供用户接入该热点与互联网通信的热点，预设热点的覆盖范围可以根据用户的需要设置。所述预设热点的接入方式可以采用Wi-Fi、蓝牙、NFC等连接方式。在本实施例所述预设热点的接入优选为蓝牙、NFC。以采用NFC的接入方式接入预设的Wi-Fi热点为例，当具有NFC功能的终端放在预设的NFC智能终端托架上时，具有NFC功能的终端通过感应托架上的NFC标签，与所述预设的Wi-Fi热点连接。
所述服务器在侦测到所述终端未接入所述预设热点时，判定终端未在预设位置范围内，即所述访问请求对应用户未在允许访问数据的特定地点内。在本发明其他实施例中，所述检测终端是否在预设位置范围内的过程包括：提前预存预设位置，例如，公司的位置等，获取终端的位置，在终端的位置与所述预设位置匹配时，判定所述终端在预设位置范围内；在终端的位置与所述预设位置不匹配时，判定所述终端不在预设位置范围内。也还可以采取其他本领域技术人员公知的方式来判定所述终端是否在预设位置范围内，在此不再一一举例。
所述建立模块20，设置为当检测到终端在预设位置范围内时，与所述终端建立连接；
所述连接可以是心跳连接，通过建立TCP协议或UDP协议来打通服务器与所述终端的数据传输通道。所述服务器接收终端发送的数据包，若所述服务器在一定时间内(2秒或3秒)响应终端发送的数据包，则判断所述服务器与所述终端建立连接成功，打通与所述终端的数据传输通道。在本发明的其他实施例中，也可以采用其他协议来建立所述连接，打通与所述终端的数据传输通道。
所述获取模块30，设置为在与所述终端建立连接时，获取所述访问请求对应的加密数据及密钥；
在与所述终端建立连接时，获取所述访问请求对应的加密数据及所述加密数据的密钥，通过所述密钥解密所述加密数据。所述密钥与所述访问请求对应的用户的身份信息关联，所述身份信息可以是：例如，用户的帐号、访问时间戳等，根据用户的需要设置。所述时间戳是文件属性里创建、修改、访问文件的时间。所述时间戳是一个经加密后形成的凭证文档，先将需要加时间戳的文件用Hash编码加密形成摘要，然后将该摘要发送到DTS，DTS在加入 了收到文件摘要的日期和时间信息后，再对该文件加密(数字签名)。所述Hash编码是Hash编码算法，即哈希编码算法，哈希编码算法将任意长度的二进制值映射为较短的固定长度的二进制值，这个小的二进制值称为哈希值。哈希值是一段数据唯一且极其紧凑的数值表示形式。如果散列一段明文而且哪怕只更改该段落的一个字母，随后的哈希编码算法都将产生不同的值。要找到散列为同一个值的两个不同的输入，在计算上是不可能的，所以数据的哈希值可以检验数据的完整性。可以用于快速查找和加密算法。
所述处理模块40，设置为将所述加密数据及所述密钥发送至终端，以供终端根据所述密钥解密所述加密数据并显示解密后的加密数据。
所述服务器在获取到所述加密数据及密钥后，将所述加密数据及密钥发送终端，所述终端根据所述密钥解密所述加密数据得到目标数据，在终端屏幕上显示所述目标数据。所述加密解密数据的方式下可以采用公开的安全散列算法SHA、RSA算法、数据加密标准DES等其他加密解密算法，根据系统的性能设置。在本发明其他实施例中，当通过终端访问加密数据后，若终端不在预设位置范围内，则控制终端清除缓存的加密数据，并断开与所述终端的连接，取消所述终端访问所述加密数据的权限，即，只有在终端处于预设位置范围内时才有访问加密数据的权限，才可访问加密数据。
本实施例通过检测终端在预设位置范围内，接收加密数据的访问请求，与终端建立连接，并获取所述访问请求对应的加密数据及密钥，将所述加密数据及密钥发送至终端，以供终端根据所述密钥解密所述加密数据并显示。有效避免在现有的数据安全防护方式下，无法主动控制数据的访问，在终端丢失或被第三方软件拦截时容易导致数据泄露，使得数据的安全性差的问题。使得在检测到终端在预设位置范围内时，主动控制数据的访问，在终端丢失或被第三方软件拦截时数据不易泄露，提高了数据的安全性。
进一步地，参照图7，所述建立模块20包括确定单元21和建立单元22；参考图8，所述数据访问装置还包括控制模块50和断开模块60。
所述确定单元21，设置为当检测到所述终端在预设位置范围内时，确定所述访问请求对应的用户是否登录成功；
当检测到所述终端在预设位置范围内时，所述服务器确定所述访问请求对应的用户是否登录成功，所述用户可以通过如下登录方式完成登录操作，例如，可以通过接收密码、语音或人脸识别登录等登录方式的登录，所述登录方式根据用户的需要设置及/或系统的性能设置。所述登录方式以人脸识别登录为例，所述服务器当检测到所述终端在预设位置范围内时，开启终端的工作客户端，所述工作客户端包含用户日常工作需要用到的功能，包括邮件、通讯录、文件查看、功能审批等。在开启终端的工作客户端时，开启终端的相机，以供终端获取所述访问请求对应的用户的人脸图像，将所述人脸图像与预存的人脸图像匹配，确定所述人脸图像与预存的人脸图像的相似度，确定所述相似度是否达到预设阈值。在所述相似度达到预设阈值时，确定所述访问请求对应的用户成功登录。所述预设阈值可以是80％、90％等根据用户的需要及/或系统的性能设置。在所述相似度未达到预设阈值时，发出所述访 问请求对应的用户登录失败的提示信息，控制终端进入锁定模式，锁定当前工作客户端的操作界面，并截止客户端数据的访问操作，防止数据的丢失或泄露等，进一步提高数据的安全性。
所述确定单元21，还设置为在所述访问请求对应的用户登录成功时，确定所述用户的身份信息；
所述建立单元22，设置为根据所述身份信息与所述终端建立连接；
所述建立连接是所述服务器在所述访问请求对应的用户登录成功时，确定所述用户的身份信息，通过所述身份信息建立与所述终端的连接。
所述控制模块50，设置为当检测到终端未在预设位置范围内时，控制终端清除与所述身份信息对应的缓存数据；
所述断开模块60，设置为在检测到终端清除与所述身份信息对应的缓存数据后，断开与所述终端的连接。
所述服务器在检测到终端未在预设位置范围内时，即所述访问请求对应的用户离开热点的覆盖范围后，控制终端清除与所述身份信息对应的缓存数据，并自动断开与所述终端的连接。通过在终端离开预设位置范围后，控制终端清除在终端本地保存的数据，防止终端在其他位置接入不安全热点时，导致数据丢失的问题，进一步提高了数据访问的安全性。
本实施例在检测到所述终端在预设位置范围内时，判断所述访问请求对应的用户是否成功登录，在所述访问请求对应的用户成功登录时，与所述终端建立连接，所述终端未在预设位置范围内时，控制终端清除与所述身份信息对应的缓存数据。实现准确、有效地确认访问加密数据用户的身份，并且侦测到所述终端在离开热点覆盖范围内，自动清除缓存数据，防止数据的泄漏，进一步地提高了数据访问的安全性。
进一步地，参照图9，所述获取模块30包括获取单元31、判断单元32和提示单元33，
所述获取单元31，设置为在与所述终端建立连接时，获取所述访问请求对应的加密数据的访问权限；
所述判断单元32，设置为根据所获取的访问权限判断所述终端是否具有所述加密数据的访问权限；
所述获取单元31，还设置为在所述终端具有所述加密数据的访问权限时，获取所述访问请求对应的加密数据及密钥；
所述提示单元33，设置为在所述终端未具有所述加密数据的访问权限时，发出所述终端无权限访问所述加密数据的提示信息。
在与所述终端建立连接时，获取所述访问请求对应的加密数据的访问权限，所述访问权限包括哪些终端或哪些用户可以访问所述加密数据，即包括可以访问所述加密数据的白名 单，或者黑名单。在获取所述加密数据的访问权限后，根据所获取的访问权限确定所述终端是否在所述访问权限的白名单内，若在所述白名单内，则判断所述终端具有所述加密数据的访问权限；若不在所述白名单内，则判断所述终端不具有所述加密数据的访问权限。判断所述终端是否具有所述加密数据的访问权限的过程也还可以是：根据所获取的访问权限确定所述终端是否在所述访问权限的黑名单内，若在所述黑名单内，则判断所述终端不具有所述加密数据的访问权限；若不在所述黑名单内，则判断所述终端具有所述加密数据的访问权限。判断所述终端是否具有所述加密数据的访问权限的过程也还可以是：根据所述权限信息判断在预设时间内是否响应所述访问请求，若在预设时间内响应所述访问请求，则判断所述终端具有所述加密数据的访问权限；若在预设时间内未响应所述访问请求，则判断所述终端未具有所述加密数据的访问权限，发出所述终端无权限访问所述加密数据的提示信息。所述预设时间可以是3秒、4秒等，所述提示方式可以是语音、文字、图片等方式。
本实施例在与所述终端建立连接时，获取所述访问请求对应的加密数据的访问权限信息，并判断所述终端是否具有所述加密数据的访问权限，在所述终端具有所述加密数据的访问权限时，获取所述访问请求对应的加密数据及密钥。通过获取访问权限和密钥能够切实保证数据的安全。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
以上仅为本发明的优选实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。
工业实用性
本发明实施例通过检测终端在预设位置范围内，接收加密数据的访问请求，与终端建立连接，并获取所述访问请求对应的加密数据及密钥，将所述加密数据及密钥发送至终端，以供终端根据所述密钥解密所述加密数据并显示。有效避免在现有的数据安全防护方式下，无法主动控制数据的访问，在终端丢失或被第三方软件拦截时容易导致数据泄露，使得数据的安全性差的问题。使得在检测到终端在预设位置范围内时，主动控制数据的访问，在终端丢失或被第三方软件拦截时数据不易泄露，提高了数据的安全性。

Claims (10)

  1. 一种数据访问方法，包括步骤：
    在接收到加密数据的访问请求时，检测终端是否在预设位置范围内；
    当检测到终端在预设位置范围内时，与所述终端建立连接；
    在与所述终端建立连接后，获取所述访问请求对应的加密数据及密钥；
    将所述加密数据及所述密钥发送至终端，以供终端根据所述密钥解密所述加密数据并显示解密后的加密数据。
  2. 如权利要求1所述的数据访问方法，其中，所述检测终端是否在预设位置范围内的步骤包括：
    检测所述终端是否接入预设热点；
    在检测到所述终端接入预设热点时，判定所述终端在预设位置范围内。
  3. 如权利要求1所述的数据访问方法，其中，所述当检测到终端在预设位置范围内时，与所述终端建立连接的步骤包括：
    当检测到所述终端在预设位置范围内时，确定所述访问请求对应的用户是否登录成功；
    在所述访问请求对应的用户登录成功时，确定所述用户的身份信息；
    通过所述身份信息与所述终端建立连接。
  4. 如权利要求3所述的数据访问方法，其中，所述根据所述身份信息与终端建立连接的步骤之后，还包括：
    当检测到终端未在预设位置范围内时，控制终端清除与所述身份信息对应的缓存数据；
    在检测到终端清除与所述身份信息对应的缓存数据后，断开与所述终端的连接。
  5. 如权利要求1至4中任一项所述的数据访问方法，其中，所述获取所述访问请求对应的加密数据及密钥的步骤包括：
    在与所述终端建立连接时，获取所述访问请求对应的加密数据的访问权限；
    根据所获取的访问权限判断所述终端是否具有所述加密数据的访问权限；
    在所述终端具有所述加密数据的访问权限时，获取所述访问请求对应的加密数据及密钥；
    在所述终端未具有所述加密数据的访问权限时，发出所述终端无权限访问所述加密数据的提示信息。
  6. 一种数据访问装置，包括：
    检测模块，设置为在接收到加密数据的访问请求时，检测终端是否在预设位置范围内；
    建立模块，设置为当检测到终端在预设位置范围内时，与所述终端建立连接；
    获取模块，设置为在与所述终端建立连接后，获取所述访问请求对应的加密数据及密钥；
    处理模块，设置为将所述加密数据及所述密钥发送至终端，以供终端根据所述密钥解密所述加密数据并显示解密后的加密数据。
  7. 如权利要求6所述的数据访问装置，其中，所述检测模块包括检测单元和判断单元，
    所述检测单元，设置为检测所述终端是否接入预设热点；
    所述判定单元，设置为在检测到所述终端接入预设热点时，判定所述终端在预设位置范围内。
  8. 如权利要求6所述的数据访问装置，其中，所述建立模块包括确定单元和建立单元，
    所述确定单元，还设置为当检测到所述终端在预设位置范围内时，确定所述访问请求对应的用户是否登录成功；还设置为在所述访问请求对应的用户登录成功时，确定所述用户的身份信息；
    所述建立单元，设置为通过所述身份信息与所述终端建立连接。
  9. 如权利要求6至8中任一项所述的数据访问装置，其中，数据访问装置还包括：控制模块，设置为当检测到终端未在预设位置范围内时，控制终端清除与所述身份信息对应的缓存数据；
    所述断开模块，设置为在检测到终端清除与所述身份信息对应的缓存数据后，断开与所述终端的连接。
  10. 如权利要求9所述的数据访问装置，其中，所述获取模块包括获取单元、判断单元和提示单元，
    所述获取单元，设置为在与所述终端建立连接时，获取所述访问请求对应的加密数据的访问权限；
    所述判断单元，设置为根据所获取的访问权限判断所述终端是否具有所述加密数据的访问权限；
    所述获取单元，还设置为在所述终端具有所述加密数据的访问权限时，获取所述访问请求对应的加密数据及密钥；
    所述提示单元，设置为在所述终端未具有所述加密数据的访问权限时，发出所述终端无权限访问所述加密数据的提示信息。
PCT/CN2016/076304 2015-03-18 2016-03-14 数据访问方法及装置 WO2016146046A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510120757.9 2015-03-18
CN201510120757.9A CN106034130A (zh) 2015-03-18 2015-03-18 数据访问方法及装置

Publications (1)

Publication Number Publication Date
WO2016146046A1 true WO2016146046A1 (zh) 2016-09-22

Family

ID=56918402

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/076304 WO2016146046A1 (zh) 2015-03-18 2016-03-14 数据访问方法及装置

Country Status (2)

Country Link
CN (1) CN106034130A (zh)
WO (1) WO2016146046A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112383576A (zh) * 2021-01-19 2021-02-19 北京信安世纪科技股份有限公司 操作请求响应方法、装置、服务端和存储介质
CN114979350A (zh) * 2022-04-26 2022-08-30 广州助蜂网络科技有限公司 一种基于手机的端口映射方法及装置

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107066889A (zh) * 2017-04-25 2017-08-18 北京洋浦伟业科技发展有限公司 一种基于地理位置信息的数据访问控制方法与系统
CN111190950B (zh) * 2019-10-31 2021-12-31 腾讯科技（深圳）有限公司 一种资产检索方法和装置

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101290642A (zh) * 2007-04-16 2008-10-22 瞬联软件科技（北京）有限公司 基于区域限制的电子文件传播控制方法及其系统
CN102395216A (zh) * 2011-12-21 2012-03-28 上海云联计算机系统有限公司 快速接入无线局域网的方法及其移动终端
CN102404727A (zh) * 2011-11-24 2012-04-04 中兴通讯股份有限公司 移动终端的安全控制方法及装置
CN102597947A (zh) * 2009-09-10 2012-07-18 赛门铁克公司 无需客户端访问组件浏览企业数字权限管理下的内容
CN103368941A (zh) * 2013-04-22 2013-10-23 北京奇虎科技有限公司 一种基于用户网络访问场景的防护的方法和装置
CN103546436A (zh) * 2012-07-13 2014-01-29 中兴通讯股份有限公司 一种安全控制方法及终端、云服务器
CN103561384A (zh) * 2013-11-07 2014-02-05 中国科学院软件研究所 一种基于移动智能终端地理位置信息的数据保护方法
CN104125223A (zh) * 2014-07-22 2014-10-29 浪潮电子信息产业股份有限公司 一种移动设备隐私数据的安全防护系统
US8918639B2 (en) * 2009-06-01 2014-12-23 Dhananjay S. Phatak Smarter leveraging of the power grid to substantially improve security of distributed systems via a control plane data communication network over the smart power grid

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140157354A1 (en) * 2012-02-14 2014-06-05 SkySocket, LLC Securing Access to Resources on a Network
CN102769631B (zh) * 2012-07-31 2015-09-09 华为技术有限公司 访问云服务器的方法、系统和接入设备
CN103401834B (zh) * 2013-06-27 2016-06-15 中国人民解放军国防科学技术大学 基于位置信息的限定区域文件保密方法

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101290642A (zh) * 2007-04-16 2008-10-22 瞬联软件科技（北京）有限公司 基于区域限制的电子文件传播控制方法及其系统
US8918639B2 (en) * 2009-06-01 2014-12-23 Dhananjay S. Phatak Smarter leveraging of the power grid to substantially improve security of distributed systems via a control plane data communication network over the smart power grid
CN102597947A (zh) * 2009-09-10 2012-07-18 赛门铁克公司 无需客户端访问组件浏览企业数字权限管理下的内容
CN102404727A (zh) * 2011-11-24 2012-04-04 中兴通讯股份有限公司 移动终端的安全控制方法及装置
CN102395216A (zh) * 2011-12-21 2012-03-28 上海云联计算机系统有限公司 快速接入无线局域网的方法及其移动终端
CN103546436A (zh) * 2012-07-13 2014-01-29 中兴通讯股份有限公司 一种安全控制方法及终端、云服务器
CN103368941A (zh) * 2013-04-22 2013-10-23 北京奇虎科技有限公司 一种基于用户网络访问场景的防护的方法和装置
CN103561384A (zh) * 2013-11-07 2014-02-05 中国科学院软件研究所 一种基于移动智能终端地理位置信息的数据保护方法
CN104125223A (zh) * 2014-07-22 2014-10-29 浪潮电子信息产业股份有限公司 一种移动设备隐私数据的安全防护系统

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112383576A (zh) * 2021-01-19 2021-02-19 北京信安世纪科技股份有限公司 操作请求响应方法、装置、服务端和存储介质
CN112383576B (zh) * 2021-01-19 2021-11-09 北京信安世纪科技股份有限公司 操作请求响应方法、装置、服务端和存储介质
CN114979350A (zh) * 2022-04-26 2022-08-30 广州助蜂网络科技有限公司 一种基于手机的端口映射方法及装置

Also Published As

Publication number Publication date
CN106034130A (zh) 2016-10-19

Similar Documents

Publication Publication Date Title
JP7152466B2 (ja) セキュア通信方法及びそれに基づくスマートロックシステム
US11616775B2 (en) Network access authentication method, apparatus, and system
US10038676B2 (en) Call encryption systems and methods
CN106104562B (zh) 机密数据安全储存和恢复系统及方法
US8769612B2 (en) Portable device association
US8099761B2 (en) Protocol for device to station association
US20030196084A1 (en) System and method for secure wireless communications using PKI
CN105634737B (zh) 一种数据传输方法、终端及其系统
WO2016201811A1 (zh) 身份认证方法、装置及系统
WO2016045464A1 (zh) 解密方法和移动终端
CN110933484A (zh) 一种无线投屏设备的管理方法及装置
US20150304321A1 (en) An image management system and an image management method based on fingerprint authentication
CN106301767B (zh) 一种加密通话的处理方法、装置、终端及kmc
WO2016146046A1 (zh) 数据访问方法及装置
WO2017063517A1 (zh) 一种近距离通信的建立方法和装置
CN104754571A (zh) 用于多媒体数据传输的用户认证实现方法、装置及其系统
US9160739B2 (en) Secure data transmission system
EP4037250A1 (en) Message transmitting system with hardware security module
KR101358375B1 (ko) 스미싱 방지를 위한 문자메시지 보안 시스템 및 방법
CN104852800A (zh) 数据传输方法及装置
US20150156173A1 (en) Communication system utilizing fingerprint information and use thereof
KR101745482B1 (ko) 스마트홈 시스템에서의 통신 방법 및 그 장치
CN111488570A (zh) 认证方法及认证系统
CN108270917B (zh) 一种加密智能手机
WO2018121394A1 (zh) 移动终端、告警信息获取、告警信息发送方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16764226

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16764226

Country of ref document: EP

Kind code of ref document: A1