WO2023051337A1

WO2023051337A1 - Data processing method and apparatus, and device and storage medium

Info

Publication number: WO2023051337A1
Application number: PCT/CN2022/120112
Authority: WO
Inventors: 李宗波; 张卓韬; 杨永帮; 邬秋元; 陈晓丹; 张涛; 宋超
Original assignee: 深圳前海微众银行股份有限公司
Priority date: 2021-09-30
Filing date: 2022-09-21
Publication date: 2023-04-06
Also published as: CN114117406A

Abstract

A data processing method and apparatus, and a device and a storage medium, wherein the method is applied to a first device. The method comprises: decrypting user identifier data on the basis of a received first user password, so as to obtain a predicted user identifier; obtaining an actual user identifier associated with the first user password; if the predicted user identifier is the same as the actual user identifier, determining that the first user password is successfully checked, and decrypting first encrypted data on the basis of the first user password, so as to obtain a first user password factor, wherein the first encrypted data comprises the encrypted first user password factor; generating a first password at least on the basis of the first user password factor; and encrypting or decrypting a target object by means of the first password. Not only can a user participate in an encryption or decryption process, but a relatively high level of security can also be provided.

Description

Data processing method, device, equipment and storage medium

Cross References to Related Applications

This application is based on a Chinese patent application with application number 202111163126.7 and a filing date of September 30, 2021, and claims the priority of this Chinese patent application. The entire content of this Chinese patent application is hereby incorporated into this application by reference.

technical field

This application relates to the technical field of data processing, involving but not limited to data processing methods, devices, equipment and storage media.

Background technique

With the continuous development of storage technology, how to improve storage security is particularly important. At present, the security of storage is mainly improved through encrypted storage.

In the encryption storage process, including encryption and decryption process. For the encryption and decryption process, the first scheme is to encrypt and decrypt the text through the built-in random password of the device; the second scheme is to encrypt and decrypt the text through the user password. For the first solution, on the one hand, the user cannot participate in the encryption and decryption process; on the other hand, the organization that provides the encryption and decryption has the ability to decrypt the text, and the security is low. For the second scheme, although the user can participate in the encryption and decryption process, the security of encrypting and decrypting the text through the user password is relatively low.

Contents of the invention

The present application provides a data processing method, device, equipment, and storage medium. The solution can not only enable users to participate in the encryption or decryption process, but also has high security.

The technical scheme of the present application is realized like this:

The present application provides a data processing method, the method is applied to a first device, and the method includes:

Decrypting the user identification data based on the received first user password to obtain a predicted user identification;

obtaining an actual user identification associated with said first user password;

If the predicted user ID is the same as the actual user ID, it is determined that the verification of the first user password is successful, and the first encrypted data is decrypted based on the first user password to obtain a first user password factor, the first user password The encrypted data includes an encrypted first user password factor;

generating a first password based at least on said first user password factor;

The target object is encrypted or decrypted by the first password.

The present application provides a data processing device, the device is deployed in the first device; the device includes:

The prediction unit is configured to decrypt the user identification data based on the received first user password to obtain a predicted user identification;

An obtaining unit configured to obtain an actual user identifier associated with the first user password;

The decryption unit is configured to determine that the verification of the first user password is successful if the predicted user ID is the same as the actual user ID, decrypt the first encrypted data based on the first user password, and obtain the first user password factor , the first encrypted data includes an encrypted first user password factor;

a generating unit configured to generate a first password based at least on the first user password factor;

A processing unit configured to encrypt or decrypt the target object by using the first password.

The present application also provides an electronic device, including: a memory and a processor, the memory stores a computer program that can run on the processor, and the processor implements the above data processing method when executing the program.

The present application also provides a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above data processing method is realized.

The data processing method, device, device, and storage medium provided in this application include: decrypting the user identification data based on the received first user password to obtain a predicted user identification; obtaining the actual user identification associated with the first user password; if If the predicted user ID is the same as the actual user ID, it is determined that the verification of the first user password is successful, and the first encrypted data is decrypted based on the first user password to obtain a first user password factor, and the first encrypted The data includes an encrypted first user password factor; a first password is generated based at least on the first user password factor; and a target object is encrypted or decrypted by the first password. In this way, first, the first password is obtained based on the user password, which can ensure that the user participates in the encryption or decryption process. Second, the scheme does not encrypt or decrypt the target object through the first user password, but based on the first user password. The user password factor obtained by the password determines the first password, and the target object is encrypted or decrypted by the first password, which increases the difficulty of cracking the first password and further improves security; The user ID is verified against the actual user ID; it is not directly based on the password. Therefore, this solution does not need to store the user password, which reduces the channels for user password leakage and further improves security.

Description of drawings

FIG. 1 is an optional structural schematic diagram of a data processing system provided in an embodiment of the present application;

FIG. 2 is an optional schematic structural diagram of a data processing system provided in an embodiment of the present application;

Fig. 3 is an optional schematic flow chart of the data processing method provided by the embodiment of the present application

FIG. 4 is an optional schematic flowchart of a data processing method provided in an embodiment of the present application;

FIG. 5 is a schematic flowchart of an optional data processing method provided in the embodiment of the present application;

FIG. 6 is a schematic flowchart of an optional data processing method provided in the embodiment of the present application;

FIG. 7 is a schematic flowchart of an optional data processing method provided in the embodiment of the present application;

FIG. 8 is an optional structural schematic diagram of a data processing device provided in an embodiment of the present application;

FIG. 9 is a schematic structural diagram of an optional electronic device provided in an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the application clearer, the specific technical solutions of the application will be further described in detail below in conjunction with the drawings in the embodiments of the application. The following examples are used to illustrate the present application, but not to limit the scope of the present application.

In the following description, references to "some embodiments" describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or a different subset of all possible embodiments, and Can be combined with each other without conflict.

In the following description, the term "first\second\third" is used as an example to distinguish different objects, and does not represent a specific order for the objects, and does not have a limitation on the sequence. It can be understood that "first\second\third" can be interchanged in a specific order or sequential order if allowed, so that the embodiments of the application described here can be used in a manner other than what is illustrated or described here implemented sequentially.

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the technical field to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application, and are not intended to limit the present application.

For ease of understanding, some technical terms in this application are explained.

An object may refer to various types of data, for example, text data, video data, audio data, or picture data.

The target object refers to the object to be encrypted or decrypted in this application.

Embodiments of the present application may provide a data processing method, device, device, and storage medium. In practical applications, the data processing method can be implemented by a data processing device, and each functional entity in the data processing device can be implemented by hardware resources of an electronic device (such as a first device), such as computing resources such as a processor, and communication resources (such as for supporting the implementation of Communication in various ways such as optical cable and cellular) is realized collaboratively.

The data processing method provided in the embodiment of the present application is applied to a data processing system, and the data processing system includes a first device. The first device decrypts the user identification data based on the received first user password to obtain a predicted user identification; obtain an actual user identification associated with the first user password; if the predicted user identification is the same as the actual user identification, determine The verification of the first user password is successful, and the first encrypted data is decrypted based on the first user password to obtain a first user password factor, and the first encrypted data includes the encrypted first user password factor; at least based on the The first user password factor generates a first password; the target object is encrypted or decrypted by the first password.

In an example, the data processing system may further include a second device and/or a third device. The second device can communicate with the first device, for example, the second device can back up the first user password factor; the third device can communicate with the first device, for example, the third device can receive the first user password and send it to the first device The received first user password is forwarded.

As an example, the structure of the data processing system 10 may be as shown in FIG. 1 , including: a first device 101 and a third device 102; the first device 101 and the third device 102 may communicate.

The first device 101 may communicate directly with the third device 102; or, the first device 101 may also communicate with the third device 102 through an application server. For example, data processing system 10 may also include application server 103 . The third device 102 runs the target service (for example, a managed storage service), the third device 102 communicates with the server 103 through an application programming interface (Application Programming Interface, API) interface provided by the target service, and the server 103 communicates with the first device 101.

The first device 101 is configured to receive various data sent by the third device 102, and process and store the received data. In the embodiment of the present application, the first device 101 may be used to receive the object sent by the third device 102, and store the object after encryption; or may also be used to decrypt the encrypted object and then send it to the third device 102. The first device 101 may be a fixed storage device such as a memory, a hard disk, or a floppy disk, or the first device 101 may also be a removable storage device such as a mobile hard disk, or the first device 101 may also be a cloud storage device.

The third device 102 is configured to send objects to the first device 101, or to receive objects sent by the first device. The third device 102 may include a mobile terminal device (such as a mobile phone, a tablet computer, etc.), or a non-mobile terminal device (such as a desktop computer, etc.).

As another example, the structure of the data processing system 10 may be as shown in FIG. 2 , including: a first device 101 , a third device 102 and a second device 104 . The second device 104 can communicate with the first device 101 and the third device 102 .

The second device 104, which may also be referred to as a third-party trusted certificate service agency device, is used to receive and store the data sent by the first device 101 or the third device 102 (for example, the encrypted second user password factor may be stored), and store the data After processing, it is sent to the first device 101 or the third device 102.

Below, with reference to the schematic diagram of the data processing system shown in FIG. 1 or FIG. 2 , various embodiments of the data processing method, device, device, and storage medium provided by the embodiments of the present application will be described.

In a first aspect, the embodiment of the present application provides a data processing method, which is applied to a data processing device; wherein, the data processing device can be deployed in the first device 101 in FIG. 1 or FIG. 2 . Next, the data processing process provided by the embodiment of the present application will be described.

Fig. 3 shows a schematic flowchart of an optional data processing method, the data processing method provided in the embodiment of the present application is used to encrypt or decrypt each object; wherein, the processing process for each object is similar, now Take the target object as an example to describe the process in detail. The data processing method may include but not limited to S301 to S305 shown in FIG. 3 .

S301. The first device decrypts user identification data based on the received first user password to obtain a predicted user identification.

Specifically, the first device receives the first user password, and decrypts the user identification data based on the first user password to obtain a predicted user identification.

For the first device to receive the first user password, in a possible implementation manner, the first device receives a first operation of the user, and receives the first user password input by the user based on the first operation.

In another possible implementation manner, the third device receives the user's first operation, and receives the first user password input by the user based on the first operation, and the third device sends the received first user password to the first device, The first device receives the first user password sent by the third device.

For the first device to decrypt the user identification data based on the first user password to obtain the predicted user identification, it may be implemented as follows: the first device invokes the first decryption algorithm, and decrypts the user identification through the first user password or the system password obtained based on the first user password data to get the predicted user ID.

Wherein, the system password is a system-specific password corresponding to the first user password.

Optionally, before decrypting to obtain the predicted user, the first device may also obtain user identification data based on the first user.

The embodiment of the present application does not uniquely limit the timing of obtaining the user identification data, which can be configured according to timing requirements.

The first device creates the user identification (Identity document, ID) of the first user for the first user, and invokes the first encryption algorithm to encrypt the first user's ID through the first user password or the system password obtained based on the first user password. User ID, get the user ID data.

The user ID of the first user is used to uniquely point to the first user. The embodiment of the present application does not limit the expression form of the first user ID, which can be configured according to actual needs. For example, the first user identifier may be a combination of a group of numbers, or a combination of letters, or a combination of numbers and letters, and so on.

The embodiment of the present application does not specifically limit the algorithm for creating the user identifier of the first user. For example, the algorithm for creating the user ID of the first user may include a random algorithm or a hash algorithm and the like.

It should be noted that the encryption password of the first encryption algorithm and the decryption password of the first decryption algorithm should be consistent. For example, when the encryption password of the first decryption algorithm is the first user password, the corresponding encryption password of the first encryption algorithm is the first user password; when the decryption password of the first decryption algorithm is the system password, the first decryption algorithm The encryption password of the algorithm is the encryption password.

S302. The first device obtains an actual user identifier associated with the first user password.

Based on the input first user password, the first device uses the same method as the first device obtains the user identification data based on the first user to regenerate the user identification as the actual user identification associated with the first user password.

S303. If the predicted user ID is the same as the actual user ID, determine that the verification of the first user password is successful, and the first device decrypts the first encrypted data based on the first user password to obtain a first user password factor .

Wherein, the first encrypted data includes the encrypted first user password factor.

The first encrypted data can be the data after the first user password factor is encrypted, or the first encrypted data can also be after the first user password factor is packaged into a file (such as a folder or a compressed file, etc.), and the file Encrypted data.

The first user password factor is used to obtain the password for encrypting or decrypting the target object. The embodiment of the present application does not limit the expression form of the first user password factor, which can be configured according to actual needs.

For example, the first user password factor may be a group of random numbers, or the first user password factor may be a combination of a group of random numbers and letters, and so on.

S303 may be implemented as: the first device judges whether the predicted user ID is the same as the actual user ID, and if the predicted user ID is the same as the actual user ID, then it is determined that the first user password verification is successful, and the first device invokes the second decryption algorithm based on the first A decryption password is obtained from a user password, and the first encrypted data is decrypted by the decryption password to obtain the first user password factor; if the predicted user ID is not the same as the actual user ID, it is determined that the verification of the first user password fails, and the process ends.

The embodiment of the present application does not uniquely limit the type of the second decryption algorithm, which can be configured according to actual requirements.

In a possible implementation manner, the second decryption algorithm may include: a wireless local area network standard packet data algorithm (SM4 decryption algorithm). For example, the second decryption algorithm may include the SM4DNCRYPT(D, P) algorithm, where D represents a decryption object, and P represents a decryption password. It can be understood that D includes the first encrypted data; P includes the first user password or a system password generated based on the first user password.

In another possible implementation manner, the second decryption algorithm may include: an asymmetric encryption algorithm (SM2 algorithm).

Optionally, before performing S303, the data processing method provided in the embodiment of the present application may further include a registration process.

The registration process for the first user may include: the first device receiving the first user password, creating the first user for the first user password, creating a first user password factor for the first user, and encrypting the first user password based on the first user password factor to obtain the first encrypted data.

The embodiment of the present application does not uniquely limit the algorithm for creating the first user password factor. For example, the algorithm for creating the first user password factor may include a random algorithm, or a hash algorithm, and the like.

The embodiment of the present application also makes no unique limitation on the second encryption algorithm for encrypting the first user password factor.

In a possible implementation manner, the second encryption algorithm may include: a wireless local area network standard packet data algorithm (SM4 encryption algorithm). For example, the second encryption algorithm may include the SM4ENCRYPT(S,P) algorithm.

In another possible implementation manner, the second encryption algorithm may include: an Advanced Encryption Standard (Advanced Encryption Standard, AES) algorithm.

It should be noted that the second encryption algorithm should correspond to the second decryption algorithm. For example, when the second decryption algorithm is the SM4DECRYPT(D, P) algorithm, the corresponding second encryption algorithm in the registration process is the SM4ENCRYPT(S, P) algorithm, where S represents the encryption object and P represents the encryption password. It can be understood that S includes the first user password factor; P includes the first user password or a system password generated based on the first user password.

It should be noted that the encryption password of the second encryption algorithm should be consistent with the decryption password of the second decryption algorithm.

For example, when the decryption password of the second decryption algorithm is the first user password, correspondingly, the encryption password of the second encryption algorithm is also the first user password; when the decryption password of the second decryption algorithm is the system password, Correspondingly, the encryption password of the second encryption algorithm is also the system password.

It should be noted that during the registration process, the received first user password is not stored, in other words, the first user password is destroyed immediately after use. In this way, the probability of leakage of the first user's password can be reduced and the security can be improved.

S304. The first device generates a first password based at least on the first user password factor.

In a possible implementation manner, the first device uses a first password generation algorithm to generate the first password according to a first user password factor.

In another possible implementation manner, the first device uses a first password generation algorithm to generate the first password according to the first user password factor and the object password factor for the target object.

The embodiment of the present application does not limit the algorithm type of the first password generation algorithm, which can be configured according to actual requirements.

In an example, the first password generation algorithm may include: a hash algorithm, or a message digest (Message Digest algorithm 5, MD5) algorithm, a secure hash (Secure Hash Algorithm, SHA) algorithm.

In another example, the first password generation algorithm may include: a hash algorithm and a random generation password algorithm (such as GENPSW algorithm), or an MD5 algorithm and a random generation password algorithm, or an SHA algorithm and a random generation password algorithm.

S305. The first device encrypts or decrypts the target object by using the first password.

The target object may include a target object to be encrypted and a target object to be decrypted, wherein the target object to be encrypted may also be called a first target object, and the target object to be decrypted may also be called a second target object.

In a possible implementation manner, S305 may be implemented as: the first device invokes a third encryption algorithm, and encrypts the first target object by using the first password.

In another possible implementation manner, S305 may be implemented as: the first device invokes a third decryption algorithm, and decrypts the second target object by using the first password.

The embodiment of this application does not limit the algorithm types of the third encryption algorithm and the third decryption algorithm, which can be configured according to actual needs. For example, the third encryption algorithm may include the SM4 encryption algorithm, or the SM2 encryption algorithm; the third decryption algorithm may include the SM4 decryption algorithm, or the SM2 decryption algorithm.

It should be noted that the third decryption algorithm should correspond to the second encryption algorithm. For example, when the third encryption algorithm is the SM4ENCRYPT algorithm, the third decryption algorithm is SM4DECRYPT.

The data processing solution provided by the embodiment of the present application includes: decrypting the user identification data based on the received first user password to obtain a predicted user identification; obtaining the actual user identification associated with the first user password; if the predicted user identification is consistent with the If the actual user IDs are the same, it is determined that the first user password verification is successful, and the first encrypted data is decrypted based on the first user password to obtain the first user password factor. The first encrypted data includes the encrypted first A user password factor; generating a first password based at least on the first user password factor; encrypting or decrypting a target object by using the first password. In this way, first, the first password is obtained based on the user password, which can ensure that the user participates in the encryption or decryption process. Second, the scheme does not encrypt or decrypt the target object through the first user password, but based on the first user password. The user password factor obtained by the password determines the first password, and the target object is encrypted or decrypted by the first password, which increases the difficulty of cracking the first password and further improves security; The user ID is verified against the actual user ID; it is not directly based on the password. Therefore, this solution does not need to store the user password, which reduces the channels for user password leakage and further improves security.

It should be noted that the data processing process provided by the embodiment of the present application may not store the first user password, that is, each stage of data processing (encryption or decryption, etc.) requires the user to input the first user password, and the first device The first user password is received, and operations such as encryption or decryption are performed based on the first user password. In this way, the possibility of the first user password being stolen or the device storing the first user password illegally decrypting the file during the process of storing the first user password can be avoided, thereby further improving data security.

Next, in S303, the process of the first device decrypting the first encrypted data based on the first user password to obtain the first user password factor will be described. This process includes but is not limited to Embodiment A or Embodiment B below.

Embodiment A, decrypting the first encrypted data through the first user password;

Embodiment B, the first encrypted data is decrypted using the system password generated by the first user password.

Embodiment A may include: the first device invokes the second decryption algorithm, decrypts the first encrypted data through the first user password, and obtains the first user password factor.

For example, the first user password factor S1 can be obtained by the following formula (1).

S1＝SM4DECRYPT(D1, P0) Formula (1);

Wherein, S1 represents the first user password factor, D1 represents the first encrypted data, SM4ENCRYPT represents the SM4 decryption algorithm (the first decryption algorithm), and P0 represents the first user password.

Embodiment B may include but not limited to the following S3021 and S3022.

S3021. The first device generates a system password corresponding to the first user password based on the first user password.

The first device uses the second password generation algorithm to generate a system password corresponding to the first user password according to the first user password.

The implementation of this application does not limit the algorithm type of the second password generation algorithm, which can be configured according to actual needs. Wherein, the second password generation algorithm may be the same as the first password generation algorithm, or may be different from the first password generation algorithm.

For example, the system password P1 can be obtained by the following formula (2).

P1＝GEMPSW(SM3(SALT0+P0)) Formula (2);

Among them, P1 represents the system password, GEMPSW represents the random generation password algorithm, SM3 represents the salted hash algorithm, SALT0 represents the salt value, P0 represents the first user password, and GEMPSW and SM3 constitute the second password generation algorithm.

S3022. The first device decrypts the first encrypted data by using the system password to obtain the first user password factor.

The first device invokes the second decryption algorithm, and decrypts the first encrypted data through the system password to obtain the first user password factor.

For example, the first user password factor can be obtained by the following formula (3).

S1＝SM4DECRYPT(D1, P1) Formula (3);

Wherein, S1 represents the first user password factor, SM4ENCRYPT represents the SM4 decryption algorithm, D1 represents the first encrypted data, and P1 represents the system password.

Optionally, the process for the first device to obtain the first encrypted data may include but not limited to the following implementation manner A1 or implementation manner B1.

Embodiment A1 corresponds to Embodiment A, and the first encrypted data is obtained by encrypting the first user password;

Embodiment B1 corresponds to embodiment B, and the first encrypted data is obtained by encrypting the system password generated by the first user password.

Embodiment A1 may include: the first device invokes the second encryption algorithm, encrypts the first user password factor through the first user password, and obtains the first encrypted data.

For example, the first encrypted data can be obtained by the following formula (4).

D1＝SM4ENCRYPT(S1, P0) Formula (4);

Wherein, D1 represents the first encrypted data, SM4ENCRYPT represents the SM4 encryption algorithm (second encryption algorithm), S1 represents the first user password factor, and P0 represents the first user password.

Embodiment B1 may include: the first device uses the second password generation algorithm to generate a system password corresponding to the first user password according to the first user password; then the first device invokes the second encryption algorithm to encrypt the first user password through the system password password factor to obtain the first encrypted data.

For example, the system password P1 can be obtained by the following formula (2), and the first encrypted data D1 can be obtained by the following formula (5).

P1＝GEMPSW(SM3(SALT0+P0)) Formula (2)

D1＝SM4ENCRYPT(S1, P1) formula (5);

Wherein, D1 represents the first encrypted data, SM4ENCRYPT represents the SM4 encryption algorithm, S1 represents the first user password factor, and P1 represents the system password corresponding to the first user password.

In the scheme of embodiment B1, the first user password factor is not encrypted by the first user password, but the first user password factor is encrypted by the system password generated by the first user password, which realizes multi-layer encryption and is more secure. A Compared with the implementation mode B, the implementation mode B has higher security, and the implementation of the implementation mode A is simpler.

Next, a process of generating a first password by the first device at least based on the first user password factor at 304 will be described, and the process may include but not limited to the following implementation manner A2 or implementation manner B2.

Embodiment A2, generating the first password based on the first user password factor;

Embodiment B2, generating the first password based on the first user password factor and the object password factor for the target object.

Implementation manner A2 may include: the first device generates the first password according to the first user password factor by using a first password generation algorithm.

Exemplarily, the first password generation algorithm may include a hash algorithm and a random password generation algorithm. Correspondingly, Embodiment A2 may be implemented as follows: After the first device obtains a hash value through a hash algorithm for the first user password factor, it uses a random password generation algorithm to truncate the first 128 bits of the hash value as the first password.

For example, the first password P3 can be obtained by formula (6).

P3＝GENPSW(SM3(S1)) Formula (6);

Among them, P3 represents the first password, GENPSW represents the random password generation algorithm, SM3 represents the hash algorithm, S1 represents the first user password factor, and SM3(S1) represents the first user password factor through the hash algorithm to obtain the hash value.

For implementation mode B2, the data processing method provided by the embodiment of this application may further include S306 as shown in FIG. 4 .

S306. The first device obtains an object encryption factor for the target object.

The object encryption factor is an object-specific encryption factor, or an object-level encryption factor.

For ease of description, the object encryption factor for the target object is referred to as the object encryption factor for short below.

Correspondingly, implementation manner B2 may include: the first device generates the first password according to the first user password factor and the object password factor by using the first password generation algorithm.

Exemplarily, the first password generation algorithm may include a salted hash algorithm and a random password generation algorithm.

For example, the first device may combine the first user password factor and the object password factor to obtain a hash value through a salted hash algorithm, and use a random password generation algorithm to truncate the first 128 bits of the hash value as the first password.

For example, the first password P3 can also be obtained through formula (7).

P3＝GENPSW(SM3(S1+S2+SALT0)) Formula (7);

Among them, P3 represents the first password, GENPSW represents the random password generation algorithm, SM3 represents the salted hash algorithm, S1 represents the first user password factor, S2 represents the object password factor, SALT0 represents the salt value, SM3(S1+S2+SALT0) Indicates that the first user password factor and the object password factor are combined to obtain a hash value through a salted hash algorithm.

Next, the realization of S306 that the first device obtains the object encryption factor for the target object will be described in detail. This process may include but not limited to the following implementation mode A3 or implementation mode B3.

Embodiment A3. For the encryption process, the first device creates an object encryption factor for the target object.

Embodiment B3. For the decryption process, the first device decrypts the second encrypted data to obtain the object encryption factor.

Implementation manner A3 may include: the first device creates an object encryption factor for the target object as the object encryption factor for the target object.

The embodiment of the present application does not uniquely limit the algorithm for creating an object encryption factor. For example, an algorithm for creating an object password factor may include a random algorithm, or a hash algorithm, and the like.

The algorithm for creating the object password factor can be the same as the algorithm for creating the first user password factor, or it can be different from the algorithm for creating the first user password factor.

Optionally, after the object encryption factor is created, the first device may encrypt and store the object encryption factor.

The first device generates a second password for the target object, and the first device encrypts a password factor of the object based on the second password to obtain second encrypted data and save the second encrypted data.

Encrypting the object password factor by the first device based on the second password may include: the first device calls the fourth encryption algorithm, and encrypts the object password factor by the second password; or, the first device generates a third password based on the second password, and uses the third password to encrypt the object password factor; The cryptographic factor of the cryptographic object.

Implementation manner B3 may include: the first device decrypts the second encrypted data based on the second password to obtain the object password factor.

In a possible implementation manner, when the encryption password for encrypting the target password factor is the second password, the first device invokes the fourth decryption algorithm to decrypt the second encrypted data by using the second password to obtain the target password factor.

In another possible implementation manner, when the encryption password of the encryption object password factor is the third password generated based on the second password, the first device invokes the fourth decryption algorithm to decrypt the second encrypted data through the third password to obtain the object password factor.

Next, the process of generating the first password based on the first user password factor and the object password factor for the target object in Embodiment B2 will be described, which may specifically include but not limited to S3031 to S3033 shown in FIG. 5 .

S3031. The first device assembles the sum of the first user factor and the object password factor into a password string.

S3032. The first device performs salted hash calculation on the password string to obtain a password hash value.

Wherein, the specific salt value in the salted hash algorithm can be controlled according to actual needs, which is not specifically limited in this embodiment of the present application.

S3033. The first device truncates the first W digits of the hash value of the password to generate the first password.

The embodiment of the present application does not limit the specific value of W, which may be configured according to actual requirements. W may be 128 in one example.

The first device truncates the first W bits of the hash value of the password through the GEMPSW algorithm to generate the first password.

The data processing method provided in the embodiment of the present application can also modify the user password of the first user. Now, the modification process of the user password will be described by taking the modification of the first user password to the second user password as an example.

This process may include but not limited to S307 to S309 shown in FIG. 6 .

S307. The first device acquires the second user password factor when receiving the second user password.

The contents of the first user password factor and the second user password factor are the same.

S308. The first device encrypts the second user password factor based on the received second user password to obtain third encrypted data.

The implementation of S308 can refer to the specific description of obtaining the first encrypted data in the registration process, and details will not be repeated here.

S309. The first device updates the first encrypted data based on the third encrypted data.

The first device updates the first encrypted data to the third encrypted data.

In this way, after the user password is changed from the first user password to the second user password, only the third encrypted data is generated according to the first user password, and then the first encrypted data is updated to the third encrypted data, and the password modification can be completed After the modification process of the file; compared with the prior art, because the prior art needs to decrypt the source encrypted file after modifying the user password, and then use the modified user password to encrypt to complete the update of the file; therefore, the present application The implementation of the solution is simple and convenient, especially for the scenario of a large amount of storage, the implementation is more convenient.

Further, before performing S307, a one-time password (One Time Password, OTP) verification may be performed first.

For example, during the registration process, the first device also receives and stores the first mobile phone number for the first user.

The first device performs OTP verification based on the first mobile phone number, and if the verification is successful, execute S307, and if the verification fails, then end.

Next, the situation of S307 that the first device acquires the second user password factor will be described in detail, which may specifically include but not limited to S3071 to S3076 shown in FIG. 7 .

S3071. The first device sends the fourth encrypted data to the second device or the third device.

In a possible implementation manner, S3071 may be implemented as: the first device sends the fourth encrypted data to the second device.

In another possible implementation manner, S3071 may be implemented as: the first device sends the fourth encrypted data to the third device.

It should be noted that, before performing S3071, the data processing method provided in the embodiment of the present application further includes a process of generating fourth encrypted data.

The process for the first device to generate the fourth encrypted data may include but not limited to S3070 and S3070A.

S3070. The first device receives the first public key for the second device.

The second device generates a set of public-private key pairs (the first public key and the first private key), the second device sends the first public key to the first device, and the first device receives the first public key for the second device.

Optionally, the first device may also generate a set of public-private key pairs (the second public key and the second private key), the first device sends the second public key to the second device, and the second device receives the second public key.

S3070A. The first device encrypts the first user password factor using the first public key to obtain fourth encrypted data.

S3072A. The second device receives the fourth encrypted data, and uses the first private key to decrypt the fourth encrypted data to obtain a second user password factor.

S3072B. The third device receives the fourth encrypted data, and uses the first private key to decrypt the fourth encrypted data under the trusted execution environment (Trusted Execution Environment, TEE), to obtain the second user password factor.

It should be noted that, before performing S3072B, the second device sends the first private key to the third device, and the first device sends the second public key to the third device.

S3073A. The second device encrypts the second user password factor with the second public key to obtain fifth encrypted data.

S3073B. Under the TEE, the third device encrypts the second user password factor with the second public key to obtain fifth encrypted data.

S3074A. The second device sends the fifth encrypted data to the first device.

S3074B. The third device sends the fifth encrypted data to the first device.

S3075. The first device receives fifth encrypted data.

In a possible implementation manner, the first device receives fifth encrypted data sent by the second device.

In another possible implementation manner, the first device receives fifth encrypted data sent by the third device.

S3076. The first device obtains the second user password factor by decrypting the fifth encrypted data with respect to the second private key corresponding to the second public key.

It should be noted that the embodiment of the present application does not specifically limit the public key encryption algorithm using the public key to encrypt data, and the private key decryption algorithm using the private key to decrypt data, which can be configured according to actual needs. For example, public key encryption algorithms may include, but are not limited to: SM2 public key encryption algorithm, Ron Rivest, Adi Shamir, Leonard Adleman (RSA) Public key encryption algorithm; private key decryption algorithm may include but not limited to: SM2 private key decryption algorithm, RSA private key decryption algorithm.

In this way, the first device stores the encrypted first user password factor, but the first device itself does not have the ability to decrypt, and the communication data between the first device and the second device is encrypted, so this method obtains the second user password factor , higher security.

In the following, the data processing method provided by the embodiment of the present application will be described through specific application scenarios.

For ease of understanding, some technologies are explained first.

SM2 algorithm: refers to the elliptic curve public key cryptography algorithm, which is an asymmetric encryption algorithm.

SM3 algorithm: Refers to the cryptographic hash function standard, which is a hash algorithm.

SM4 algorithm: Refers to the block cipher standard, which is a domestic symmetric encryption algorithm.

In the encryption storage process, including encryption and decryption process. For the encryption and decryption process, the first solution is to encrypt or decrypt the file through the built-in random password of the device; the second solution is to directly encrypt or decrypt the file through the user password.

The above-mentioned first scheme cannot allow the user password to participate in the encryption process. Theoretically speaking, the organization that provides encryption or decryption has the ability to decrypt the text, so the security is low.

The above-mentioned second solution can make the user password directly participate in the file encryption process. If the implementation needs to store the user's independent password, its security also depends on the password storage solution. If this method does not need to store the user password and directly uploads the encrypted file through the client after encryption, to a certain extent, it can be relatively safe, and the file storage organization cannot "guard and steal". But it affects its usability. If the user password is lost, the encrypted content will not be restored, and it will not be able to provide functions similar to independent password modification.

Relying on the mobile trusted execution environment solution, to a certain extent, "the key is only held by the user"; but when the user's device is replaced, data decryption will become a problem, and it does not support the user to display and set the password.

This application makes the following improvements:

1. Support user-defined passwords to "indirectly" participate in the encryption process. By using the user password to encrypt the system's built-in password, the user password can participate in the file encryption process. While ensuring user privacy and security, it supports modification and reset of user passwords. And the modification of the password has no effect on the stock data, and there is no need to decrypt the stock data and then encrypt it, taking into account the usability and ensuring the performance.

2. Different from the traditional TEE scheme, a third-party trusted certificate authority (without commercial conflict of interest) is introduced as a TEE certificate service provider. In the scenario of using the mobile terminal, it supports device replacement while using the TEE feature, and is compatible with the mobile terminal (equivalent to the third device, which can also be called terminal device) and the non-mobile terminal (equivalent to the second device, which can also be called authentication) device) shared key scenario.

In order to facilitate understanding, some algorithms (functions) are briefly explained.

SM3(X), use SM3 to calculate the hash value of X;

GENPSW(X), truncate the first 128 bits of X as the password used by SM4;

SM4ENCRYPT(S, P), the SM4 algorithm uses P to encrypt S;

SM4DECRYPT(D, P), SM4 algorithm P decrypts D;

SM2ENCRYPT(S, PUK), the SM2 algorithm uses the public key (PUK) to encrypt S;

SM2DECRYPT(D, PRK), the SM2 algorithm uses the private key (PRK) to decrypt D.

The data processing method provided by the embodiment of the present application may include, but not limited to, a registration process, a password verification process, an encryption process, a decryption process, a password modification process, and a mobile device replacement process.

The following describes the registration process:

When a user registers on the first device to use the file hosting service system (hereinafter referred to as the system), it is necessary to set the user's independent password P0 (equivalent to the first user's password) and the user's mobile phone number for OTP authentication. When the system creates a user ID, it will create a user-level random password factor S1 (equivalent to the first user password factor). The system will use the user's independent password P0 to pass the salt hash algorithm (SM3 algorithm) and truncate the first 128 bits ( bit) to generate the system password P1. Use the SM4 algorithm to encrypt S1 to the ciphertext D1 (equivalent to the first encrypted data) through P1.

For example, P1 can be obtained by the above formula (2), and D1 can be obtained by the above formula (5).

P1＝GEMPSW(SM3(SALT0+P0)) Formula (2);

D1=SM4ENCRYPT(S1, P1) Formula (5).

After the user registration is completed, the system will generate a public-private key pair <PUK0, PRK0> (PUK0 is the public key of the system, and PRK0 is the private key of the system) (equivalent to the second public key and the second private key), and the user The information (including mobile phone number and PUK0) is sent to a third-party certificate authority for registration (equivalent to the second device or authentication device), and the third-party certificate authority is responsible for registration and generates a user-level public-private key pair <PUK1, PRK1> (PUK1 is a third-party The public key of the certificate authority, PRK1 is the private key of the third-party certificate authority) (equivalent to the first public key and the first private key)). The third-party certificate authority issues PUK1 to the system, and the system uses the SM2 algorithm to encrypt S1 through PUK1 to obtain ciphertext D2 (equivalent to the fourth encrypted data).

Optionally, for the TEE scenario of the mobile terminal device (equivalent to the third device), the third-party certificate authority injects PRK1 and PUK0 into the user TEE; for non-TEE scenarios, no injection is required. D2 is equivalent to the backup of user factor S1 in this system, but the password used for decryption is stored in the third-party certificate authority and TEE environment, so as to ensure that the system cannot directly decrypt D2 to restore the password factor S1. The user's independent password P0 is not recorded in the whole process and will be destroyed when it is used up. Finally, use SM4 to encrypt the user ID through P1 to obtain ciphertext D3 (equivalent to user identification data), and store D1, D2, D3, PRK0, and PUK1.

For example, D2 can be obtained by formula (8), and D3 can be obtained by formula (9).

D2=SM2ENCRYPT(S1, PUK1) formula (8);

Among them, D2 represents the obtained ciphertext, SM2ENCRYPT represents the SM2 encryption algorithm, S1 represents the user-level random password factor, and PUK1 represents the public key of the third-party certificate authority.

D3=SM4ENCRYPT(ID, P1) formula (9);

Among them, D3 represents the obtained ciphertext, SM4ENCRYPT represents the SM4 encryption algorithm, ID represents the user identification, and P1 represents the system password.

The verification password process may include:

All subsequent encryption or decryption related methods require the user to pass in an independent password P0 (this operation can be completed by other front-end systems, and the user only needs to enter it once and cache it to the server). The system obtains P1 through P0, decrypts (SM4) D3 to the plaintext string S according to P1, and checks whether S is equal to the user ID. If they are equal, the verification is considered successful, and if they are not equal, the verification fails.

For example, P1 can be obtained by formula (2), and ID' can be obtained by formula (10).

P1＝GENPSW(SM3(SALT0+P0)) Formula (2);

ID'=SM4DECRYPT(D3, P1) Formula (10);

Among them, ID' represents the predicted user ID, SM4DECRYPT represents the SM4 decryption algorithm, D3 represents the ciphertext, SALT0 represents the salt value, and P1 represents the system password.

The encryption process can include:

The user uploads the file to be encrypted F0 (equivalent to the target object) and the user's independent password P0. On the premise that the user's password is correct, the system generates a file-level password factor S2 (equivalent to the object password factor) and The corresponding file password P2 (equivalent to the second password). The system restores P1 to P0, uses P1 to decrypt D1 to restore the user factor S1, assembles a new character string S3 through S1+S2, and truncates the first 128 bits of S3 through the salt hash algorithm (SM3 algorithm) to obtain the password P3 (equivalent to The first password), use the SM4 algorithm to encrypt F0 (equivalent to the first target object) through P3 to obtain the encrypted file F1; calculate the password P2 through the SM3 algorithm to intercept the first 128 bits to obtain the password P4, use SM4 encryption to obtain the ciphertext D4 through P4 encryption S2 (equivalent to the second encrypted data), this system records F1, P2 and D4.

For example, P1 can be obtained by formula (2), S1 can be obtained by formula (3), S3 can be obtained by formula (11), P3 can be obtained by formula (12), F1 can be obtained by formula (13), and P4 can be obtained by Equation (14) gets the password, and D4 can be obtained by Equation (15).

P1＝GEMPSW(SM3(SALT0+P0)) Formula (2);

S1＝SM4DECRYPT(D1, P1) Formula (3);

S3=SALT1+S1+S2 Formula 11;

Among them, S3 represents a new character string, SALT1 represents a salt value, S1 represents a user-level random password factor, and S2 represents a file-level password factor.

P3＝GENPSW(SM3(S3)) formula (12);

Among them, P3 represents the obtained password, GENPSW represents the random password generation algorithm, SM3 represents the salted hash algorithm, and S3 represents the new character string.

F1=SM4ENCRYPT(F0, P3) Formula (13);

Among them, F1 represents the encrypted file, SM4ENCRYPT represents the SM4 encryption algorithm, F0 represents the file to be encrypted, and P3 represents the encrypted password.

P4＝GENPSW(SM3(SALT2+P2) Formula (14);

Among them, P4 represents the obtained password, GENPSW represents the random password generation algorithm, SM3 represents the salted hash algorithm, SALT2 represents the salt value, and P2 represents the file password.

D4=SM4ENCRYPT(S2, P4) formula (15);

Among them, D4 represents the obtained file, SM4ENCRYPT represents the SM4 encryption algorithm, S2 represents the password factor at the file level, and P4 represents the encryption password.

The decryption process can include:

The user specifies the file ID to be obtained and the independent password P0. Under the premise that the verification of the user password is correct, the system recovers P1 from P0, and uses P1 to decrypt D1 to recover the user factor S1. The system restores the password P4 through the password P2, and decrypts D2 through P4 to obtain the factor S2.

The system assembles the password P3 through S1 and S2 in the same way as the encryption process. Use P3 to decrypt the encrypted file F1 (equivalent to the second target object) and restore the original file F0 for use by the user.

For example, P1 can be obtained by formula (2), S1 can be obtained by formula (3), P4 can be obtained by formula (14), S2 can be obtained by formula (16), S3 can be obtained by formula (11), and P3 can be obtained by Formula (12) is obtained, and F0 can be obtained by formula (17).

P1＝GENPSW(SM3(SALT0+P0) Formula (2);

S1＝SM4DECRYPT(D1, P1) Formula (3);

P4＝GENPSW(SM3(SALT2+P2) formula (14);

S2＝SM4DECRYPT(D4, P4) formula (16);

Among them, S2 represents the password factor at the file level, SM4DECRYPT represents the SM4 decryption algorithm, D4 represents the encrypted ciphertext of S2, and P4 represents the encrypted password.

S3=SALT1+S1+S2 formula (11);

P3＝GENPSW(SM3(S3)) formula (12);

F0＝SM4DECRYPT(F1, P3) formula (17);

Among them, F0 represents the original file after decryption, SM4DECRYPT represents the SM4 decryption algorithm, F1 represents the encrypted ciphertext of F0, and P3 represents the decryption password.

The password change process can include:

Scenarios initiated by non-mobile terminals (non-TEE environments, or authentication devices or second devices): OTP SMS verification is required. After passing the verification and confirming that the verification is successful, get the new password P0' input by the user, and send D2 to the third-party trusted certificate authority. The third-party trusted certificate authority uses PRK1 to decrypt D2 to obtain S1, and the third-party trusted certificate authority uses PUK0 The encrypted S1 is sent back to the system (to ensure the security of the transmission process).

Scenario initiated by mobile TEE: without OTP verification, use PRK1 in TEE to decrypt D2 to get S1, use PUK0 to encrypt S1 and send it back to the system.

The system receives the returned file, and uses PRK0 to decrypt it to get S1, generates P1' in the same way as the registration process, and uses P1' to encrypt S1 to get a new ciphertext D1', and replaces D1 with D1'. In this way, the new password P0' (equivalent to the second user password) can be used to encrypt and decrypt later, and indirectly participate in the encryption process through the user password, which supports password replacement while taking into account usability, and password replacement does not require re-encryption or decryption. The stored files (F1) greatly save the performance overhead compared with the traditional solution.

For example, for TEE or a third-party trusted certificate authority, S1 can be obtained by formula (18), S1_ENCRYPTED can be obtained by formula (19), S1 can be obtained by formula (20), and P1' can be obtained by formula (21).

S1=SM2DECRYPT(D2, PRK1) formula (18);

Among them, S1 represents the user-level random password factor, SM2DECRYPT represents the SM2 decryption algorithm, D2 represents the encrypted ciphertext of S1, and PRK1 represents the private key of the third-party trusted certificate authority.

S1_ENCRYPTED=SM2ENCRYPT(S1, PUK0) formula (19);

Among them, S1_ENCRYPTED represents the obtained ciphertext, SM2DECRYPT represents the SM2 encryption algorithm, S1 represents the user-level random password factor, and PUK0 represents the public key of the system.

For example, for this system, S1 can be obtained by formula (20), P1' can be obtained by formula (21), and D1' can be obtained by formula (22).

S1=SM2DECRYPT(S1_ENCRYPTED, PRK0) formula (20);

Among them, S1 represents the user-level random password factor, SM2DECRYPT represents the SM2 decryption algorithm, S1_ENCRYPTED represents the encrypted ciphertext of S1, and PRK0 represents the private key of the system.

P1'＝GENPSW(SM3(SALT0+P0')) formula (21);

Among them, P1' represents the updated system password, GENPSW represents the random password generation algorithm, SM3 represents the salted hash algorithm, SALT0 represents the salt value, and P0' represents the modified user password.

D1'=SM4ENCRYPT(S1, P1') Formula (22);

Among them, D1' represents the obtained ciphertext, SM4ENCRYPT represents the SM4 encryption algorithm, S1 represents the user-level random password factor, and P1' represents the updated system password.

The mobile device replacement process can include:

On the premise that the user password P0 is successfully verified, the third-party trusted certificate authority is notified to re-inject PRK1 and PUK0 into the TEE of the trusted mobile device.

It should be noted that this system provides an open (Open) API method through the use of third-party applications distributed by this system and the dynamic password refresh mechanism for authentication. The scenario used by the mobile terminal also relies on an intermediate service to access this system using the same mechanism .

If the device is replaced, the original device needs to be invalidated, and then go through the registration process to regenerate a new public-private key pair <PUK1', PRK1'>, and update D2 in this system to D2', and inject the new PRK1' and PUK0 into new device.

The salt value of the salted hash is maintained in this system and cannot be directly restored externally. The salt value can be the same or different in different processes.

In order to implement the above data processing method, a data processing device according to an embodiment of the present application will be described below with reference to the schematic structural diagram of the data processing device shown in FIG. 8 .

As shown in FIG. 8 , the data processing device 80 includes: a predicting unit 801 , an obtaining unit 802 (also referred to as the first obtaining unit 802 for ease of distinction), a decrypting unit 803 , a generating unit 804 and a processing unit 805 . in:

The prediction unit 801 is configured to decrypt the user identification data based on the received first user password to obtain a predicted user identification;

An obtaining unit 802 configured to obtain an actual user identifier associated with the first user password;

The decryption unit 803 is configured to determine that the verification of the first user password is successful if the predicted user ID is the same as the actual user ID, and decrypt the first encrypted data based on the first user password to obtain the first user password factor, the first encrypted data includes an encrypted first user password factor;

A generating unit 804 configured to generate a first password based at least on the first user password factor;

The processing unit 805 is configured to encrypt or decrypt the target object by using the first password.

In some embodiments, the decryption unit 803 is further configured to:

Generate a system password corresponding to the first user password based on the first user password; the system password is a system-specific password corresponding to the first user password; decrypt the first encryption by using the system password data to obtain the first user password factor.

In some embodiments, the data processing device 80 further includes a second obtaining unit.

an obtaining unit configured to obtain an object encryption factor for the target object;

Correspondingly, the generating unit 804 is configured to generate the first password based on the first user password factor and the object password factor.

In some embodiments, the obtaining unit is further configured to: decrypt the second encrypted data based on the second password to obtain the object encryption factor, and the second encrypted data includes the encrypted object encryption factor.

In some embodiments, generating unit 804 is further configured to:

Assembling the sum of the first user factor and the subject password factor into a password string;

Perform salted hash calculation on the password string to obtain a password hash value;

Truncating the first W digits of the password hash value to generate the first password.

In some embodiments, the data processing device 80 further includes a password modification unit.

The password modification unit is configured as:

In the case of receiving the second user password, obtain the second user password factor, the contents of the first user password factor and the second user password factor are the same;

Encrypting the second user password factor based on the received second user password to obtain third encrypted data; updating the first encrypted data based on the third encrypted data.

The data processing device 80 also includes a communication unit.

Communication unit configured as:

receiving the first public key for the authentication device; using the first public key to encrypt the first user password factor to obtain fourth encrypted data;

The password modification unit is also configured to:

Sending the fourth encrypted data to the authentication device or terminal device; receiving fifth encrypted data, the fifth encrypted data includes a second user password factor encrypted by a second public key, the second public key is for The public key of the first device; the second user password factor is obtained by decrypting the fifth encrypted data with respect to the second private key corresponding to the second public key.

It should be noted that the data processing device provided in the embodiment of the present application includes each included unit, which can be realized by a processor in an electronic device; of course, it can also be realized by a specific logic circuit; in the process of implementation, the processor It can be a central processing unit (CPU, Central Processing Unit), a microprocessor (MPU, Micro Processor Unit), a digital signal processor (DSP, Digital Signal Processor) or a field programmable gate array (FPGA, Field-Programmable Gate Array) wait.

The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiments of the present application, please refer to the description of the method embodiments of the present application for understanding.

It should be noted that, in the embodiment of the present application, if the above-mentioned data processing method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solutions of the embodiments of the present application or the part that contributes to the related technologies can be embodied in the form of software products. The computer software products are stored in a storage medium and include several instructions to make A computer device (which may be a personal computer, a server, or a network device, etc.) executes all or part of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes such as U disk, mobile hard disk, read-only memory (Read Only Memory, ROM), magnetic disk or optical disk. Thus, embodiments of the present application are not limited to any specific combination of hardware and software.

In order to implement the above data processing method, an embodiment of the present application provides an electronic device, including a memory and a processor, the memory stores a computer program that can run on the processor, and the processor implements the above implementation when executing the program The steps in the data processing method provided in the example.

The structural diagram of the electronic device will be described below with reference to the electronic device 90 shown in FIG. 9 .

In an example, the electronic device 90 may be the above-mentioned first device. As shown in FIG. 9 , the electronic device 90 includes: a processor 901 , at least one communication bus 902 , a user interface 903 , at least one external communication interface 904 and a memory 905 . Wherein, the communication bus 902 is configured to realize connection and communication among these components. Wherein, the user interface 903 may include a display screen, and the external communication interface 904 may include a standard wired interface and a wireless interface.

The memory 905 is configured to store instructions and applications executable by the processor 901, and can also cache data to be processed or processed by the processor 901 and various modules in the electronic device (for example, image data, audio data, voice communication data and video data) Communication data), which can be realized by flash memory (FLASH) or random access memory (Random Access Memory, RAM).

In a fourth aspect, the embodiments of the present application provide a storage medium, that is, a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in the data processing method provided in the above-mentioned embodiments are implemented. .

It should be pointed out here that: the descriptions of the above storage medium and device embodiments are similar to the descriptions of the above method embodiments, and have similar beneficial effects to those of the method embodiments. For technical details not disclosed in the storage medium and device embodiments of the present application, please refer to the description of the method embodiments of the present application for understanding.

It should be understood that reference throughout the specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic related to the embodiment is included in at least one embodiment of the present application. Thus, appearances of "in one embodiment" or "in some embodiments" throughout this specification are not necessarily referring to the same embodiments. Furthermore, the particular features, structures or characteristics may be combined in any suitable manner in one or more embodiments. It should be understood that in various embodiments of the present application, the sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not be used in the embodiments of the present application. The implementation process constitutes any limitation. The serial numbers of the above embodiments of the present application are for description only, and do not represent the advantages and disadvantages of the embodiments.

It should be noted that, in this document, the term "comprising", "comprising" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or apparatus comprising a set of elements includes not only those elements, It also includes other elements not expressly listed, or elements inherent in the process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus comprising that element.

In the several embodiments provided in this application, it should be understood that the disclosed devices and methods may be implemented in other ways. The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or May be integrated into another system, or some features may be ignored, or not implemented. In addition, the coupling, or direct coupling, or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be electrical, mechanical or other forms of.

The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed to multiple network units; Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application can be integrated into one processing unit, or each unit can be used as a single unit, or two or more units can be integrated into one unit; the above-mentioned integration The unit can be realized in the form of hardware or in the form of hardware plus software functional unit.

Those of ordinary skill in the art can understand that all or part of the steps to realize the above method embodiments can be completed by hardware related to program instructions, and the aforementioned programs can be stored in computer-readable storage media. When the program is executed, the execution includes The steps of the foregoing method embodiments; and the foregoing storage media include: removable storage devices, read-only memory (Read Only Memory, ROM), magnetic disks or optical disks and other media that can store program codes.

Alternatively, if the above-mentioned integrated units of the present application are realized in the form of software function modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solutions of the embodiments of the present application or the part that contributes to the related technologies can be embodied in the form of software products. The computer software products are stored in a storage medium and include several instructions to make A computer device (which may be a personal computer, a server, or a network device, etc.) executes all or part of the methods described in the various embodiments of the present application. The aforementioned storage medium includes various media capable of storing program codes such as removable storage devices, ROMs, magnetic disks or optical disks.

The above is only the embodiment of the present application, but the scope of protection of the present application is not limited thereto. Anyone familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, and should covered within the scope of protection of this application. Therefore, the protection scope of the present application should be determined by the protection scope of the claims.

Claims

A data processing method, the method being applied to a first device, the method comprising:

Decrypting the user identification data based on the received first user password to obtain a predicted user identification;

obtaining an actual user identification associated with said first user password;

If the predicted user ID is the same as the actual user ID, it is determined that the verification of the first user password is successful, and the first encrypted data is decrypted based on the first user password to obtain a first user password factor, the first user password The encrypted data includes an encrypted first user password factor;

generating a first password based at least on said first user password factor;

The target object is encrypted or decrypted by the first password.
The method according to claim 1, wherein said decrypting the first encrypted data based on the first user password to obtain the first user password factor comprises:

generating a system password corresponding to the first user password based on the first user password; the system password is a system-specific password corresponding to the first user password;

The first encrypted data is decrypted by the system password to obtain the first user password factor.
The method according to claim 1 or 2, said method further comprising:

obtaining an object encryption factor for the target object;

The generating a first password at least based on the first user password factor includes:

The first password is generated based on the first user password factor and the object password factor.
The method according to claim 3, said obtaining an object password factor for said target object, comprising:

Decrypting the second encrypted data based on the second password to obtain the object encryption factor, the second encrypted data including the encrypted object encryption factor.
The method according to claim 3 or 4, said generating said first password based on said first user password factor and said object password factor, comprising:

Assembling the sum of the first user factor and the subject password factor into a password string;

Perform salted hash calculation on the password string to obtain a password hash value;

Truncating the first W digits of the password hash value to generate the first password.
The method according to any one of claims 1-5, further comprising:

In the case of receiving the second user password, obtain the second user password factor, the contents of the first user password factor and the second user password factor are the same;

Encrypting the second user password factor based on the received second user password to obtain third encrypted data;

The first encrypted data is updated based on the third encrypted data.
The method of claim 6, further comprising:

receiving a first public key for a second device;

Encrypting the first user password factor with the first public key to obtain fourth encrypted data;

The obtaining of the second user password factor includes:

sending said fourth encrypted data to said second device or third device;

receiving fifth encrypted data including a second user cryptographic factor encrypted with a second public key, the second public key being a public key for the first device;

The second user password factor is obtained by decrypting the fifth encrypted data with respect to the second private key corresponding to the second public key.
A data processing device, the device is deployed in a first device; the device includes:

The prediction unit is configured to decrypt the user identification data based on the received first user password to obtain a predicted user identification;

An obtaining unit configured to obtain an actual user identifier associated with the first user password;

The decryption unit is configured to determine that the verification of the first user password is successful if the predicted user ID is the same as the actual user ID, decrypt the first encrypted data based on the first user password, and obtain the first user password factor , the first encrypted data includes an encrypted first user password factor;

a generating unit configured to generate a first password based at least on the first user password factor;

A processing unit configured to encrypt or decrypt the target object by using the first password.
An electronic device comprising a memory and a processor, the memory stores a computer program that can run on the processor, and the processor implements the data processing method according to any one of claims 1 to 7 when executing the program.
A storage medium on which a computer program is stored, and when the computer program is executed by a processor, the data processing method according to any one of claims 1 to 7 is realized.