WO2022252356A1 - 数据处理方法、装置、电子设备及介质 - Google Patents

数据处理方法、装置、电子设备及介质 Download PDF

Info

Publication number
WO2022252356A1
WO2022252356A1 PCT/CN2021/106606 CN2021106606W WO2022252356A1 WO 2022252356 A1 WO2022252356 A1 WO 2022252356A1 CN 2021106606 W CN2021106606 W CN 2021106606W WO 2022252356 A1 WO2022252356 A1 WO 2022252356A1
Authority
WO
WIPO (PCT)
Prior art keywords
client
account data
storage
encrypted
data
Prior art date
Application number
PCT/CN2021/106606
Other languages
English (en)
French (fr)
Inventor
罗平
Original Assignee
腾讯云计算（北京）有限责任公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯云计算（北京）有限责任公司 filed Critical 腾讯云计算（北京）有限责任公司
Publication of WO2022252356A1 publication Critical patent/WO2022252356A1/zh
Priority to US18/132,126 priority Critical patent/US20230244797A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees

Definitions

  • the present application relates to the field of cloud technology, and in particular to a data processing method, device, electronic equipment and media.
  • the demand for unified storage of multiple client account data is also increasing.
  • the method for storing client account data is usually to manually add data and upload it to a remote server for storage.
  • the data is intercepted by hackers during data transmission, it will easily lead to data leakage, which will bring risks and losses to users. Therefore, how to improve the security of data storage in the process of storing client account data has become an urgent problem to be solved.
  • the embodiments of the present application provide a data processing method, device, electronic equipment, and medium, which can improve the security of data storage.
  • the embodiment of the present application provides a data processing method, the method comprising:
  • the output instruction In response to an output instruction, restore the client account data based on the stored encrypted client account data, and output it on the client interface of the storage client, the output instruction is stored in the storage An output instruction for the client account data acquired in the client.
  • the embodiment of the present application provides a data processing device, the device includes:
  • An acquisition module configured to acquire the client account data of the target client in the storage client, and acquire the storage key corresponding to the client account data, and the target client is a client authorized by the user;
  • An encryption module configured to encrypt the client account data based on the storage key, obtain encrypted client account data, and store the encrypted client account data;
  • An output module configured to restore the client account data based on the stored encrypted client account data in response to an output instruction, and output it on the client interface of the storage client, the output instruction is an output instruction for the client account data acquired in the storage client.
  • an embodiment of the present application provides an electronic device, the electronic device includes a processor and a memory, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions, Perform some or all of the steps in the method above.
  • an embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a processor, they are used to perform the above method some or all of the steps.
  • a computer program product or computer program includes program instructions, and the program instructions are stored in a computer-readable storage medium.
  • the processor of the computer device reads the program instructions from the computer-readable storage medium, and the processor executes the program instructions, so that the computer device executes the data processing method provided above.
  • the client account data of the target client can be obtained in the storage client, and the storage key corresponding to the client account data can be obtained, and the client account data can be encrypted based on the storage key to obtain the encrypted client Account data, and store encrypted client account data, thereby improving the security of data storage.
  • an output instruction for client account data is obtained in the storage client, restore the client account data based on the stored encrypted client account data, and output it on the client interface of the storage client.
  • FIG. 1 is a schematic diagram of an application architecture provided by an embodiment of the present application
  • FIG. 2 is a schematic diagram of an application architecture provided by an embodiment of the present application.
  • FIG. 3 is a schematic flow diagram of a data processing method provided in an embodiment of the present application.
  • FIG. 4 is a schematic diagram of a scenario of determining a target client provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a scenario of determining a target client provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a scenario of encrypted data provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a scenario for outputting client account data provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of a scenario for outputting client account data provided by an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of a data processing method provided in an embodiment of the present application.
  • FIG. 10 is a schematic diagram of a data processing scenario provided by an embodiment of the present application.
  • FIG. 11 is a schematic diagram of a data processing scenario provided by an embodiment of the present application.
  • FIG. 12 is a schematic diagram of a data processing scenario provided by an embodiment of the present application.
  • FIG. 13 is a schematic diagram of a data processing scenario provided by an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of a data processing device provided in an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • the data processing method proposed in the embodiment of the present application may be implemented in an electronic device, and the electronic device may be a server or a terminal device.
  • the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, and can also provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication Cloud servers for basic cloud computing services such as middleware services, domain name services, security services, content delivery network (Content Delivery Network, CDN), and big data and artificial intelligence platforms.
  • the terminal device may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto.
  • the embodiments of the present application may relate to the technical field related to cloud technology, such as the field of cloud security technology, wherein, cloud security (Cloud Security) refers to the general term of security software, hardware, users, institutions, and security cloud platforms based on cloud computing business model applications .
  • Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and judgment of unknown virus behavior. Through the abnormal monitoring of software behavior in the network through a large number of mesh clients, it obtains the latest information on Trojan horses and malicious programs in the Internet, and sends Go to the server for automatic analysis and processing, and then distribute the virus and Trojan solution to each client. Safe storage of data can be realized by implementing the technical solution of the present application and utilizing cloud security services.
  • FIG. 1 is a schematic diagram of an application architecture provided by an embodiment of the present application, through which the data processing method proposed in this application can be executed.
  • Fig. 1 may include an electronic device (here, the electronic device is taken as a terminal device as an example) and a storage server.
  • the terminal device can obtain the client account data of the authorized client (webpage client or application client) by executing the technical solution of this application, and encrypt the client account data, and the terminal device will encrypt The final client account data is stored through the storage client and storage server, thereby improving the security of data storage.
  • the terminal device can obtain the encrypted client account data from the storage client or the storage server, and based on the encrypted client account data in the storage client, The data restores and outputs the client account data.
  • the storage server may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server.
  • FIG. 2 is a schematic diagram of an application architecture provided by an embodiment of the present application.
  • a management client may also be included.
  • the terminal device before installing the storage client, the terminal device needs to send a client download request for the storage client to the management client, and after the management client reviews the user identity information of the target user carried in the client download request, it will store the The client installation data package and client login password are sent to the terminal device, based on which the terminal device can install and log in the storage client, and then can obtain or restore the output client account data in the logged-in storage client.
  • FIG. 1 and Fig. 2 are only exemplary representations of the application architecture proposed by the embodiment of the present application, and do not limit the architecture of the technical solution of the present application, that is, the technical solution of the present application can also provide other forms of application architecture.
  • the data processing methods mentioned later will be described using the application architecture shown in FIG. 2 as an example.
  • the electronic device may execute the data processing method according to actual business requirements to improve data storage security.
  • the technical solution of this application can be applied to the scenario where the client account data of multiple clients are stored uniformly, and the electronic device can encrypt the authorized client account data of multiple clients through the technical solution of this application, and store them in the storage
  • the client or the storage server when receiving the output instruction, restores the output based on the encrypted client account data in the storage client.
  • the data involved in this application can be stored in the database, or can be stored in the block chain, such as through the block chain distributed system storage , which is not limited in this application.
  • a storage server can be a node in a blockchain.
  • Blockchain is a new application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm.
  • Blockchain essentially a decentralized database, is a series of data blocks associated with each other using cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify its Validity of information (anti-counterfeiting) and generation of the next block.
  • the blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.
  • the underlying blockchain platform can include processing modules such as user management, basic services, smart contracts, and operational monitoring.
  • the user management module is responsible for the identity information management of all blockchain participants, including maintenance of public and private key generation (account management), key management, and maintenance of the corresponding relationship between the user's real identity and blockchain address (authority management), etc., and in In the case of authorization, supervise and audit transactions of certain real identities, and provide risk control rule configuration (risk control audit);
  • the basic service module is deployed on all blockchain node devices to verify the validity of business requests, And complete the consensus on valid requests and record them on the storage. For a new business request, the basic service first analyzes and authenticates the interface adaptation (interface adaptation), and then encrypts the business information through the consensus algorithm (consensus management).
  • the smart contract module is responsible for the registration and issuance of the contract, contract triggering and contract execution. Developers can define the contract logic through a programming language and publish it to On the blockchain (contract registration), according to the logic of the contract terms, call the key or other events to trigger execution, complete the contract logic, and also provide the function of contract upgrade and cancellation; the operation monitoring module is mainly responsible for the deployment during the product release process , configuration modification, contract setting, cloud adaptation, and visual output of real-time status during product operation, such as: alarms, monitoring network conditions, monitoring node device health status, etc.
  • the platform product service layer provides the basic capabilities and implementation framework of typical applications. Based on these basic capabilities, developers can superimpose the characteristics of the business and complete the blockchain implementation of business logic.
  • the application service layer provides application services based on blockchain solutions for business participants to use. For example, in this application, the data storage function can be provided through the block chain, and the stored data, such as encrypted client account data, can be provided to target users and the like.
  • FIG. 3 is a schematic flowchart of a data processing method provided by an embodiment of the present application. As shown in Figure 3, the flow of the data processing method in the embodiment of the present application may include the following:
  • the target client may be a webpage client, or an application client installed in the terminal device, and the client account data may include information such as a user name and a password for logging into the target client.
  • the client account data may include information such as a user name and a password for logging into the target client.
  • the acquired client account data may be one or more, and the data processing process and principle of the client account data for each target client are the same, here Take the target client and the corresponding client account data as an example for illustration.
  • the storage client is used to store client account data, and may also be called a token client, and the token client may be an application program (Application, APP) installed in a terminal device.
  • APP Application, APP
  • the terminal device determines the exemplary implementation of the target client as follows: according to the client authorization operation in the storage client, output the client authorization list, the client authorization list includes M clients to be authorized terminal, M is a positive integer, and according to the selection operation for M clients to be authorized, the selected client to be authorized is determined as the target client.
  • the selection operation may be a click operation, a long press operation, a slide operation, or a voice instruction operation for a client to be authorized that needs to be authorized in the client authorization list.
  • the selection operation for M clients to be authorized may be to determine one target client by one selection operation, or to determine multiple target clients by one selection operation, such as a batch selection operation for M clients to be authorized.
  • the terminal device when the terminal device detects the selection operation for the client to be authorized, it determines the client to be authorized as the authorized target client, and after authorization, the terminal device has the ability to access the target client at any time through the storage client. Based on this authority, the terminal device can obtain the historical account data of the target client or the account data after modifying the historical account data in the storage client, and use the historical account data or the modified account data as the client account data.
  • Figure 4 is a schematic diagram of a scene for determining the target client provided by the embodiment of the present application, wherein the terminal device outputs the client authorization list in the storage client according to the client authorization operation in the storage client , the client authorization list has multiple clients to be authorized (such as client 1, client 2, client 3, client 4...), the target user can search for the client name through the search bar Or quickly retrieve the corresponding client to be authorized by the first letter of the client name, and the terminal device can determine the selected client to be authorized as the target client according to the selection operation in the client authorization list (as shown in Figure 4 It is the client 3), and after authorization, the client account data of the target client can be obtained in the storage client.
  • the terminal device outputs the client authorization list in the storage client according to the client authorization operation in the storage client
  • the client authorization list has multiple clients to be authorized (such as client 1, client 2, client 3, client 4...)
  • the target user can search for the client name through the search bar Or quickly retrieve the corresponding client to be authorized by the first letter of the client name, and the terminal device
  • FIG. 5 is a schematic diagram of a scenario of determining a target client provided by an embodiment of the present application, wherein the terminal device outputs the client authorization operation in the storage client according to the client authorization operation in the storage client.
  • the client authorization list has multiple clients to be authorized (such as client 1, client 2, client 3, client 4...), the target user can determine multiple clients by triggering the batch selection control
  • the target client that is, in Figure 5(1), after detecting the triggering of the batch selection control, you can see in the client authorization list that each client to be authorized corresponds to a circular icon, and you can use the circular icon in the The selection operation for batch selection, and the selection operation of the client to be authorized can be realized by triggering the selection control; in Figure 5 (2), after the selection operation is performed on the circular icons corresponding to client 1 and client 3, the There is an icon in the circular icon to indicate that it has been checked. After clicking the OK control, the terminal device determines the selected client to be authorized as the target client (as shown in Figure 5 (2) is client 1, client 3).
  • the process for the terminal device to obtain the storage key corresponding to the client account data may include: generating an encrypted random number for encrypting the client account data, and obtaining an encrypted key for encrypting the encrypted random number. account key, and use the encrypted random number and encrypted account key as a storage key.
  • the process of the terminal device encrypting the client account data based on the storage key may include: encrypting the client account data based on an encrypted random number to obtain account encrypted data, and encrypting the client account data based on the encrypted account key.
  • the encrypted random number is encrypted to obtain encrypted data of the random number, and the encrypted data of the account and the encrypted data of the random number are determined as encrypted client account data. Encrypting both the client account data and the encrypted random number before storing can effectively increase the difficulty of decrypting the encrypted client account data, thereby improving security.
  • the terminal device after the terminal device obtains the encrypted client account data, it stores the encrypted client account data in the storage client in the terminal device, and then can obtain the stored encrypted client account data in the storage client. data and restore it to output.
  • Figure 6 is a schematic diagram of an encrypted data scenario provided by an embodiment of the present application, wherein, when the electronic device acquires the client account data of the target client in the storage client, it uses a random number source or The random number generator obtains the encrypted random number, and encrypts the client account data based on the encrypted random number to obtain the encrypted account data; then encrypts the encrypted random number based on the encrypted account key pre-selected and encapsulated in the storage client to obtain the random number Encrypt the data, and obtain encrypted client account data according to the encrypted account data and the random number encrypted data.
  • the random number generator obtains the encrypted random number, and encrypts the client account data based on the encrypted random number to obtain the encrypted account data; then encrypts the encrypted random number based on the encrypted account key pre-selected and encapsulated in the storage client to obtain the random number Encrypt the data, and obtain encrypted client account data according to the encrypted account data and the random number encrypted data.
  • step S203 is executed in response to an output instruction, where the output instruction is an output instruction for client account data acquired in the storage client.
  • an exemplary implementation in which the terminal device obtains the output instruction for the client account data in the storage client may be that, according to the account data viewing operation in the storage client, the output client has authorized List, the client authorized list includes N authorized clients, N is a positive integer, when a selection operation for a target client among the N authorized clients is detected, it is obtained in the storage client Output commands for client account data. Furthermore, the client account data corresponding to the selected target client will be output in the client interface of the storage client.
  • the selection operation may be a click operation, a long press operation, a slide operation, or a voice instruction operation for the target client in the authorized client list.
  • Figure 7 is a schematic diagram of a scenario for outputting client account data provided by an embodiment of the present application, wherein the terminal device outputs the client account data in the storage client according to the operation of viewing the account data in the storage client.
  • Authorized list the client authorized list has multiple authorized clients (such as client 1, client 3, ...), and the client account of each authorized client is stored in the storage client Data, the target user can search for the client name through the search bar, or quickly retrieve the corresponding authorized client through the initials of the client name (such as the initials A, B, ...
  • the terminal device can operate according to the selection operation for the target client (such as client 3) in the client authorized list (as shown in Figure 7 (1)), that is, after obtaining the output command for the client account data, a pop-up
  • the client account data details page of the target client i.e., the client interface.
  • This details page can view detailed client account data (such as user name, password, private relative information, home page address of the target client, etc.), that is, it can be stored in In the client interface of the client, restore and output the client account data based on the encrypted client account data (as shown in Figure 7(2)).
  • Figure 8 is a schematic diagram of a scenario for outputting client account data provided by the embodiment of the present application, wherein, when viewing client account data, an encrypted display control is set at the data display (as shown in Figure 8 (1)), the target user can trigger the encrypted display control so that the client account data is not directly displayed in plain text (as shown in Figure 8(2)), so as to prevent the client account data on the client interface from being seen by other users after being directly displayed .
  • each item in the client account data (such as the user name and password in Figure 8) can be separately set with an encrypted display control, and the target user can control the corresponding encrypted display control, so that each One item is displayed in plain text or cipher text, as shown in Figure 8(2), the user name is displayed in plain text, and the password is displayed in plain text.
  • the terminal device restores the client account data based on the stored encrypted client account data
  • the process of outputting on the client interface of the storage client may include: obtaining in the storage client The encrypted client account data is stored, and the decrypted account key corresponding to the encrypted account key is used to decrypt the random number encrypted data included in the encrypted client account data to obtain an encrypted random number, and based on The decrypted encrypted random number decrypts the account encrypted data included in the encrypted client account data to obtain the client account data, and outputs the decrypted client account data on the client interface.
  • the encrypted account data and the decrypted account data may be the same or different.
  • the client account data of the target client can be obtained in the storage client, and the storage key corresponding to the client account data can be obtained, and the client account data can be encrypted based on the storage key to obtain the encrypted client Account data, and store encrypted client account data, thereby improving the security of data storage.
  • the client account data is restored based on the stored encrypted client account data, and output on the client interface of the storage client.
  • FIG. 9 is a schematic flowchart of a data processing method provided by an embodiment of the present application.
  • the method can be executed by the above-mentioned electronic device, and the electronic device is used as a terminal device as an example for illustration.
  • the flow of the data processing method in the embodiment of the present application may include the following:
  • the terminal device obtains the client account data of the target client from the storage client.
  • An exemplary implementation may be to obtain the existing historical account data of the target client based on the storage client, and store the historical account data The account data is used as the client account data; or, when a modification operation on the historical account data is detected in the storage client, the account data after modification of the historical account data is determined as the client account data. That is, after the storage client is authorized to access the target client at any time, the terminal device can obtain the historical account data in the target client through the storage client, and encrypt the historical account data as the client account data or storage operations.
  • the modified historical account data will be acquired and encrypted or stored as client account data; if the modified historical account data is used as client account data When storing, the encrypted client account data obtained based on historical account data will be stored before. That is, the terminal device will use the latest account data as the client account data.
  • the storage key used for data encryption may include an encrypted random number and an encrypted account key
  • the process for the terminal device to obtain the storage key corresponding to the client account data may include: The data generates an encrypted random number, obtains an encrypted account key generated based on the client account data, and determines the encrypted random number and the encrypted account key as a storage key.
  • the encrypted account key is generated based on the client account data and unique to the target user.
  • the encrypted account key can be generated based on the user name in the client account data, or based on the Username generation in storage clients that encrypt or store client account data.
  • the encrypted account key may be the same or different.
  • the same encryption account key may be used when performing encryption operations on the client account data of all authorized target clients, or it may be performed on the client account data of all authorized target clients.
  • different target clients use different encryption account keys.
  • the encrypted random number can be generated by a random number source or a random number generator, and each time an encryption operation is performed on the client account data, a new encrypted random number will be generated, that is, the encrypted random number at each encryption Not the same; the target user is the user to which the terminal device belongs.
  • the terminal device needs to install and log in the storage client before obtaining the client account data of the target client from the storage client.
  • a client download request of the client where the client download request includes user identity information of the target user.
  • the terminal device will obtain the client installation data package and the client login password of the storage client sent by the management client.
  • the user identity information is encapsulated in the client installation data package, and the user identity information has a mapping relationship with the client login password.
  • the client login password may be generated based on user identity information (such as a valid identity document in the user identity information), the client login password has a mapping relationship with the target user's user identity information.
  • the terminal device can install the storage client based on the client installation data package, and log in the storage client based on the client login password. After logging in to the storage client, the client login password can be modified, and the terminal device can log in to the storage client. Get client account data from the terminal.
  • the management client can be a web page or an application client, etc., and the download request of the client can also include the storage space required by the target user, and the user identity information includes the target user's name, contact information, and valid identity certificate Wait.
  • the terminal device in addition to storing the client's login through the client's login password, the terminal device can also log in through a third-party authentication method (such as using other clients), or it can also use the face recognition method of the target user to log in.
  • the storage client before logging into the storage client based on the client login password, it may be detected whether the user identity information encapsulated in the installed storage client has a mapping relationship with the client login password. In response to the fact that the user identity information encapsulated in the installed storage client has a mapping relationship with the client login password, the storage client is logged in based on the client login password. If there is no mapping relationship, the aforementioned login action will not be performed.
  • the management server corresponding to the management client will initialize the storage client.
  • An exemplary implementation manner may be as follows:
  • the management server creates a user name for the target user in the storage server, and generates a corresponding client login password, and allocates a storage space of a specified size for the target user in the storage server based on the instruction of the client download request, and The access permission of the storage space is set to only allow the target user to read and write;
  • the management server generates an encrypted account key and a decrypted account key corresponding to the target user based on the user identity information, and stores the encrypted account key, the decrypted account key, the network address of the storage server, and the target user's address in the storage server.
  • the user name is encapsulated in the client installation data package of the storage client, so the terminal device can directly obtain the required information in the storage client installed based on the client installation data package;
  • the management server will also set a recovery password (such as a valid ID card) for recovery of the storage server and an acquisition password for obtaining data from the storage server.
  • a recovery password such as a valid ID card
  • an acquisition password for obtaining data from the storage server.
  • the management server will also create a user record of the target user in the user information database, which records the user identity information of the target user, and stores the recovery file of the client, which includes the user name and the target user in the storage server. Store the network address of client account data, encrypted account key, encrypted account key, etc. in the storage server.
  • the data of the terminal device in the storage client is lost or the data file in the storage client is damaged, or after the storage client needs to be reinstalled and the client installation data package is lost, the password of the storage client can be restored in the management server.
  • the management server will query the relevant information of the target user from the user information database, and based on the queried relevant information, restore the stored client data or return the client installation data package, etc. .
  • the management server can manage the storage server, that is, create a storage space in the storage server that is readable only by specified users, and acquire or back up data in the storage server.
  • the terminal device first downloads and installs the storage client as an initialization operation, and sends an application and use request carrying the user identity information of the target user to the management client through the storage client, and the management client receives the After obtaining the user's identity information and conducting an audit, the management server creates a user name in the storage server, generates an encrypted account key and a decrypted account key, and sends the storage server's network address, encrypted account key, decrypted account key and The user name is sent to the storage client, and the terminal device can set the client login password in the storage client.
  • S602. Encrypt the client account data based on the storage key to obtain encrypted client account data.
  • the encryption method for the client account data can be based on encrypted random numbers to perform symmetric encryption on the client account data, such as using a symmetric encryption algorithm (such as Data Encryption Standard (Data Encryption Standard, DES), Advanced Encryption Standard (Advanced Encryption Standard) Encryption Standard, AES), triple data encryption algorithm (Triple Data Encryption Algorithm, 3DES, etc.) and the encrypted random number as the key for symmetric encryption to encrypt the client account data, that is, the encrypted random number (also known as the key) as Parameter, input to the encryption algorithm that converts plaintext into ciphertext, so that the client account data (plaintext) is encrypted to obtain account encrypted data (ciphertext).
  • the encrypted random number used in the aforementioned encryption is used as a parameter to decrypt the account encrypted data (ciphertext) to obtain the client account data (plaintext).
  • the encryption method for encrypted random numbers can be symmetric encryption or asymmetric encryption for encrypted random numbers based on the encrypted account key. If it is symmetric encryption, the encrypted random number can be encrypted by How the data is encrypted (but the symmetric encryption algorithm used can vary). Correspondingly, when decrypting the encrypted random number data to obtain the encrypted random number, the decrypted account key corresponding to the encrypted account key can be used for decryption.
  • the encrypted account key and the encrypted account key are the same; if
  • the way to encrypt encrypted random numbers can be to use asymmetric encryption algorithms (Elliptic Curve Cryptography (Elliptic Curve Cryptography, ECC), Digital Signature Algorithm (Digital Signature Algorithm, DSA), etc.) and encrypt the account
  • ECC Elliptic Curve Cryptography
  • DSA Digital Signature Algorithm
  • the key is used as an asymmetric encryption key to encrypt the encrypted random number to obtain the random number encrypted data.
  • the decryption account key used is different from the encryption account key.
  • the terminal device after logging in to the storage client, the terminal device will use the network address of the storage server encapsulated in the storage client to establish a connection relationship with the storage server, based on which the encrypted Client Account Data.
  • the process of establishing the connection relationship is as follows: based on the network address, the storage server sends a connection request carrying the username and password of the target user to the storage server, and the storage server returns the connection response information after verifying the username and the corresponding password.
  • the terminal device receives the connection response information, it indicates that the connection relationship is successfully established, and then the storage space on the storage server is mapped to a virtual partition on the terminal device.
  • the virtual partition is a disk that stores data on the remote server virtualized by the terminal device. Like the local disk, the terminal device can read data on the virtual partition and view the storage space occupied by the virtual partition through the storage client. happening.
  • reading data from the storage space (virtual partition) of the storage server by the terminal device through the storage client can be realized based on a network protocol
  • the network protocol can be a Common Internet File System (Common Internet File System, CIFS) protocol.
  • the protocol can provide the storage client with the service of accessing the storage space on the storage server and receiving the required data returned by the storage server, or the network protocol can also be Hyper Text Transfer Protocol (Hyper Text Transfer Protocol, HTTP).
  • the protocol can also be a transmission control protocol (Transmission Control Protocol, TCP), which implements data transmission through bytecode, which can improve data transmission efficiency and reduce the number of encrypted client account data acquired by terminal devices from storage servers. time.
  • TCP Transmission Control Protocol
  • the terminal device After the terminal device stores the encrypted client account data through the storage client, it will send the encrypted client account data to the storage server based on the connection relationship and using the CIFS protocol, and the storage server will send the encrypted client account data to the storage server.
  • Account data is stored in the storage space previously created for the target user. Among them, if the client account data is the modified account data, the encrypted client account data based on the modified account data will be stored, which refers to using the encrypted client account data based on the modified account data Replace the encrypted client account data based on historical account data.
  • the management server can regularly back up the data in the storage server, such as using a tape library backup device for backup or transferring it to a third-party cloud storage server for backup, which can reduce server operating costs.
  • the terminal device can restore the data in the storage client and the storage server through the management server.
  • the management client can charge the target user by monthly subscription or other methods according to the size of the storage space allocated to the target user, and stop the storage client and storage of the terminal device when the target user is not paying the fee. server usage.
  • the terminal device when the output instruction is obtained, restores and outputs the client account data on the client interface based on the encrypted client account data stored in the storage client; or, when obtaining the When the instruction is output and the encrypted client account data cannot be obtained from the storage client (for example, the encrypted client account data stored in the storage client is deleted), the terminal device obtains the encrypted client account data from the storage server based on the connection relationship and the password. The encrypted client account data is restored and output on the client interface based on the encrypted client account data obtained from the storage server.
  • the terminal device restores and outputs the client account data on the client interface.
  • the data is verified.
  • the data signature is used to verify the integrity of the received data and the identity of the data sender to ensure the security of the received data. After the verification is passed, use the corresponding decryption account key and encrypted random number Decrypt and output the received encrypted client account data.
  • the storage client will always run in the background, so the connection relationship between the terminal device and the storage server will always be maintained.
  • the terminal device detects that the storage client exits (the process of the storage client is closed) Afterwards, the connection to the storage server is disconnected and the virtual partition disappears from the end device.
  • FIG. 10-FIG. 13 is a schematic diagram of a data processing scenario provided by the embodiment of the present application.
  • the client downloads the request to apply to the management client to use the storage client.
  • the management server performs initialization operations, that is, creates a user name and storage space, generates related keys (encrypted account key and decrypted account key) and related Password (client login password, access password, recovery password), the relevant information (network address of the storage server, user, related key) is encapsulated in the client installation data package, and the client installation data package and related passwords are sent to terminal device, and create the user record of the target user in the user information database;
  • the terminal device is connected to the storage server, that is, the terminal device installs the storage client based on the client installation data package, and uses the client login password to log in to the storage client end, read the network address of the storage server in the storage client, the terminal device sends a connection request based on the
  • the data is downloaded and decrypted, that is, the terminal device accesses the storage server through the storage client, and receives the encrypted client data sent by the storage server.
  • Terminal account data the terminal device decrypts the encrypted client account data, and outputs the decrypted client account data on the client interface of the storage client; in Figure 13, (1) Disconnect and store The connection relationship of the server, that is, after the terminal device detects that the storage client exits, it disconnects the connection relationship with the storage server, and the virtual partition in the terminal device disappears;
  • billing that is, the management client applies for the storage
  • the size of the space is billed by monthly subscription or other methods.
  • the client account data of the target client can be obtained in the storage client, and the storage key corresponding to the client account data can be obtained, and the client account data can be encrypted based on the storage key to obtain the encrypted client Account data, store the encrypted client account data in the storage client, and send the encrypted client account data to the storage server, so that the storage server stores the encrypted client account data, and when the storage client When the output instruction for the client account data is obtained in the computer, based on the stored encrypted client account data, the client account data is restored and output on the client interface of the storage client.
  • the client account data when the client account data is obtained, it can be encrypted and stored in the storage client using the storage key, and even if it is intercepted during data transmission, it cannot be obtained.
  • data which can reduce the risk of data leakage and improve data storage security; through encrypted storage data, client account data can be more safely restored and output, and data will be backed up, even if the stored client data is deleted or damaged,
  • the data in the storage client can also be restored to ensure that important data will not be lost, and the secure storage of client account data of multiple clients can be realized through the storage client and storage server, which improves user experience and convenience .
  • FIG. 14 is a schematic structural diagram of a data processing device provided by the present application. It should be noted that the data processing device shown in FIG. 14 is used to execute the method of the embodiment shown in FIG. 3 and FIG. 9 of the present application. For the convenience of description, only the parts related to the embodiment of the present application are shown. The technical details Not disclosed, refer to the embodiment shown in FIG. 3 and FIG. 9 of the present application.
  • the data processing device 800 may include: an acquisition module 801 , an encryption module 802 , and an output module 803 . in:
  • An acquisition module 801 configured to acquire the client account data of the target client in the storage client, and acquire the storage key corresponding to the client account data, and the target client is a client authorized by the user;
  • An encryption module 802 configured to encrypt the client account data based on the storage key, obtain encrypted client account data, and store the encrypted client account data;
  • the output module 803 is configured to restore the client account data based on the stored encrypted client account data in response to an output instruction, and output it on the client interface of the storage client, the output instruction is An output instruction for the client account data obtained in the storage client.
  • the obtaining module 801 when the obtaining module 801 is used to obtain the storage key corresponding to the client account data, it is used to:
  • the encryption module 802 When the encryption module 802 is used to encrypt the client account data based on the storage key to obtain encrypted client account data, it is used to:
  • the account encrypted data and the random number encrypted data are determined as the encrypted client account data.
  • the output module 803 is configured to restore the client account data based on the stored encrypted client account data when outputting instructions, and store When the client interface is output, it is used to:
  • the encryption module 802 when used to store encrypted client account data, it is used to:
  • the output module 803 is configured to restore the client account data based on the stored encrypted client account data when outputting instructions, and to restore the client account data when the client interface of the storage client outputs :
  • the interface restores and outputs the client account data.
  • the obtaining module 801 is also used to:
  • the client authorization list includes M clients to be authorized, and M is a positive integer;
  • the selected client to be authorized is determined as the target client.
  • the obtaining module 801 when the obtaining module 801 is used to obtain the client account data of the target client in the storage client, it is used to:
  • account data after modification of the historical account data is determined as the client account data.
  • the obtaining module 801 is also used to:
  • the client download request includes user identity information of the target user
  • the user identity information is encapsulated in the client installation data packet, and the user identity information is related to the client
  • the login password has a mapping relationship
  • the acquisition of the client account data of the target client in the storage client includes:
  • the obtaining module obtains the client account data of the target client in the storage client, and obtains the storage key corresponding to the client account data, and the encryption module encrypts the client account data based on the storage key to obtain the encrypted encrypted client account data, and store the encrypted client account data, thereby improving the security of data storage.
  • the output module obtains an output instruction for the client account data in the storage client, restore the client account data based on the stored encrypted client account data, and output it on the client interface of the storage client.
  • Each functional module in each embodiment of the present application may be integrated into one module, each module may exist separately physically, or two or more modules may be integrated into one module.
  • the above-mentioned integrated modules may be implemented in the form of hardware or in the form of software function modules, which is not limited in this application.
  • the electronic device 900 includes: at least one processor 901 and a memory 902 .
  • the electronic device may further include a network interface 903 .
  • data can be exchanged between the processor 901, the memory 902 and the network interface 903, the network interface 903 is controlled by the processor 903 for sending and receiving messages, the memory 902 is used for storing computer programs, and the computer programs include program instructions, and the processor 901 Used to execute the program instructions stored in the memory 902.
  • the processor 901 is configured to call the program instruction to execute the above method.
  • the memory 902 may include a volatile memory (volatile memory), such as a random-access memory (random-access memory, RAM); the memory 902 may also include a non-volatile memory (non-volatile memory), such as a flash memory (flash memory), solid-state hard drive (solid-state drive, SSD) etc.;
  • volatile memory volatile memory
  • non-volatile memory non-volatile memory
  • flash memory flash memory
  • solid-state drive solid-state drive
  • the processor 901 may be a central processing unit (central processing unit, CPU). In one embodiment, the processor 901 may also be a graphics processing unit (Graphics Processing Unit, GPU). The processor 901 may also be a combination of a CPU and a GPU.
  • CPU central processing unit
  • GPU Graphics Processing Unit
  • the memory 902 is used to store program instructions.
  • the processor 901 can invoke the program instructions to perform the following steps:
  • the processor 901 when the processor 901 is used to obtain the storage key corresponding to the client account data, it is used to:
  • the processor 901 When the processor 901 is configured to encrypt the client account data based on the storage key to obtain encrypted client account data, it is configured to:
  • the account encrypted data and the random number encrypted data are determined as the encrypted client account data.
  • the processor 901 is configured to restore the client account data based on the stored encrypted client account data when outputting the instruction, and store the encrypted client account data in the stored When the client interface is output, it is used to:
  • processor 901 when the processor 901 is used to store the encrypted client account data, it is used to:
  • the processor 901 is configured to restore the client account data based on the stored encrypted client account data when outputting the instruction, and when the client interface of the storage client outputs, for :
  • the interface restores and outputs the client account data.
  • the processor 901 is also configured to:
  • the client authorization list includes M clients to be authorized, and M is a positive integer;
  • the selected client to be authorized is determined as the target client.
  • the processor 901 when the processor 901 is used to acquire the client account data of the target client from the storage client, it is used to:
  • account data after modification of the historical account data is determined as the client account data.
  • the processor 901 is also configured to:
  • the client download request includes user identity information of the target user
  • the user identity information is encapsulated in the client installation data packet, and the user identity information is related to the client
  • the login password has a mapping relationship
  • the acquisition of the client account data of the target client in the storage client includes:
  • the data processing device 800, processor 901, memory 902, etc. described above may execute the implementation described in the above method embodiment, or may execute the implementation described in the embodiment of the present application, which will not be repeated here.
  • An embodiment of the present application also provides a computer (readable) storage medium, the computer storage medium stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a processor, the processor Part or all of the steps performed in the foregoing method embodiments may be performed.
  • the computer storage medium may be volatile or non-volatile.
  • the computer-readable storage medium may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application program required by at least one function, etc.; Use the created data etc.
  • the "plurality” mentioned herein means two or more.
  • “And/or” describes the association relationship of associated objects, indicating that there may be three types of relationships, for example, A and/or B may indicate: A exists alone, A and B exist simultaneously, and B exists independently.
  • the character “/” generally indicates that the contextual objects are an "or” relationship.
  • the program can be stored in a computer storage medium, and the computer storage medium can be As for the computer-readable storage medium, when the program is executed, it may include the processes of the embodiments of the above-mentioned methods.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM) or a random access memory (Random Access Memory, RAM), etc.

Abstract

本申请实施例公开了一种数据处理方法、装置、电子设备及介质，应用于云技术领域，涉及云安全技术领域。其中方法包括：在存储客户端中获取目标客户端的客户端账户数据，并获取客户端账户数据对应的存储密钥，目标客户端为用户已授权客户端，基于存储密钥对客户端账户数据进行加密，得到加密后的客户端账户数据，并存储加密后的客户端账户数据，响应于输出指令，基于所存储的加密后的客户端账户数据，对客户端账户数据进行还原，并在存储客户端的客户端界面输出，输出指令是在存储客户端中获取到的针对客户端账户数据的输出指令。

Description

数据处理方法、装置、电子设备及介质
本公开要求于2021年6月3日提交的申请号为202110621841.4、发明名称为“数据处理方法、装置、电子设备及介质”的中国专利申请的优先权，其全部内容通过引用结合在本公开中。
技术领域
本申请涉及云技术领域，尤其涉及一种数据处理方法、装置、电子设备及介质。
背景技术
目前，随着用户需要记忆越来越多的客户端账户数据，对于将多个客户端账户数据进行统一存储的需求也日趋增加。相关技术中，客户端账户数据存储方法通常是通过手动添加数据并上传至远端服务器进行存储。然而，在数据传输过程中若被黑客攻击拦截后容易导致数据泄露，进而给用户带来风险和损失。因此，如何在存储客户端账户数据的过程中提高数据存储的安全性成为一个亟待解决的问题。
发明内容
本申请实施例提供了一种数据处理方法、装置、电子设备及介质，可以提高数据存储的安全性。
一方面，本申请实施例提供了一种数据处理方法，该方法包括：
在存储客户端中获取目标客户端的客户端账户数据，并获取所述客户端账户数据对应的存储密钥，所述目标客户端为用户已授权客户端；
基于所述存储密钥对所述客户端账户数据进行加密，得到加密后的客户端账户数据，并存储所述加密后的客户端账户数据；
响应于输出指令，基于所存储的所述加密后的客户端账户数据，对所述客户端账户数据进行还原，并在所述存储客户端的客户端界面输出，所述输出指令是在所述存储客户端中获取到的针对所述客户端账户数据的输出指令。
一方面，本申请实施例提供了一种数据处理装置，该装置包括：
获取模块，用于在存储客户端中获取目标客户端的客户端账户数据，并获取所述客户端账户数据对应的存储密钥，所述目标客户端为用户已授权客户端；
加密模块，用于基于所述存储密钥对所述客户端账户数据进行加密，得到加密后的客户端账户数据，并存储所述加密后的客户端账户数据；
输出模块，用于响应于输出指令，基于所存储的所述加密后的客户端账户数据，对所述客户端账户数据进行还原，并在所述存储客户端的客户端界面输出，所述输出指令是在所述存储客户端中获取到的针对所述客户端账户数据的输出指令。
一方面，本申请实施例提供了一种电子设备，该电子设备包括处理器和存储器，其中，存储器用于存储计算机程序，该计算机程序包括程序指令，处理器被配置用于调用该程序指令，执行上述方法中的部分或全部步骤。
一方面，本申请实施例提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，该计算机程序包括程序指令，该程序指令被处理器执行时，用于执行上述方法中的部分或全部步骤。
相应地，根据本申请的一个方面，提供了一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括程序指令，该程序指令存储在计算机可读存储介质中。计算机设备的处理器从计算机可读存储介质读取该程序指令，处理器执行该程序指令，使得该计算机设备执行上述提供的数据处理方法。
本申请实施例中可以在存储客户端中获取目标客户端的客户端账户数据，并获取客户端账户数据对应的存储密钥，基于存储密钥对客户端账户数据进行加密，得到加密后的客户端账户数据，并存储加密后的客户端账户数据，进而提高数据存储的安全性。当在所述存储客户端中获取到针对客户端账户数据的输出指令时，基于所存储的加密后的客户端账户数据，对客户端账户数据进行还原，并在存储客户端的客户端界面输出。通过实施上述所提出的方法，可以在获取到已授权的客户端账户数据时，在存储客户端中就利用存储密钥对该数据进行加密存储；通过所加密存储的数据可以更安全对客户端账户数据进行还原输出，从而可以提高数据存储的安全性。
附图说明
为了更清楚地说明本申请实施例技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本申请实施例提供的一种应用架构示意图；
图2为本申请实施例提供的一种应用架构示意图；
图3为本申请实施例提供的一种数据处理方法的流程示意图；
图4为本申请实施例提供的一种确定目标客户端的场景示意图；
图5为本申请实施例提供的一种确定目标客户端的场景示意图；
图6为本申请实施例提供的一种加密数据的场景示意图；
图7为本申请实施例提供的一种输出客户端账户数据的场景示意图；
图8为本申请实施例提供的一种输出客户端账户数据的场景示意图；
图9为本申请实施例提供的一种数据处理方法的流程示意图；
图10为本申请实施例提供的一种数据处理的场景示意图；
图11为本申请实施例提供的一种数据处理的场景示意图；
图12为本申请实施例提供的一种数据处理的场景示意图；
图13为本申请实施例提供的一种数据处理的场景示意图；
图14为本申请实施例提供的一种数据处理装置的结构示意图；
图15为本申请实施例提供的一种电子设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
本申请实施例提出的数据处理方法可实现于电子设备，该电子设备可以服务器，也可以是终端设备。其中，服务器可以是独立的物理服务器，也可以是多个物理服务器构成的服务器集群或者分布式系统，还可以是提供云服务、云数据库、云计算、云函数、云存储、网络服务、云通信、中间件服务、域名服务、安全服务、内容分发网络(Content Delivery Network，CDN)、以及大数据和人工智能平台等基础云计算服务的云服务器。终端设备可以是智能手机、平板电脑、笔记本电脑、台式计算机、智能音箱、智能手表等，但并不局限于此。
本申请实施例可涉及云技术相关技术领域，比如涉及云安全技术领域，其中，云安全(Cloud Security)是指基于云计算商业模式应用的安全软件、硬件、用户、机构、安全云平台的总称。云安全融合了并行处理、网格计算、未知病毒行为判断等新兴技术和概念，通过网状的大量客户端对网络中软件行为的异常监测，获取互联网中木马、恶意程序的最新信息，并发送到服务端进行自动分析和处理，再把病毒和木马的解决方案分发到每一个客户端。可以通过执行本申请的技术方案和利用云安全服务实现数据的安全存储。
请参见图1，图1为本申请实施例提供的一种应用架构示意图，可以通过该应用架构执行本申请所提出的数据处理方法。如图1所示，图1可包括电子设备(此处以电子设备为终 端设备为例)和存储服务器。其中，终端设备可以通过执行本申请的技术方案来获取到已授权的客户端(网页客户端或应用客户端)的客户端账户数据，并对客户端账户数据进行加密，并且，终端设备将加密后的客户端账户数据通过存储客户端和存储服务器进行存储，进而提高数据存储的安全性。以及，当需在存储客户端中查看该客户端账户数据时，终端设备可以从存储客户端或存储服务器中获取加密后的客户端账户数据，并在存储客户端中基于加密后的客户端账户数据对客户端账户数据进行还原输出。可选的，该存储服务器可以是独立的物理服务器，也可以是多个物理服务器构成的服务器集群或者分布式系统，还可以是云服务器。
在一个可能的实施方式中，请参见图2，图2为本申请实施例提供的一种应用架构的示意图，在图1的基础上，还可以包括管理客户端。其中，在安装存储客户端之前，终端设备需发送针对存储客户端的客户端下载请求至管理客户端，在管理客户端对客户端下载请求中携带的目标用户的用户身份信息进行审核之后，将存储客户端安装数据包和客户端登录口令发送至终端设备，终端设备可以基于此安装并登录存储客户端，进而可以在登录的存储客户端中获取或还原输出客户端账户数据。
可以理解的是，图1和图2只是示例性地表征本申请实施例所提出的应用架构，并不对本申请技术方案的架构进行限定，即本申请技术方案还可以提供其他形式的应用架构。为了便于阐述，除非特别指明，后续所提及的数据处理方法均以应用在图2所示的应用架构为例进行说明。
可选的，在一些实施例中，电子设备可根据实际的业务需求，执行该数据处理方法以提高数据存储的安全性。例如，本申请技术方案可以应用于统一存储多个客户端的客户端账户数据的场景中，电子设备可以通过本申请技术方案将已授权的多个客户端的客户端账户数据进行加密，并存储在存储客户端或者存储服务器，在接收到输出指令时，在存储客户端中基于加密后的客户端账户数据进行还原输出。
可选的，本申请涉及的数据如加密后的客户端账户数据、目标用户的用户身份信息等，可以存储于数据库中，或者可以存储于区块链中，如通过区块链分布式系统存储，本申请不做限定。例如，存储服务器可以是区块链中的节点。
其中，区块链是分布式数据存储、点对点传输、共识机制、加密算法等计算机技术的新型应用模式。区块链(Blockchain)，本质上是一个去中心化的数据库，是一串使用密码学方法相关联产生的数据块，每一个数据块中包含了一批次网络交易的信息，用于验证其信息的有效性(防伪)和生成下一个区块。区块链可以包括区块链底层平台、平台产品服务层以及应用服务层。
区块链底层平台可以包括用户管理、基础服务、智能合约以及运营监控等处理模块。其中，用户管理模块负责所有区块链参与者的身份信息管理，包括维护公私钥生成(账户管理)、密钥管理以及用户真实身份和区块链地址对应关系维护(权限管理)等，并且在授权的情况下，监管和审计某些真实身份的交易情况，提供风险控制的规则配置(风控审计)；基础服务模块部署在所有区块链节点设备上，用来验证业务请求的有效性，并对有效请求完成共识后记录到存储上，对于一个新的业务请求，基础服务先对接口适配解析和鉴权处理(接口适配)，然后通过共识算法将业务信息加密(共识管理)，在加密之后完整一致的传输至共享账本上(网络通信)，并进行记录存储；智能合约模块负责合约的注册发行以及合约触发和合约执行，开发人员可以通过某种编程语言定义合约逻辑，发布到区块链上(合约注册)，根据合约条款的逻辑，调用密钥或者其它的事件触发执行，完成合约逻辑，同时还提供对合约升级注销的功能；运营监控模块主要负责产品发布过程中的部署、配置的修改、合约设置、云适配以及产品运行中的实时状态的可视化输出，例如：告警、监控网络情况、监控节点设备健康状态等。
平台产品服务层提供典型应用的基本能力和实现框架，开发人员可以基于这些基本能力，叠加业务的特性，完成业务逻辑的区块链实现。应用服务层提供基于区块链方案的应用服务给业务参与方进行使用。例如，在本申请中，可以通过区块链提供数据存储功能，并可将存储的数据如加密后的客户端账户数据提供给目标用户等。
可以理解，上述场景仅是作为示例，并不构成对于本申请实施例提供的技术方案的应用场景的限定，本申请的技术方案还可应用于其他场景。例如，本领域普通技术人员可知，随着系统架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
基于上述的描述，本申请实施例提出了一种数据处理方法，该方法可以由上述提及的电子设备来执行，此处以电子设备为终端设备为例进行说明。请参见图3，图3为本申请实施例提供的一种数据处理方法的流程示意图。如图3所示，本申请实施例的数据处理方法的流程可以包括如下：
S201、在存储客户端中获取目标客户端的客户端账户数据，并获取客户端账户数据对应的存储密钥，目标客户端为用户已授权客户端。
其中，目标客户端可以是网页客户端，还可以是安装在终端设备中的应用客户端，以及客户端账户数据可以包括用于登录目标客户端的用户名、密码等信息。此外，目标客户端可以是一个或多个，相应的，获取到的客户端账户数据可以是一个或多个，针对每个目标客户端的客户端账户数据的数据处理过程和原理相同，此处则以目标客户端和对应的客户端账户数据是一个为例进行说明。
存储客户端用于存储客户端账户数据，也可以称之为令牌客户端，该令牌客户端可以是安装在终端设备中的应用程序(Application，APP)。
在一个可能的实施方式中，终端设备确定目标客户端的示例性实施方式为：根据在存储客户端中的客户端授权操作，输出客户端授权列表，该客户端授权列表包括了M个待授权客户端，M为正整数，根据针对M个待授权客户端的选择操作，将所选择的待授权客户端确定为目标客户端。其中，选择操作可以是在客户端授权列表中针对需进行授权的待授权客户端的点击操作、长按操作、滑动操作或语音指示操作。其中，该针对M个待授权客户端的选择操作可以是一次选择操作确定一个目标客户端，也可以是一个选择操作确定多个目标客户端，如针对M个待授权客户端的批量选择操作。以及当终端设备检测到针对待授权客户端的选择操作后，将待授权客户端确定为已授权的目标客户端，并在授权之后，终端设备具有可以通过存储客户端对目标客户端随时进行访问的权限，并基于该权限，终端设备可以在存储客户端中获取到目标客户端的历史账户数据或者对历史账户数据进行修改后的账户数据，并将该历史账户数据或者修改后的账户数据作为客户端账户数据。
例如，如图4所示，图4为本申请实施例提供的一种确定目标客户端的场景示意图，其中，终端设备根据在存储客户端的客户端授权操作，在存储客户端中输出客户端授权列表，该客户端授权列表有多个待授权客户端(如客户端1、客户端2、客户端3、客户端4......)，目标用户可以通过搜索栏进行客户端名称的搜索或者通过客户端名称首字母快速检索到相应的待授权客户端，以及终端设备可以根据在客户端授权列表中的选择操作，将所选择的待授权客户端确定为目标客户端(如图4中即为客户端3)，并在进行授权之后可以在存储客户端中获取到目标客户端的客户端账户数据。
又如，如图5所示，图5为本申请实施例提供的一种确定目标客户端的场景示意图，其中，终端设备根据在存储客户端的客户端授权操作，在存储客户端中输出客户端授权列表，该客户端授权列表有多个待授权客户端(如客户端1、客户端2、客户端3、客户端4......)，目标用户可以通过触发批量选择控件确定多个目标客户端，即在图5(1)中，在检测到批量选择控件触发后，可以在客户端授权列表中查看到每个待授权客户端对应一个圆形图标，可以通过在圆形图标中的选择操作进行批量选择，以及可以通过触发全选控件实现待授权客户端的全选操作；在图5(2)中，对客户端1和客户端3对应的圆形图标进行选择操作后，其圆形图标中有用于表示已勾选的图标，通过点击确定控件之后，终端设备将所选择的待授权客户端确定为目标客户端(如图5(2)中即为客户端1、客户端3......)。
在一个可能的实施方式中，终端设备获取客户端账户数据对应的存储密钥的过程可以包 括：生成用于加密客户端账户数据的加密随机数，以及获取用于对加密随机数进行加密的加密账户密钥，并将该加密随机数和加密账户密钥作为存储密钥。
S202、基于存储密钥对客户端账户数据进行加密，得到加密后的客户端账户数据，并存储加密后的客户端账户数据。
在一个可能的实施方式中，终端设备基于存储密钥对客户端账户数据进行加密的过程可以包括：基于加密随机数对客户端账户数据进行加密，得到账户加密数据，并基于加密账户密钥对加密随机数进行加密，得到随机数加密数据，将该账户加密数据和该随机数加密数据确定为加密后的客户端账户数据。对客户端账户数据和加密随机数均进行加密后再存储，可以有效地提高对加密后的客户端账户数据进行解密的难度，进而提高安全性。其中，终端设备在得到加密后的客户端账户数据之后，将该加密后的客户端账户数据存储于终端设备中的存储客户端中，进而可以在存储客户端中获取所存储的该加密后的数据并对其进行还原输出。
例如，如图6所示，图6为本申请实施例提供的一种加密数据的场景示意图，其中，电子设备在存储客户端中获取到目标客户端的客户端账户数据时，利用随机数源或者随机数生成器得到加密随机数，并基于加密随机数对客户端账户数据进行加密，得到加密账户数据；然后基于存储客户端中预选封装好的加密账户密钥对加密随机数进行加密得到随机数加密数据，并根据加密账户数据和随机数加密数据得到加密后的客户端账户数据。
S203、当在存储客户端中获取到针对客户端账户数据的输出指令时，基于所存储的加密后的客户端账户数据，对客户端账户数据进行还原，并在存储客户端的客户端界面输出。
也即响应于输出指令，执行步骤S203，输出指令是在存储客户端中获取到的针对客户端账户数据的输出指令。
在一个可能的实施方式中，终端设备在存储客户端中获取到针对客户端账户数据的输出指令的示例性实施方式可以是，根据在存储客户端中的账户数据查看操作，输出客户端已授权列表，该客户端已授权列表包括N个已授权客户端，N为正整数，当检测到针对该N个已授权客户端中的目标客户端的选择操作时，即为在存储客户端中获取到针对客户端账户数据的输出指令。进而在存储客户端的客户端界面中会输出所选择的目标客户端对应的客户端账户数据。其中，该选择操作可以是在客户端已授权列表中针对目标客户端的点击操作、长按操作、滑动操作或语音指示操作。
例如，如图7所示，图7为本申请实施例提供的一种输出客户端账户数据的场景示意图，其中，终端设备根据在存储客户端的账户数据查看操作，在存储客户端中输出客户端已授权列表，该客户端已授权列表有多个已授权客户端(如客户端1、客户端3、......)，存储客户端中存储有每个已授权客户端的客户端账户数据，目标用户可以通过搜索栏进行客户端名称的搜索，或者通过客户端名称首字母(例如图7中的首字母A、B、......)快速检索到相应的已授权客户端，以及终端设备可以根据在客户端已授权列表中针对目标客户端(如客户端3)的选择操作(如图7(1))，即获取到针对客户端账户数据的输出指令之后，会弹出目标客户端的客户端账户数据详情页(即客户端界面)，该详情页可以查看详细的客户端账户数据(如用户名、密码、私密亲属信息、目标客户端的主页地址等)，即可以在存储客户端的客户端界面中，基于加密后的客户端账户数据对客户端账户数据进行还原输出并查看(如图7(2))。
又如，如图8所示，图8为本申请实施例提供的一种输出客户端账户数据的场景示意图，其中，查看客户端账户数据时，数据显示处设置有加密显示控件(如图8(1))，目标用户可以触发加密显示控件以使客户端账户数据不以明文直接显示(如图8(2))，以免客户端界面上的客户端账户数据直接显示后被其他用户看到。
如图8所示，客户端账户数据中的每一项(例如图8中的用户名、密码)可以分别设置加密显示控件，目标用户可以分别控制各项对应的加密显示控件，以使的每一项以明文或者密文的形式显示，如图8(2)中，用户名即是以明文形式显示，而密码是以明文形式显示的。
在一个可能的实施方式中，终端设备基于所存储的加密后的客户端账户数据，对客户端账户数据进行还原，并在存储客户端的客户端界面输出的过程可以包括：在存储客户端中获 取所存储的加密后的客户端账户数据，并利用与加密账户密钥相对应的解密账户密钥对加密后的客户端账户数据所包括的随机数加密数据进行解密，得到加密随机数，并基于解密得到的加密随机数对加密后的客户端账户数据所包括的账户加密数据进行解密，得到客户端账户数据，并在客户端界面输出解密得到的客户端账户数据。其中，加密账户数据和解密账户数据可以相同或不相同。
本申请实施例中可以在存储客户端中获取目标客户端的客户端账户数据，并获取客户端账户数据对应的存储密钥，基于存储密钥对客户端账户数据进行加密，得到加密后的客户端账户数据，并存储加密后的客户端账户数据，进而提高数据存储的安全性。当在存储客户端中获取到针对客户端账户数据的输出指令时，基于所存储的加密后的客户端账户数据，对客户端账户数据进行还原，并在存储客户端的客户端界面输出。通过实施本申请实施例所提出的方法，可以在获取到已授权的客户端账户数据时，在存储客户端中就利用存储密钥对该数据进行加密存储；通过所加密存储的数据可以更安全对客户端账户数据进行还原输出，进而可以提高数据存储的安全性。
请参加图9，图9为本申请实施例提供的一种数据处理方法的流程示意图，该方法可以由上述提及的电子设备执行，此处以电子设备为终端设备为例进行说明。如图9所示，本申请实施例中数据处理方法的流程可以包括如下：
S601、在存储客户端中获取目标客户端的客户端账户数据，并获取客户端账户数据对应的存储密钥，目标客户端为用户已授权客户端。
确定的目标客户端的实施方式可以参见上述步骤S201的相关描述，此处不再赘述。
在一个可能的实施方式中，终端设备在存储客户端中获取目标客户端的客户端账户数据示例性实施方式可以是，基于存储客户端获取目标客户端中已有的历史账户数据，并将该历史账户数据作为客户端账户数据；或者，当在存储客户端中检测到针对历史账户数据的修改操作时，将对历史账户数据进行修改后的账户数据确定为客户端账户数据。即对存储客户端授权了对目标客户端可以随时进行访问的权限后，终端设备可以通过存储客户端获取到目标客户端中的历史账户数据，并将该历史账户数据作为客户端账户数据进行加密或存储操作。若在存储客户端中检测到了历史账户数据被修改，则获取修改后的历史账户数据，并将其作为客户端账户数据进行加密或存储操作；若修改后的历史账户数据作为客户端账户数据进行存储时，此前会存储有基于历史账户数据得到的加密后的客户端账户数据。即终端设备会以最新的账户数据作为客户端账户数据。
在一个可能的实施方式中，用于进行数据加密的存储密钥可以包括加密随机数和加密账户密钥，因此终端设备获取客户端账户数据对应的存储密钥的过程可以包括：针对客户端账户数据生成加密随机数，并获取基于客户端账户数据生成的加密账户密钥，并将该加密随机数和加密账户密钥确定为存储密钥。可以理解的是，加密账户密钥是基于客户端账户数据生成的并专属于目标用户的密钥，例如加密账户密钥可以是基于客户端账户数据中的用户名生成的，也可以是基于用于加密或存储客户端账户数据的存储客户端中的用户名生成。每次在基于目标用户的存储密钥对相同或者不同的客户端账户数据进行加密时，该加密账户密钥可以相同也可以不相同。例如，可以是在对所有已授权的目标客户端的客户端账户数据执行加密操作时，均使用相同的加密账户密钥，或者，还可以是在对所有已授权的目标客户端的客户端账户数据执行加密操作时，不同的目标客户端使用不同的加密账户密钥。以及，加密随机数可以利用随机数源或随机数生成器生成，以及在每次对客户端账户数据执行加密操作时，都会生成一个新的加密随机数，即每次加密时的加密随机数均不相同；目标用户为终端设备所属的用户。
在一个可能的实施方式中，终端设备在存储客户端中获取目标客户端的客户端账户数据之前，需安装和登录存储客户端，因此实施方式可以是，终端设备向管理客户端发送目标用户针对存储客户端的客户端下载请求，该客户端下载请求包括目标用户的用户身份信息。并 且终端设备会获取管理客户端发送的存储客户端的客户端安装数据包和客户端登录口令，该客户端安装数据包中封装有用户身份信息，该用户身份信息与客户端登录口令具备映射关系，其中，由于客户端登录口令可以是基于用户身份信息(如用户身份信息中的有效身份证件等)生成的，因此该客户端登录口令与目标用户的用户身份信息具备映射关系。进而终端设备可以基于客户端安装数据包安装存储客户端，并基于客户端登录口令登录存储客户端，在登录存储客户端之后可以对客户端登录口令进行修改，以及终端设备可以在登录的存储客户端中获取客户端账户数据。其中，管理客户端可以是网页端或者应用客户端等，该客户端下载请求中还可以包括目标用户所需的存储空间大小，以及该用户身份信息包括目标用户的姓名、联系方式、有效身份证件等。可选的，终端设备除了可以通过客户端登录口令进行存储客户端的登录，还可以通过第三方认证的方式(如利用其他客户端)进行登录，或者，还可以通过目标用户的人脸识别的方式进行登录。
可选的，在基于客户端登录口令登录存储客户端之前，可以检测所安装的存储客户端中封装的用户身份信息与客户端登录口令是否具备映射关系。响应于所安装的存储客户端中封装的用户身份信息与客户端登录口令具备映射关系，基于客户端登录口令登录存储客户端。如果不具备映射关系，则不执行前述登录动作。
可选的，在管理客户端的管理人员在对目标用户的用户身份信息审核通过后，管理客户端对应的管理服务器会对存储客户端进行初始化操作，示例性实施方式可以为：
(1)管理服务器在存储服务器中创建针对目标用户的用户名，以及生成对应的客户端登录口令，并基于客户端下载请求的指示在存储服务器中为目标用户分配指定大小的存储空间，以及将该存储空间的访问权限设置为只允许目标用户进行读写；
(2)管理服务器基于用户身份信息生成目标用户对应的加密账户密钥和解密账户密钥，并将该加密账户密钥、解密账户密钥、存储服务器的网络地址和存储服务器中的目标用户的用户名封装在存储客户端的客户端安装数据包中，因此终端设备可以在基于客户端安装数据包进行安装的存储客户端中直接获取到所需信息；
(3)管理服务器还会设置用于进行存储服务器恢复的恢复口令(如有效身份证件)和用于从存储服务器中获取数据的获取口令，只有在该获取口令验证成功后，终端设备才能从存储服务器中获取客户端账户数据，并将该恢复口令和获取口令发给终端设备；
(4)管理服务器还会在用户信息数据库中创建目标用户的用户记录，其中记录了目标用户的用户身份信息，以及存储客户端恢复文件，该恢复文件包括在存储服务器中的用户名以及目标用户在存储服务器中存放客户端账户数据的网络地址以及加密账户密钥和加密账户密钥等。终端设备在存储客户端中的数据丢失或存储客户端中的数据文件被损坏或在需重新安装存储客户端且丢失了客户端安装数据包之后，可以通过恢复口令在管理服务器中进行存储客户端的恢复，即管理客户端在验证恢复口令正确之后，管理服务器会从用户信息数据库中查询目标用户的相关信息，并基于查询到的相关信息进行存储客户端的数据恢复或者重新返回客户端安装数据包等。可以理解的是，管理服务器可以对存储服务器进行管理，即可以在存储服务器中创建仅指定用户可读的存储空间，以及对存储服务器中的数据进行获取或者备份处理。
可选的，还可以是，终端设备先下载安装为进行初始化操作的存储客户端，并通过存储客户端向管理客户端发送携带了目标用户的用户身份信息的申请使用请求，管理客户端在接收到用户身份信息并进行审核之后，管理服务器在存储服务器中创建用户名，以及生成加密账户密钥和解密账户密钥，并将该存储服务器的网络地址、加密账户密钥、解密账户密钥和用户名发送给存储客户端，以及终端设备可以在存储客户端中设置客户端登录口令。
S602、基于存储密钥对客户端账户数据进行加密，得到加密后的客户端账户数据。
在一个可能的实施方式中，基于存储密钥对客户端账户进行加密的示例性实施方式可以参见上述步骤S202的相关描述，此处不再赘述。
可选的，针对客户端账户数据的加密方式可以是基于加密随机数对客户端账户数据进行 对称加密，如利用对称加密算法(如数据加密标准(Data Encryption Standard，DES)、高级加密标准(Advanced Encryption Standard，AES)、三重数据加密算法(Triple Data Encryption Algorithm，3DES)等)并将加密随机数作为对称加密的密钥对客户端账户数据进行加密，即将加密随机数(又称密钥)作为参数，输入将明文转换为密文的加密算法中，以使对客户端账户数据(明文)进行加密得到账户加密数据(密文)。相应的，在对账户加密数据进行时，将前述加密时使用的加密随机数作为参数对该账户加密数据(密文)进行解密得到客户端账户数据(明文)。
可选的，针对加密随机数的加密方式可以是基于加密账户密钥对加密随机数进行对称加密或者非对称加密，若为对称加密时，对加密随机数进行加密的方式可以通过对客户端账户数据进行加密的方式(但使用的对称加密算法可以不同)。相应的，在对随机数加密数据进行解密得到加密随机数时，可以是利用与加密账户密钥相对应的解密账户密钥进行解密，此时，加密账户密钥和加密账户密钥相同；若为非对称加密时，对加密随机数进行加密的方式可以是利用非对称加密算法(椭圆曲线加密算法(Elliptic Curve Cryptography，ECC)、数字签名算法(Digital Signature Algorithm，DSA)等)并将加密账户密钥作为非对称加密的密钥对加密随机数进行加密得到随机数加密数据。相应的，在解密时，所利用的解密账户密钥与加密账户密钥不相同。
S603、在存储客户端中存储加密后的客户端账户数据，并将加密后的客户端账户数据发送给存储服务器，以使存储服务器存储加密后的客户端账户数据。
在一个可能的实施方式中，终端设备在登录存储客户端之后，会使用存储客户端中封装的存储服务器的网络地址与存储服务器建立连接关系，可以基于该连接关系上传、下载或删除加密后的客户端账户数据。
其中，建立连接关系的过程如下：基于网络地址向存储服务器发送携带了目标用户的用户名和获取口令的连接请求，存储服务器在对用户名和对应的获取口令进行验证通过后，返回连接响应信息，在终端设备接收到该连接响应信息时，表示成功建立连接关系，进而把存储服务器上的存储空间映射为终端设备上的虚拟分区。其中，虚拟分区即为终端设备虚拟出的远程服务器上的一个存储数据的磁盘，同本地磁盘一样，终端设备可以通过存储客户端在该虚拟分区上读取数据以及可以查看虚拟分区的存储空间占用情况。
以及，终端设备通过存储客户端从存储服务器的存储空间(虚拟分区)中读取数据可以是基于网络协议实现的，该网络协议可以是通用互联网文档系统(Common Internet File System，CIFS)协议，该协议可以给存储客户端提供访问存储服务器上的存储空间并接收该存储服务器返回的所需数据的服务，或者，该网络协议还可以是超文本传输协议(Hyper Text Transfer Protoco，HTTP)，该网络协议还可以是传输控制协议(Transmission Control Protocol，TCP)，该协议是通过字节码方式实现数据的传输，可以提高数据传输效率，减小终端设备从存储服务器上获取加密后的客户端账户数据的时间。
基于此，终端设备在通过存储客户端存储加密后的客户端账户数据之后，会基于连接关系以及利用CIFS协议将加密后的客户端账户数据发送给存储服务器，存储服务器会将加密后的客户端账户数据存储在此前针对目标用户创建的存储空间中。其中，若客户端账户数据会修改后的账户数据时，将基于修改后的账户数据得到加密后的客户端账户数据进行存储，是指用基于修改后的账户数据得到加密后的客户端账户数据对基于历史账户数据得到加密后的客户端账户数据进行替换。
可选的，管理服务器可以定期对存储服务器中的数据进行备份，如使用磁带库备份装置进行备份或者传输至第三方云存储服务器进行备份，可以降低服务器运营成本，当存储客户端中的数据以及存储服务器中的数据被删除时，终端设备可以通过管理服务器进行存储客户端和存储服务器中的数据恢复。进一步可选的，管理客户端可以根据为目标用户所分配的存储空间的大小对目标用户采用包月或其他方式进行收费功能，在目标用户为进行费用缴纳时，停止终端设备的存储客户端和存储服务器的使用功能。
S604、当在存储客户端中获取到针对客户端账户数据的输出指令时，基于所存储的加密后的客户端账户数据，对客户端账户数据进行还原，并在存储客户端的客户端界面输出。
在一个可能的实施方式中，当获取到输出指令时，终端设备基于在存储客户端中所存储的加密的客户端账户数据，在客户端界面对客户端账户数据进行还原输出；或者，当获取到输出指令以及无法从存储客户端中获取加密后的客户端账户数据时(例如存储客户端中的存储的加密的客户端账户数据被删除)，终端设备基于连接关系和获取口令从存储服务器获取该加密后的客户端账户数据，并基于从存储服务器处所获取到的加密后的客户端账户数据在客户端界面对客户端账户数据进行还原输出。
其中，终端设备基于从存储服务器处所获取到的加密后的客户端账户数据，在客户端界面对客户端账户数据进行还原输出的示例性实施方式可以是，首先利用数字签名对从存储服务器处接收的数据进行验证，该数据签名用于验证接收到数据的完整性和数据发送方的身份，以确保接收到的数据的安全性，在验证通过后，利用相应的解密账户密钥和加密随机数对所接收的加密后的客户端账户数据进行解密并输出。
此外，在存储客户端的使用过程中，存储客户端会以后台的方式一直运行，因此终端设备与存储服务器的连接关系会一直保持，在终端设备检测到存储客户端退出(存储客户端的进程关闭)之后，会断开与存储服务器的连接，虚拟分区也会从终端设备中消失。
例如，请参见图10-图13，图10-图13为本申请实施例提供的一种数据处理的场景示意图，其中，在图10中，终端设备向管理客户端发送目标用户针对存储客户端的客户端下载请求，以向管理客户端申请使用存储客户端，审核通过后，管理服务器执行初始化操作，即创建用户名和存储空间，生成相关密钥(加密账户密钥和解密账户密钥)以及相关口令(客户端登录口令、获取口令、恢复口令)，将相关信息(存储服务器的网络地址、用户、相关密钥)封装在客户端安装数据包中，将客户端安装数据包和相关口令发送给终端设备，并在用户信息数据库中创建目标用户的用户记录；在图11中，终端设备连接存储服务器，即终端设备基于客户端安装数据包安装存储客户端，并利用客户端登录口令登录存储客户端，在存储客户端中读取存储服务器的网络地址，终端设备基于网络地址发送连接请求，存储服务器在身份验证通过后与终端设备建立连接关系，终端设备将存储服务器中的存储空间映射为虚拟分区；在图12中，(1)数据加密上传，即终端设备通过存储客户端获取客户端账户数据，并对客户端账户数据进行加密得到加密后的客户端账户数据，终端设备基于连接关系将加密后的客户端账户数据上传以存储服务器，存储服务器将该数据存储于存储空间中，(2)数据下载解密，即终端设备通过存储客户端访问存储服务器，接收存储服务器发送的加密后的客户端账户数据，终端设备对加密后的客户端账户数据进行解密，并将解密后得到的客户端账户数据在存储客户端的客户端界面上进行输出；在图13中，(1)断开与存储服务器的连接关系，即终端设备检测到存储客户端退出后，断开与存储服务器的连接关系，以及终端设备中的虚拟分区消失；(2)计费，即管理客户端根据目标用户申请的存储空间的大小，采用包月或其他方式进行计费。
本申请实施例中可以在存储客户端中获取目标客户端的客户端账户数据，并获取客户端账户数据对应的存储密钥，基于存储密钥对客户端账户数据进行加密，得到加密后的客户端账户数据，在存储客户端中存储加密后的客户端账户数据，并将加密后的客户端账户数据发送给存储服务器，以使存储服务器存储加密后的客户端账户数据，并当在存储客户端中获取到针对客户端账户数据的输出指令时，基于所存储的加密后的客户端账户数据，对客户端账户数据进行还原，并在存储客户端的客户端界面输出。通过实施本申请实施例所提出的方法，可以在获取到客户端账户数据时，在存储客户端中就利用存储密钥对其进行加密存储，进而在数据传输过程中即使被拦截也无法获取到数据，可以降低数据泄露的风险和提高数据存储安全性；通过所加密存储的数据可以更安全对客户端账户数据进行还原输出，以及会对数据进行备份，即使存储客户端数据被删除或损坏，也可以对存储客户端中的数据进行恢复，以确保重要数据不会丢失，以及可以通过存储客户端和存储服务器实现多个客户端的客户端账 户数据的安全存储，提高了用户体验感和便利性。
请参见图14，图14为本申请提供的一种数据处理装置的结构示意图。需要说明的是，图14所示的数据处理装置，用于执行本申请图3和图9所示实施例的方法，为了便于说明，仅示出了与本申请实施例相关的部分，技术细节未揭示，经参照本申请图3和图9所示的实施例。该数据处理装置800可包括：获取模块801、加密模块802、输出模块803。其中：
获取模块801，用于在存储客户端中获取目标客户端的客户端账户数据，并获取所述客户端账户数据对应的存储密钥，所述目标客户端为用户已授权客户端；
加密模块802，用于基于所述存储密钥对所述客户端账户数据进行加密，得到加密后的客户端账户数据，并存储加密后的客户端账户数据；
输出模块803，用于响应于输出指令，基于所存储的所述加密后的客户端账户数据，对所述客户端账户数据进行还原，并在所述存储客户端的客户端界面输出，输出指令是在所述存储客户端中获取到的针对所述客户端账户数据的输出指令。
在一个可能的实施方式中，获取模块801在用于获取所述客户端账户数据对应的存储密钥时，用于：
针对所述客户端账户数据生成加密随机数，并获取基于所述客户端账户数据生成的加密账户密钥；
将所述加密随机数和所述加密账户密钥确定为所述存储密钥；
加密模块802在用于基于所述存储密钥对所述客户端账户数据进行加密，得到加密后的客户端账户数据时，用于：
基于所述加密随机数对所述客户端账户数据进行加密，得到账户加密数据；
基于所述加密账户密钥对所述加密随机数进行加密，得到随机数加密数据；
将所述账户加密数据和所述随机数加密数据确定为所述加密后的客户端账户数据。
在一个可能的实施方式中，输出模块803在用于当输出指令时，基于所存储的所述加密后的客户端账户数据，对所述客户端账户数据进行还原，并在所述存储客户端的客户端界面输出时，用于：
当获取到所述输出指令时，基于与所述加密账户密钥相对应的解密账户密钥对所述随机数加密数据进行解密，得到所述加密随机数；
基于解密得到的所述加密随机数对所述账户加密数据进行解密，得到所述客户端账户数据；
在所述客户端界面输出解密得到的所述客户端账户数据。
在一个可能的实施方式中，加密模块802在用于存储加密后的客户端账户数据时，用于：
在所述存储客户端中存储所述加密后的客户端账户数据，并将所述加密后的客户端账户数据发送给存储服务器，以使所述存储服务器存储所述加密后的客户端账户数据；
输出模块803在用于当输出指令时，基于所存储的所述加密后的客户端账户数据，对所述客户端账户数据进行还原，并在所述存储客户端的客户端界面输出时，用于：
当获取到所述输出指令时，基于在所述存储客户端中所存储的所述加密后的客户端账户数据，在所述客户端界面对所述客户端账户数据进行还原输出；或者
当获取到所述输出指令时，向所述存储服务器获取所述加密后的客户端账户数据，并基于从所述存储服务器处所获取到的所述加密后的客户端账户数据在所述客户端界面对所述客户端账户数据进行还原输出。
在一个可能的实施方式中，获取模块801还用于：
根据在所述存储客户端中的客户端授权操作，输出客户端授权列表；所述客户端授权列表包括M个待授权客户端，M为正整数；
根据针对所述M个待授权客户端的选择操作，将所选择的待授权客户端确定为所述目标客户端。
在一个可能的实施方式中，获取模块801在用于在存储客户端中获取目标客户端的客户端账户数据时，用于：
基于所述存储客户端获取所述目标客户端中已有的历史账户数据，并将所述历史账户数据作为所述客户端账户数据；或者
当在所述存储客户端中检测到针对所述历史账户数据的修改操作时，将对所述历史账户数据进行修改后的账户数据确定为所述客户端账户数据。
在一个可能的实施方式中，获取模块801还用于：
向管理客户端发送目标用户针对所述存储客户端的客户端下载请求；所述客户端下载请求包含所述目标用户的用户身份信息；
获取所述管理客户端发送的所述存储客户端的客户端安装数据包和客户端登录口令；所述客户端安装数据包中封装有所述用户身份信息，所述用户身份信息与所述客户端登录口令具备映射关系；
基于所述客户端安装数据包安装所述存储客户端，基于所述客户端登录口令登录所述存储客户端；
所述在存储客户端中获取目标客户端的客户端账户数据，包括：
在所登录的所述存储客户端中获取所述客户端账户数据。
本申请实施例中，获取模块在存储客户端中获取目标客户端的客户端账户数据，并获取客户端账户数据对应的存储密钥，加密模块基于存储密钥对客户端账户数据进行加密，得到加密后的客户端账户数据，并存储加密后的客户端账户数据，进而提高数据存储的安全性。输出模块当在存储客户端中获取到针对客户端账户数据的输出指令时，基于所存储的加密后的客户端账户数据，对客户端账户数据进行还原，并在存储客户端的客户端界面输出。通过实施上述所提出的装置，可以在获取到已授权的客户端账户数据时，在存储客户端中就利用存储密钥对该数据进行加密存储；通过所加密存储的数据可以更安全对客户端账户数据进行还原输出，从而可以提高数据存储的安全性。
在本申请各个实施例中的各功能模块可以集成在一个模块中，也可以是各个模块单独物理存在，也可以是两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现，本申请不做限定。
请参见图15，图15为本申请实施例提供的一种电子设备的结构示意图。如图15所示，该电子设备900包括：至少一个处理器901、存储器902。可选的，该电子设备还可包括网络接口903。其中，处理器901、存储器902以及网络接口903之间可以交互数据，网络接口903受处理器903的控制用于收发消息，存储器902用于存储计算机程序，该计算机程序包括程序指令，处理器901用于执行存储器902存储的程序指令。其中，处理器901被配置用于调用该程序指令执行上述方法。
其中，存储器902可以包括易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)；存储器902也可以包括非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，固态硬盘(solid-state drive，SSD)等；存储器902还可以包括上述种类的存储器的组合。
其中，处理器901可以是中央处理器(central processing unit，CPU)。在一个实施例中，处理器901还可以是图形处理器(Graphics Processing Unit，GPU)。处理器901也可以是由CPU和GPU的组合。
在一个可能的实施方式中，存储器902用于存储程序指令。处理器901可以调用该程序指令，执行以下步骤：
在存储客户端中获取目标客户端的客户端账户数据，并获取所述客户端账户数据对应的存储密钥，所述目标客户端为用户已授权客户端；
基于所述存储密钥对所述客户端账户数据进行加密，得到加密后的客户端账户数据，并 存储加密后的客户端账户数据；
当输出指令时，基于所存储的所述加密后的客户端账户数据，对所述客户端账户数据进行还原，并在所述存储客户端的客户端界面输出。
在一个可能的实施方式中，处理器901在用于获取所述客户端账户数据对应的存储密钥时，用于：
针对所述客户端账户数据生成加密随机数，并获取基于所述客户端账户数据生成的加密账户密钥；
将所述加密随机数和所述加密账户密钥确定为所述存储密钥；
处理器901在用于基于所述存储密钥对所述客户端账户数据进行加密，得到加密后的客户端账户数据时，用于：
基于所述加密随机数对所述客户端账户数据进行加密，得到账户加密数据；
基于所述加密账户密钥对所述加密随机数进行加密，得到随机数加密数据；
将所述账户加密数据和所述随机数加密数据确定为所述加密后的客户端账户数据。
在一个可能的实施方式中，处理器901在用于当输出指令时，基于所存储的所述加密后的客户端账户数据，对所述客户端账户数据进行还原，并在所述存储客户端的客户端界面输出时，用于：
当获取到所述输出指令时，基于与所述加密账户密钥相对应的解密账户密钥对所述随机数加密数据进行解密，得到所述加密随机数；
基于解密得到的所述加密随机数对所述账户加密数据进行解密，得到所述客户端账户数据；
在所述客户端界面输出解密得到的所述客户端账户数据。
在一个可能的实施方式中，处理器901在用于存储加密后的客户端账户数据时，用于：
在所述存储客户端中存储所述加密后的客户端账户数据，并将所述加密后的客户端账户数据发送给存储服务器，以使所述存储服务器存储所述加密后的客户端账户数据；
处理器901在用于当输出指令时，基于所存储的所述加密后的客户端账户数据，对所述客户端账户数据进行还原，并在所述存储客户端的客户端界面输出时，用于：
当获取到所述输出指令时，基于在所述存储客户端中所存储的所述加密后的客户端账户数据，在所述客户端界面对所述客户端账户数据进行还原输出；或者
当获取到所述输出指令时，向所述存储服务器获取所述加密后的客户端账户数据，并基于从所述存储服务器处所获取到的所述加密后的客户端账户数据在所述客户端界面对所述客户端账户数据进行还原输出。
在一个可能的实施方式中，处理器901还用于：
根据在所述存储客户端中的客户端授权操作，输出客户端授权列表；所述客户端授权列表包括M个待授权客户端，M为正整数；
根据针对所述M个待授权客户端的选择操作，将所选择的待授权客户端确定为所述目标客户端。
在一个可能的实施方式中，处理器901在用于在存储客户端中获取目标客户端的客户端账户数据时，用于：
基于所述存储客户端获取所述目标客户端中已有的历史账户数据，并将所述历史账户数据作为所述客户端账户数据；或者
当在所述存储客户端中检测到针对所述历史账户数据的修改操作时，将对所述历史账户数据进行修改后的账户数据确定为所述客户端账户数据。
在一个可能的实施方式中，处理器901还用于：
向管理客户端发送目标用户针对所述存储客户端的客户端下载请求；所述客户端下载请求包含所述目标用户的用户身份信息；
获取所述管理客户端发送的所述存储客户端的客户端安装数据包和客户端登录口令；所 述客户端安装数据包中封装有所述用户身份信息，所述用户身份信息与所述客户端登录口令具备映射关系；
基于所述客户端安装数据包安装所述存储客户端，基于所述客户端登录口令登录所述存储客户端；
所述在存储客户端中获取目标客户端的客户端账户数据，包括：
在所登录的所述存储客户端中获取所述客户端账户数据。
实现中，上述所描述的数据处理装置800、处理器901、存储器902等可执行上述方法实施例所描述的实现方式，也可执行本申请实施例所描述的实现方式，在此不再赘述。
本申请实施例中还提供一种计算机(可读)存储介质，所述计算机存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令被处理器执行时，使所述处理器可执行上述方法实施例中所执行的部分或全部步骤。可选的，该计算机存储介质可以是易失性的，也可以是非易失性的。所述的计算机可读存储介质可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序等；存储数据区可存储根据区块链节点的使用所创建的数据等。
在本文中提及的“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的程序可存储于计算机存储介质中，该计算机存储介质可以为计算机可读存储介质，该程序在执行时，可包括如上述各方法的实施例的流程。其中，所述的存储介质可为磁碟、光盘、只读存储记忆体(Read-Only Memory，ROM)或随机存储记忆体(Random Access Memory，RAM)等。
以上所揭露的仅为本申请的部分实施例而已，当然不能以此来限定本申请之权利范围，本领域普通技术人员可以理解实现上述实施例的全部或部分流程，并依本申请权利要求所作的等同变化，仍属于本申请所涵盖的范围。

Claims (15)

  1. 一种数据处理方法，其特征在于，由电子设备执行，所述方法包括：
    在存储客户端中获取目标客户端的客户端账户数据，并获取所述客户端账户数据对应的存储密钥，所述目标客户端为用户已授权客户端；
    基于所述存储密钥对所述客户端账户数据进行加密，得到加密后的客户端账户数据，并存储所述加密后的客户端账户数据；
    响应于输出指令，基于所存储的所述加密后的客户端账户数据，对所述客户端账户数据进行还原，并在所述存储客户端的客户端界面输出，所述输出指令是在所述存储客户端中获取到的针对所述客户端账户数据的输出指令。
  2. 根据权利要求1所述的方法，其特征在于，所述获取所述客户端账户数据对应的存储密钥，包括：
    针对所述客户端账户数据生成加密随机数，并获取基于所述客户端账户数据生成的加密账户密钥；
    将所述加密随机数和所述加密账户密钥确定为所述存储密钥。
  3. 根据权利要求2所述的方法，其特征在于，所述基于所述存储密钥对所述客户端账户数据进行加密，得到加密后的客户端账户数据，包括：
    基于所述加密随机数对所述客户端账户数据进行加密，得到账户加密数据；
    基于所述加密账户密钥对所述加密随机数进行加密，得到随机数加密数据；
    将所述账户加密数据和所述随机数加密数据确定为所述加密后的客户端账户数据。
  4. 根据权利要求3所述的方法，其特征在于，所述响应于输出指令，基于所存储的所述加密后的客户端账户数据，对所述客户端账户数据进行还原，并在所述存储客户端的客户端界面输出，包括：
    响应于所述输出指令，基于与所述加密账户密钥相对应的解密账户密钥对所述随机数加密数据进行解密，得到所述加密随机数；
    基于解密得到的所述加密随机数对所述账户加密数据进行解密，得到所述客户端账户数据；
    在所述客户端界面输出解密得到的所述客户端账户数据。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述存储所述加密后的客户端账户数据，包括：
    在所述存储客户端中存储所述加密后的客户端账户数据，并将所述加密后的客户端账户数据发送给存储服务器，以使所述存储服务器存储所述加密后的客户端账户数据。
  6. 根据权利要求5所述的方法，其特征在于，所述响应于输出指令，基于所存储的所述加密后的客户端账户数据，对所述客户端账户数据进行还原，并在所述存储客户端的客户端界面输出，包括：
    响应于所述输出指令，基于在所述存储客户端中所存储的所述加密后的客户端账户数据，在所述客户端界面对所述客户端账户数据进行还原输出。
  7. 根据权利要求5所述的方法，其特征在于，所述响应于输出指令，基于所存储的所述加密后的客户端账户数据，对所述客户端账户数据进行还原，并在所述存储客户端的客户端界面输出，包括：
    响应于所述输出指令，向所述存储服务器获取所述加密后的客户端账户数据，并基于从所述存储服务器处所获取到的所述加密后的客户端账户数据，在所述客户端界面对所述客户端账户数据进行还原输出。
  8. 根据权利要求1至7任一项所述的方法，其特征在于，所述方法还包括：
    根据在所述存储客户端中的客户端授权操作，输出客户端授权列表；所述客户端授权列表包括M个待授权客户端，M为正整数；
    根据针对所述M个待授权客户端的选择操作，将所选择的待授权客户端确定为所述目标客户端。
  9. 根据权利要求1至8任一项所述的方法，其特征在于，所述在存储客户端中获取目标客户端的客户端账户数据，包括：
    基于所述存储客户端获取所述目标客户端中已有的历史账户数据，并将所述历史账户数据作为所述客户端账户数据。
  10. 根据权利要求1至8任一项所述的方法，其特征在于，所述在存储客户端中获取目标客户端的客户端账户数据，包括：
    响应于在所述存储客户端中检测到针对历史账户数据的修改操作，将对所述历史账户数据进行修改后的账户数据确定为所述客户端账户数据。
  11. 根据权利要求1至10任一项所述的方法，其特征在于，所述方法还包括：
    向管理客户端发送目标用户针对所述存储客户端的客户端下载请求；所述客户端下载请求包含所述目标用户的用户身份信息；
    获取所述管理客户端发送的所述存储客户端的客户端安装数据包和客户端登录口令；所述客户端安装数据包中封装有所述用户身份信息，所述用户身份信息与所述客户端登录口令具备映射关系；
    基于所述客户端安装数据包安装所述存储客户端，基于所述客户端登录口令登录所述存储客户端。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    在所述基于所述客户端登录口令登录所述存储客户端之前，检测所安装的所述存储客户端中封装的用户身份信息与所述客户端登录口令是否具备映射关系；
    响应于所安装的所述存储客户端中封装的用户身份信息与所述客户端登录口令具备映射关系，基于所述客户端登录口令登录所述存储客户端。
  13. 一种数据处理装置，其特征在于，所述装置包括：
    获取模块，用于在存储客户端中获取目标客户端的客户端账户数据，并获取所述客户端账户数据对应的存储密钥，所述目标客户端为用户已授权客户端；
    加密模块，用于基于所述存储密钥对所述客户端账户数据进行加密，得到加密后的客户端账户数据，并存储所述加密后的客户端账户数据；
    输出模块，用于响应于输出指令，基于所存储的所述加密后的客户端账户数据，对所述客户端账户数据进行还原，并在所述存储客户端的客户端界面输出，所述输出指令是在所述存储客户端中获取到的针对所述客户端账户数据的输出指令。
  14. 一种电子设备，其特征在于，包括处理器和存储器，其中，所述存储器用于存储计算机程序，所述计算机程序包括程序指令，所述处理器被配置用于调用所述程序指令，执行如 权利要求1至12任一项所述的方法。
  15. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时使所述处理器执行如权利要求1至12任一项所述的方法。
PCT/CN2021/106606 2021-06-03 2021-07-15 数据处理方法、装置、电子设备及介质 WO2022252356A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/132,126 US20230244797A1 (en) 2021-06-03 2023-04-07 Data processing method and apparatus, electronic device, and medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110621841.4A CN113360924A (zh) 2021-06-03 2021-06-03 数据处理方法、装置、电子设备及介质
CN202110621841.4 2021-06-03

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/132,126 Continuation US20230244797A1 (en) 2021-06-03 2023-04-07 Data processing method and apparatus, electronic device, and medium

Publications (1)

Publication Number Publication Date
WO2022252356A1 true WO2022252356A1 (zh) 2022-12-08

Family

ID=77531979

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/106606 WO2022252356A1 (zh) 2021-06-03 2021-07-15 数据处理方法、装置、电子设备及介质

Country Status (3)

Country Link
US (1) US20230244797A1 (zh)
CN (1) CN113360924A (zh)
WO (1) WO2022252356A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11848930B1 (en) * 2021-06-15 2023-12-19 Whatsapp Llc Methods, mediums, and systems for verifying devices in an encrypted messaging system

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101771699A (zh) * 2010-01-06 2010-07-07 华南理工大学 一种提高SaaS应用安全性的方法及系统
CN104581214A (zh) * 2015-01-28 2015-04-29 三星电子（中国）研发中心 基于ARM TrustZone系统的多媒体内容保护方法和装置
US10410015B2 (en) * 2017-05-18 2019-09-10 Linden Research, Inc. Systems and methods to secure personally identifiable information
CN111193695A (zh) * 2019-07-26 2020-05-22 腾讯科技（深圳）有限公司 一种第三方账号登录的加密方法、装置及存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101771699A (zh) * 2010-01-06 2010-07-07 华南理工大学 一种提高SaaS应用安全性的方法及系统
CN104581214A (zh) * 2015-01-28 2015-04-29 三星电子（中国）研发中心 基于ARM TrustZone系统的多媒体内容保护方法和装置
US10410015B2 (en) * 2017-05-18 2019-09-10 Linden Research, Inc. Systems and methods to secure personally identifiable information
CN111193695A (zh) * 2019-07-26 2020-05-22 腾讯科技（深圳）有限公司 一种第三方账号登录的加密方法、装置及存储介质

Also Published As

Publication number Publication date
CN113360924A (zh) 2021-09-07
US20230244797A1 (en) 2023-08-03

Similar Documents

Publication Publication Date Title
US11431495B2 (en) Encrypted file storage
US20200329041A1 (en) Cross-region requests
CN108076057B (zh) 一种基于区块链的数据保全系统及方法
US10462114B2 (en) System and associated software for providing advanced data protections in a defense-in-depth system by integrating multi-factor authentication with cryptographic offloading
CA2864347C (en) Cloud-based key management
EP3585032B1 (en) Data security service
US9367697B1 (en) Data security with a security module
US9852300B2 (en) Secure audit logging
TWI701929B (zh) 密碼運算、創建工作密鑰的方法、密碼服務平台及設備
EP3437322B1 (en) Providing low risk exceptional access
US10211977B1 (en) Secure management of information using a security module
US11831753B2 (en) Secure distributed key management system
CA2911639A1 (en) Instant data security in un-trusted environments
US11626998B2 (en) Validated payload execution
CN112953930A (zh) 一种云存储数据的处理方法、装置及计算机系统
US10630722B2 (en) System and method for sharing information in a private ecosystem
CN110611657A (zh) 一种基于区块链的文件流处理的方法、装置及系统
KR101648364B1 (ko) 대칭키 암호화와 비대칭키 이중 암호화를 복합적으로 적용한 암/복호화 속도개선 방법
US10187213B2 (en) Off device storage of cryptographic key material
CN114041134A (zh) 用于基于区块链的安全存储的系统和方法
CN111538977A (zh) 云api密钥的管理、云平台的访问方法、装置及服务器
CN113039542A (zh) 云计算网络中的安全计数
US11258601B1 (en) Systems and methods for distributed digital rights management with decentralized key management
US20230244797A1 (en) Data processing method and apparatus, electronic device, and medium
CN117240625A (zh) 一种涉及防篡改的数据处理方法、装置及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21943713

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE