CN110138749A - Data security protection method and related equipment - Google Patents

Abstract

The embodiment of the invention discloses a data security protection method and related equipment. The method comprises the following steps: the first terminal sends first ciphertext information to the key server; the first ciphertext information is obtained by encrypting a first password by the first terminal according to a public key from the key server; the first terminal receives second ciphertext information sent by the key server; the second ciphertext information is obtained by encrypting a second password of the key server according to the first password after the key server decrypts the first ciphertext information according to a private key corresponding to the public key to obtain the first password; the first terminal decrypts the second ciphertext information according to the first password to obtain a second password; and the first terminal sends the data encrypted by the second password to the storage server. By implementing the embodiment, the safety of the personal data of the user in the cloud backup process can be improved, and the risk of data leakage is avoided.

Description

A data security protection method and related equipment

technical field

The invention relates to a data transmission technology in the communication field, in particular to a data security protection method and related equipment.

Background technique

Cloud backup is to back up the user's personal data, such as contacts, text messages, pictures, videos and other data to the network through cloud storage. As cloud backup technology becomes more and more mature, more and more users like to back up personal data in their mobile phones to the cloud. In this way, users can not only free up a large amount of mobile phone storage space, but also download from the cloud anytime and anywhere when they need to use this personal data.

Since most of the personal data in the user's mobile phone involves personal privacy, we need to have higher protection requirements for the user's personal data, so as to avoid the user's personal data being stolen and the user's interests being damaged. However, in the prior art, there is a risk of leakage during the process that the user transmits personal data to the cloud through the terminal and the storage of the personal data in the cloud server. While enjoying the convenience brought by cloud backup technology, how to ensure the security of users' personal data is an urgent problem to be solved at present.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a data security protection method and related equipment, so as to improve the security of user personal data in the cloud backup process, avoid the risk of data leakage, and achieve better and safer protection of user personal data.

In a first aspect, an embodiment of the present invention provides a data security protection method, the method includes: a first terminal sends first ciphertext information to a key server; the first ciphertext information is the first terminal obtained by encrypting the first password with the public key of the secret key server; the first terminal receives the second ciphertext information sent by the secret key server; the second ciphertext information is the secret key After the server decrypts the first ciphertext information according to the private key corresponding to the public key to obtain the first password, it is obtained by encrypting the second password of the secret key server according to the first password; A terminal decrypts the second ciphertext information according to the first password to obtain the second password; the first terminal sends the data encrypted by the second password to the storage server.

It can be seen that the first terminal encrypts the first password according to the public key of the key server, and obtains the first ciphertext information; The ciphertext information is decrypted to obtain the first password. Here, only the secret key server has the right to use the private key, so only the secret key server can decrypt to obtain the first password; after the secret key server decrypts and obtains the first password, according to the first password The second password of the key server is encrypted to obtain the second ciphertext information, and the second ciphertext information is sent to the first terminal; since the first terminal originally stores the first password, the first terminal can directly The second password can be obtained by decrypting the second ciphertext information with a password; then, the data sent by the first terminal to the storage server are all encrypted by the second password. It can be seen from the above process that the transmission of the second password for data encryption negotiated by the first terminal and the secret key server in the network is protected by layers of encryption. Specifically, the secret key server issues the second password to the first terminal. is encrypted by the first password, and the first password is encrypted and transmitted by the first terminal to the secret key server through an asymmetric encryption method (public key and private key encryption method). In any of the above steps, even if the data information is intercepted by the hacker during the transmission between the terminal and the key server, since the data information is encrypted and the hacker cannot obtain the corresponding decryption password, the content of the data information cannot be obtained. By implementing the above embodiments, the security of the user's personal data during the cloud backup process can be improved, the risk of data leakage can be avoided, and better and more secure protection of the user's personal data can be achieved.

In some implementations, the data is video data, and the video data encrypted by the second password is used to be delivered to the second terminal through the storage server for decryption and playback.

In some implementations, before the first terminal sends the video data encrypted by the second password to the storage server, the method further includes: obtaining, by the first terminal, a plurality of video segments according to the original video data correspondingly, the first terminal sending the video data encrypted by the second password to the storage server specifically includes: the first terminal sending each video encrypted by the second password to the storage server Chunked data.

It should be noted that, if the video data is transmitted in the network in the form of plaintext, the online playback of the video can be realized through the common streaming media technology, that is, the downloaded video content is played while downloading. The video data aimed at in the present invention is encrypted, that is, the video data is transmitted in the form of cipher text in the network, and the encrypted video data cannot be played online through the conventional scheme, and the conventional scheme needs to be completely downloaded. After the encrypted video data is encrypted and the encrypted video data is decrypted, the decrypted video data can be played. By implementing the solution proposed by the present invention, the code of the underlying streaming media technology of the operating system can not be modified, and the original video data can be segmented and separately encrypted, and then each encrypted video segment data can be sent to the storage. The server makes it easy for the second terminal to download the encrypted video segment data from the storage server, and play the video segment data every time one video segment data is decrypted. Therefore, both the secure transmission of the encrypted video data and the online playback of the video data can be realized, which is efficient and fast, and can save a lot of development costs.

In some implementations, the video data encrypted by the second cipher is at least one video block data in the original video data.

It should be noted that the at least one video segment data is determined from a plurality of video segment data based on an input instruction for . By implementing the above embodiments, only part of the original video data can be backed up according to the user's needs, which not only improves the user experience, but also saves the storage space of the storage server.

In some implementation manners, the first terminal obtains a plurality of video block data according to the original video data, including: the first terminal cuts the original video data according to the block rule information from the storage server. sub-processing to obtain the plurality of video sub-blocking data; the sub-blocking rule information is determined according to the network bandwidth between the first terminal and the storage server.

In the above embodiment, the original video data is segmented according to the segmentation rule determined by the network bandwidth, and each segmented video segment data is sent to the storage server, which can avoid the problem of excessive video segment data. The network is congested, thereby increasing the transmission speed of the video segmented data from the first terminal to the storage server.

In some implementations, before the first terminal sends the first ciphertext information to the secret key server, the method further includes: receiving, by the first terminal, an access password sent by the authentication server; the access password is the The authentication server is generated according to the login information of the first terminal; the first terminal sends a request for obtaining the public key to the secret key server; the request includes the access password; in the secret key When the server successfully verifies the access password through the authentication server, the first terminal receives the public key sent by the secret key server.

In some implementation manners, the first terminal sends the access password to the secret key server while sending the first ciphertext information to the secret key server; accordingly, the first terminal receives the The second ciphertext information sent by the secret key server specifically includes: when the secret key server successfully verifies the access password through the authentication server, the first terminal receives the information sent by the secret key server. of the second ciphertext information.

In the above embodiment, an authentication server is added to the cloud, and before the key server sends the relevant security data (such as the public key and the second ciphertext information) to the terminal, the authentication server is responsible for verifying the legitimacy of the logged-in user of the terminal, Granting an access password to an authenticated terminal further improves the security of user privacy data (such as video data) in the cloud backup by increasing the verification of the legitimacy of the user's request.

In some implementations, the login information of the first terminal and the login information of the second terminal are the same. Embodiments Through the above-mentioned embodiments, different terminals can be associated through login information (user accounts), and downloading or backup can be implemented in different terminals.

In some implementations, the first password is a password generated by the first terminal according to a random number. In the above embodiment, since the first password is randomly generated inside the terminal, it is more difficult for hackers to steal the first password, and the security is higher.

In a second aspect, an embodiment of the present invention provides a data security protection method, the method includes: a second terminal sends first ciphertext information to a secret key server; the first ciphertext information is the second terminal according to the source obtained by encrypting the first password with the public key of the secret key server; the second terminal receives the second ciphertext information sent by the secret key server; the second ciphertext information is the secret key After the server decrypts the first ciphertext information according to the private key corresponding to the public key to obtain the first password, it is obtained by encrypting the second password of the secret key server according to the first password; The second terminal decrypts the second ciphertext information according to the first password, and obtains the second password of the secret key server; the second terminal encrypts the encrypted data from the storage server according to the second password of the secret key server data is decrypted.

It can be seen that the second terminal encrypts the first password according to the public key of the key server to obtain the first ciphertext information; The ciphertext information is decrypted to obtain the first password. Here, only the secret key server has the right to use the private key, so only the secret key server can decrypt to obtain the first password; after the secret key server decrypts and obtains the first password, according to the first password The second password of the key server is encrypted to obtain the second ciphertext information, and the second ciphertext information is sent to the second terminal; since the second terminal originally stores the first password, the second terminal can directly The second password can be obtained by decrypting the second ciphertext information with a password; then, the data sent by the second terminal to the storage server are all encrypted by the second password. It can be seen from the above process that the second password for data decryption negotiated by the second terminal and the secret key server is transmitted in the network through layer-by-layer encryption protection. Specifically, the secret key server issues the second password to the second terminal. is encrypted by the first password, and the first password is encrypted and transmitted by the first terminal to the secret key server through an asymmetric encryption method (public key and private key encryption method). In any of the above steps, even if the data information is intercepted by the hacker during the transmission between the terminal and the key server, since the data information is encrypted and the hacker cannot obtain the corresponding decryption password, the content of the data information cannot be obtained. By implementing the above embodiments, the security of the user's personal data during the cloud backup process can be improved, the risk of data leakage can be avoided, and better and more secure protection of the user's personal data can be achieved.

In some implementations, the encrypted data is encrypted by the first terminal according to the second password of the key server and sent to the storage server.

In some implementation manners, the encrypted data is video data encrypted by the first terminal according to the second password of the key server; the second terminal, according to the second password of the key server, encrypts the video data from the key server. After decrypting the encrypted data of the storage server, the method further includes: playing, by the second terminal, the decrypted video data.

In some implementation manners, the encrypted video data is obtained by encrypting each video block data in the original video data by the first terminal according to the second password.

It should be noted that, if the video data is transmitted in the network in the form of plaintext, the online playback of the video can be realized through the common streaming media technology, that is, the downloaded video content is played while downloading. The video data aimed at in the present invention is encrypted, that is, the video data is transmitted in the form of cipher text in the network, and the encrypted video data cannot be played online through the conventional scheme, and the conventional scheme needs to be completely downloaded. After the encrypted video data is encrypted and the encrypted video data is decrypted, the decrypted video data can be played. In this embodiment of the present invention, the video data stored in the storage server is processed in blocks and encrypted separately by the first terminal. Therefore, the video data downloaded from the storage server by the second terminal is processed in blocks and encrypted respectively. , every time the second terminal downloads a piece of video segment data from the storage server, it decrypts and plays the video segment data. Therefore, both the secure transmission of the encrypted video data and the online playback of the video data can be realized, which is efficient and fast, and can save a lot of development costs.

In some implementation manners, the encrypted video data is obtained by encrypting at least one video block data in the original video data by the first terminal according to the second password.

It should be noted that the at least one video segment data is determined from the original video data by the second terminal based on the input instruction for . By implementing the above embodiments, only part of the original video data can be downloaded according to user requirements, which not only improves user experience, but also saves network bandwidth.

In some implementations, before the second terminal decrypts the encrypted data from the storage server according to the second password of the secret key server, the method further includes: the second terminal sends a message to the storage server Send a request for obtaining an encrypted video block data; the one encrypted video block data is a piece of the encrypted each video block data, and the one video block data is the second The terminal is determined based on a user input instruction; the second terminal receives the one encrypted video segment data from the storage server.

In the above embodiment, the second terminal sends a request for obtaining an encrypted video segment data to the storage server, and the encrypted video segment data is based on the input instructions, such as fast forward, Drag the playback progress bar to determine. By implementing the above embodiments, fast-forward playback, fast-rewind playback, and playback by dragging a progress bar at will are implemented for encrypted video data, thereby improving user experience.

In some implementations, before the second terminal sends the first ciphertext information to the secret key server, the method further includes: receiving, by the second terminal, an access password sent by an authentication server; the access password is the authentication server generated according to the login information of the second terminal; the second terminal sends a request for obtaining the public key to the key server; the request includes the access password; When the authentication server successfully verifies the access password, the second terminal receives the public key sent by the secret key server.

In some implementation manners, the second terminal sends the access password to the secret key server while sending the first ciphertext information to the secret key server; accordingly, the second terminal receives the The second ciphertext information sent by the secret key server specifically includes: when the secret key server successfully verifies the access password through the authentication server, the second terminal receives the information sent by the secret key server. of the second ciphertext information.

In the above embodiment, an authentication server is added to the cloud, and before the key server sends the relevant security data (such as the public key and the second ciphertext information) to the terminal, the authentication server is responsible for verifying the legitimacy of the logged-in user of the terminal, Granting an access password to an authenticated terminal further improves the security of user privacy data (such as video data) in the cloud backup by increasing the verification of the legitimacy of the user's request.

In some implementations, the login information of the second terminal is the same as the login information of the first terminal. Embodiments Through the above-mentioned embodiments, different terminals can be associated through login information (user accounts), and downloading or backup can be implemented in different terminals.

In a third aspect, an embodiment of the present invention provides a data security protection method, the method includes: a key server receives first ciphertext information sent by a terminal, the first ciphertext information is the obtained by encrypting the first password of the terminal with the public key of the key server; the key server decrypts the first ciphertext information according to the private key corresponding to the public key to obtain the first password; the The secret key server sends second ciphertext information to the terminal, where the second ciphertext information is obtained by encrypting the second password generated by the secret key server according to the first password, and the second password uses For the security protection of the data of the terminal.

It can be seen that the terminal encrypts the first password according to the public key of the key server to obtain the first ciphertext information; the first ciphertext information can only be encrypted to the first ciphertext according to the private key corresponding to the public key of the secret key server. The information is decrypted to obtain the first password. Here only the secret key server has the right to use the private key, so only the secret key server can decrypt to obtain the first password; after the secret key server decrypts and obtains the first password, the secret key The second password of the server is encrypted to obtain the second ciphertext information, and the second ciphertext information is sent to the first terminal; since the terminal originally stores the first password, the terminal can directly decrypt the second password according to the first password. Then, the data sent by the terminal to the storage server is encrypted by the second password. It can be seen from the above process that the transmission of the second password for data encryption negotiated by the terminal and the key server in the network is protected by layers of encryption. Specifically, the second password delivered by the key server to the terminal is transmitted through the first password. The password is encrypted, and the first password is encrypted and transmitted by the terminal to the secret key server through an asymmetric encryption method (public key and private key encryption method). In any of the above steps, even if the data information is intercepted by the hacker during the transmission between the terminal and the key server, since the data information is encrypted and the hacker cannot obtain the corresponding decryption password, the content of the data information cannot be obtained. By implementing the above embodiments, the security of the user's personal data during the cloud backup process can be improved, the risk of data leakage can be avoided, and better and more secure protection of the user's personal data can be achieved.

In some implementations, the data is video data, and the second password is used by the terminal to encrypt the video data and send it to a storage server.

In some implementations, the data is video data, and the second password is used by the terminal to decrypt the encrypted video data from the storage server.

In some implementations, before the key server receives the first ciphertext information sent by the terminal, the method further includes: receiving, by the key server, a request sent by the terminal for obtaining the public key; the The request includes an access password; the access password is pre-generated by the authentication server according to the login information of the terminal and sent to the terminal; in the case that the key server successfully verifies the access password through the authentication server, The key server sends the public key to the terminal.

In some implementations, the secret key server receives the access password when receiving the first ciphertext information sent by the terminal; correspondingly, the secret key server sends a second ciphertext to the terminal The information is specifically: in the case that the key server successfully verifies the access password through the authentication server, the key server sends the second ciphertext information to the terminal.

In the above embodiment, an authentication server is added to the cloud, and before the key server sends the relevant security data (such as the public key and the second ciphertext information) to the terminal, the authentication server is responsible for verifying the legitimacy of the logged-in user of the terminal, Granting an access password to an authenticated terminal further improves the security of user privacy data (such as video data) in the cloud backup by increasing the verification of the legitimacy of the user's request.

In some implementations, the second password is a password generated by the key server according to a random number. In the above embodiment, since the second password is randomly generated inside the key server, it increases the difficulty for hackers to steal the second password, and the security is higher.

In a fourth aspect, an embodiment of the present invention provides a terminal, which serves as a first terminal and includes a display device, an input device, an output device, one or more memories, and one or more processors; wherein the one One or more programs are stored in one or more memories; it is characterized in that, when the one or more processors are executing the one or more programs, the terminal is made to implement the method of the first aspect.

In a fifth aspect, an embodiment of the present invention provides a terminal, the terminal is used as a second terminal, and includes a display device, an input device, an output device, one or more memories, and one or more processors; wherein the one One or more programs are stored in one or more memories; it is characterized in that, when the one or more processors are executing the one or more programs, the terminal is made to implement the method of the second aspect.

In a sixth aspect, an embodiment of the present invention provides a server, including an input device, an output device, one or more memories, and one or more processors; wherein the one or more memories store one or more programs ; characterized in that, when the one or more processors are executing the one or more programs, the server is caused to implement the method of the third aspect.

In a seventh aspect, an embodiment of the present invention provides a first terminal, where the terminal includes: an encryption/decryption module and a communication module. In a possible embodiment, the first terminal further includes: a segmentation module. The foregoing modules are used to implement the data security protection method described in the first aspect and any implementation manner thereof.

The communication module is used for sending the first ciphertext information to the secret key server; the first ciphertext information is obtained by the first terminal encrypting the first password according to the public key from the secret key server;

The communication module is configured to receive the second ciphertext information sent by the secret key server; the second ciphertext information is that the secret key server decrypts the first ciphertext information according to the private key corresponding to the public key Obtained by encrypting the second password of the secret key server according to the first password after obtaining the first password;

The encryption and decryption module is configured to decrypt the second ciphertext information according to the first password to obtain the second password;

The communication module is used for sending the data encrypted by the second password to the storage server.

In a possible embodiment, the data is video data, and the video data encrypted by the second password is used to be delivered to the second terminal through the storage server for decryption and playback.

In a possible embodiment, the segmentation module is configured to obtain a plurality of video segment data according to the original video data before the communication module sends the video data encrypted by the second password to the storage server; for sending each video segment data encrypted by the second password to the storage server.

In a possible embodiment, the video data encrypted by the second password is at least one video block data in the original video data.

In a possible embodiment, the segmentation module is configured to perform segmentation processing on the original video data according to the segmentation rule information from the storage server to obtain the plurality of video segmentation data; the segmentation rule information is based on The network bandwidth between the first terminal and the storage server is determined.

In a possible embodiment, the communication module is configured to receive an access password sent by the authentication server before the communication module sends the first ciphertext information to the secret key server; log-in information is generated; a request for obtaining the public key is sent to the secret key server; the request includes the access password; when the secret key server successfully verifies the access password through the authentication server Next, receive the public key sent by the key server.

In a possible embodiment, the communication module is configured to send the access password to the key server while sending the first ciphertext information to the key server; correspondingly, the communication module is configured to receive the key The second ciphertext information sent by the server specifically includes: a communication module configured to receive the first ciphertext sent by the secret key server when the secret key server successfully verifies the access password through the authentication server. Second cipher text information.

In a possible embodiment, the login information of the first terminal and the login information of the second terminal are the same.

In a possible embodiment, the first password is a password generated by the encryption/decryption module according to a random number.

In an eighth aspect, an embodiment of the present invention provides a second terminal, the terminal includes: a communication module, an encryption/decryption module, and in a possible embodiment, the first terminal further includes: a playback module. The foregoing modules are used to implement the data security protection method described in the second aspect and any implementation manner thereof.

The communication module is used for sending the first ciphertext information to the secret key server; the first ciphertext information is obtained by the second terminal encrypting the first password according to the public key from the secret key server;

The communication module is configured to receive the second ciphertext information sent by the secret key server; the second ciphertext information is that the secret key server decrypts the first ciphertext information according to the private key corresponding to the public key Obtained by encrypting the second password of the secret key server according to the first password after obtaining the first password;

The encryption and decryption module is configured to decrypt the second ciphertext information according to the first password, and obtain the second password of the secret key server;

The encryption and decryption module decrypts the encrypted data from the storage server according to the second password of the key server.

In a possible embodiment, the encrypted data is encrypted by the first terminal according to the second password of the key server and sent to the storage server.

In a possible embodiment, the encrypted data is video data encrypted by the first terminal according to the second password of the key server; After the encrypted data from the storage server is decrypted, the decrypted video data is played.

In a possible embodiment, the encrypted video data is obtained by encrypting each video block data in the original video data by the first terminal according to the second password.

In a possible embodiment, the encrypted video data is obtained by encrypting at least one video block data in the original video data by the first terminal according to the second password.

In a possible embodiment, the communication module is configured to, before the encryption and decryption module decrypts the encrypted data from the storage server according to the second password of the key server, send to the storage server an encrypted video segment for obtaining an encrypted video segment. data request; the encrypted video block data is a piece of the encrypted video block data, and the video block data is determined by the second terminal based on a user input instruction; The one encrypted video segment data of the storage server.

In a possible embodiment, the communication module is configured to receive an access password sent by the authentication server before the second terminal sends the first ciphertext information to the secret key server; information generated; send a request for obtaining the public key to the secret key server; the request includes the access password; in the case that the secret key server successfully verifies the access password through the authentication server , and receive the public key sent by the key server.

In a possible embodiment, the communication module is configured to send the access password to the key server while sending the first ciphertext information to the key server; correspondingly, the communication module is configured to receive the key The second ciphertext information sent by the server specifically includes: a communication module configured to receive the first ciphertext sent by the secret key server when the secret key server successfully verifies the access password through the authentication server. Second cipher text information.

In a possible embodiment, the login information of the second terminal is the same as the login information of the first terminal.

In a ninth aspect, an embodiment of the present invention provides a key server including: a communication module, and an encryption and decryption module. The foregoing modules are used to implement the data security protection method described in the third aspect and any implementation manner thereof.

The communication module is configured to receive first ciphertext information sent by the terminal, where the first ciphertext information is obtained by the terminal encrypting the first password of the terminal according to the public key from the secret key server;

The encryption and decryption module is configured to decrypt the first ciphertext information according to the private key corresponding to the public key to obtain the first password;

The communication module is configured to send second ciphertext information to the terminal, where the second ciphertext information is obtained by encrypting a second password generated by the secret key server according to the first password, and the second password It is used for security protection of the data of the terminal.

In a possible embodiment, the data is video data, and the second password is used by the terminal to encrypt the video data and send it to a storage server.

In a possible embodiment, the data is video data, and the second password is used by the terminal to decrypt the encrypted video data from the storage server.

In a possible embodiment, the communication module is configured to receive, before receiving the first ciphertext information sent by the terminal, a request sent by the terminal for obtaining the public key; the request includes an access password; the access password is an authentication The server generates in advance according to the login information of the terminal and sends it to the terminal; in the case that the access password is successfully verified by the authentication server, the public key is sent to the terminal.

In a possible embodiment, the communication module is configured to receive the access password while receiving the first ciphertext information sent by the terminal; correspondingly, the communication module is configured to send the second ciphertext information to the terminal, specifically The steps are: the communication module is configured to send the second ciphertext information to the terminal when the authentication server successfully verifies the access password.

In a possible embodiment, the second password is a password generated by an encryption/decryption module according to a random number.

In a tenth aspect, an embodiment of the present invention provides a storage server, including: a communication module and a storage module, wherein:

The communication module is configured to receive the data encrypted by the second password sent by the first terminal;

The communication module is used for sending the data encrypted by the second password to the second terminal;

The storage module is used for storing the data encrypted by the second password sent by the first terminal in the database.

In an eleventh aspect, an embodiment of the present invention provides a non-volatile computer-readable storage medium; the computer-readable storage medium is used to store an implementation code of the method in the first aspect. When the program code is executed by a computing device, the computing device is used in the method of the first aspect.

In a twelfth aspect, an embodiment of the present invention provides yet another non-volatile computer-readable storage medium; the computer-readable storage medium is used to store an implementation code of the method in the second aspect. When the program code is executed by a computing device, the user equipment is used in the method of the second aspect.

In a thirteenth aspect, an embodiment of the present invention provides yet another non-volatile computer-readable storage medium; the computer-readable storage medium is used to store an implementation code of the method in the second aspect. When the program code is executed by a computing device, the user equipment is used in the method of the third aspect.

In a fourteenth aspect, an embodiment of the present invention provides a computer program product; the computer program product includes program instructions, and when the computer program product is executed by a computing device, the controller executes the method described in the foregoing first aspect. The computer program product may be a software installation package, and if the method provided by any of the possible designs of the first aspect needs to be used, the computer program product may be downloaded and executed on the controller to The method described in the first aspect is implemented.

In a fifteenth aspect, an embodiment of the present invention provides yet another computer program product. The computer program product includes program instructions, and when the computer program product is executed by the user equipment, the controller performs the method provided by any one of the possible designs of the aforementioned second aspect. The computer program product may be a software installation package, and if the method provided by any of the possible designs of the foregoing second aspect needs to be used, the computer program product may be downloaded and executed on the controller to The method of the second aspect is implemented.

In a sixteenth aspect, an embodiment of the present invention provides yet another computer program product. The computer program product includes program instructions, and when the computer program product is executed by the user equipment, the controller executes the method provided by any possible design of the aforementioned third aspect. The computer program product may be a software installation package, and if the method provided by any of the possible designs of the foregoing third aspect needs to be used, the computer program product may be downloaded and executed on the controller to The method described in the third aspect is implemented.

It can be seen that, in this embodiment of the present invention, the second password negotiated by the terminal and the key server for encrypting or decrypting video data is transmitted in the network through layer-by-layer encryption protection. The delivery to the terminal is encrypted by the first password, and the first password is encrypted and transmitted to the secret key server by the terminal through an asymmetric encryption method (public key private key encryption method). An authentication server is added to the cloud, and before the key server sends the relevant security data (such as the public key and the second ciphertext information) to the terminal, the authentication server needs to verify the legitimacy of the logged-in user of the terminal; in addition, the present invention implements In an example, before backing up the encrypted video data, the terminal splits the original video data and encrypts them respectively, thereby realizing both the secure transmission of the encrypted video and the online playback of the encrypted video. By implementing the embodiments of the present invention, the security of user privacy data (such as video data) in cloud backup is improved, and the problem that conventional solutions cannot perform online playback of encrypted video data is also solved.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments.

1 is a schematic diagram of a network architecture for data security protection provided by an embodiment of the present invention;

FIG. 2 is a schematic diagram of another network architecture for data security protection provided by an embodiment of the present invention

3 is a schematic diagram of an application scenario designed by an embodiment of the present invention;

4 is a schematic diagram of a hardware architecture of a terminal device provided by an embodiment of the present invention;

5 is a schematic diagram of a hardware architecture of a server provided by an embodiment of the present invention;

6 is a schematic flowchart of a data security protection method provided by an embodiment of the present invention;

7 is a schematic flowchart of another data security protection method provided by an embodiment of the present invention;

FIG. 8 is a schematic diagram of cooperation and interaction of each component in each device described in the embodiment of FIG. 6;

9 is a schematic diagram of functional modules of a data security protection system and related equipment provided by an embodiment of the present invention;

FIG. 10 is a schematic diagram of functional modules of another data security protection system and related equipment provided by an embodiment of the present invention.

Detailed ways

The terms used in the embodiments of the present invention are only used to explain specific embodiments of the present invention, and are not intended to limit the present invention.

The following describes a process in which a user backs up and downloads personal data in the cloud through a terminal in a conventional solution.

The terminal encrypts the user's personal data according to the user's secret key, and then the terminal uploads the encrypted user's personal data to the storage server for backup. There is no user's secret key in the storage server, so the encrypted user's personal data cannot be accessed. Manufacturers that provide decryption services deploy independent decryption servers, which are responsible for obtaining keys from user terminals and storing them in the keystore. When the user needs to download the user's personal data that has been backed up in the cloud, the decryption server is responsible for the user's personal data obtained from the storage server, and decrypts the user's personal data according to the corresponding key in the keystore, and decrypts the decrypted user's personal data. data is sent to the terminal.

However, in the above process, the decryption server sends the user's personal data to the terminal in plaintext, and hackers can directly obtain the user's personal data by intercepting the downlink user's personal data. Therefore, the above solution has the risk of privacy leakage of personal data.

The embodiment of the present invention provides a new data security protection network architecture, which can effectively avoid the risk of user data leakage during the cloud backup process, and achieve more secure protection of user personal data. Referring specifically to FIG. 1, FIG. 1 is a schematic diagram of a network architecture for data security protection provided by the present invention, and the architecture includes:

(1) Secret key cloud: The secret key cloud is formed by connecting multiple servers deployed in the cloud. The server that provides secret key services in the secret key cloud can also be called "secret key server". The secret key server is responsible for communicating with the first terminal. . The second terminal negotiates a password, the password is used by the first terminal to encrypt the user's personal data and send to the storage server, and the password is also used by the second terminal to decrypt the encrypted user's personal data from the storage server.

(2) Authentication cloud: The authentication cloud is formed by connecting multiple servers deployed in the cloud. The server that provides authentication services in the authentication cloud can also be called "authentication server". Authentication, the user who passes the authentication is granted an access password, and only the user who is granted the access password can obtain the secret key corresponding to the account in the key cloud and the user's personal data corresponding to the account in the storage cloud.

(3) Storage cloud: The storage cloud is formed by connecting multiple servers deployed in the cloud. The server that provides the storage server in the storage cloud can also be called "storage server". The storage server is responsible for storing the encrypted personal data uploaded by users. In addition, since each server in the storage cloud cannot obtain the user's secret key, the encrypted content of the user's personal data cannot be directly accessed in the storage cloud.

(4) First terminal, second terminal: Both the first terminal and the second terminal may include but are not limited to other portable devices such as mobile phones, wearable devices, laptop computers or tablet computers. The first terminal is responsible for encrypting the user's personal data to be backed up to the storage cloud according to the password negotiated with the key cloud, and sending the encrypted user's personal data to the storage cloud for storage. The second terminal is responsible for decrypting the encrypted user personal data downloaded from the storage cloud according to the password negotiated with the key cloud.

In another embodiment, the network architecture for data security protection provided by the present invention may also be the network architecture shown in FIG. 2 , that is, the key cloud, authentication cloud, and storage cloud described above can be combined into one cloud, One or more servers in the cloud can be used as the key server, one or more servers in the cloud can be used as the authentication server, and one or more servers in the cloud can be used as the key server, wherein the key server The relevant functions of the authentication server and the secret key server can refer to the above description. The first terminal and the second terminal can communicate and interact with the server in the cloud to realize data security protection. The relevant functions of the first terminal and the second terminal can be Refer to the description above.

To facilitate understanding of the embodiments of the present invention, application scenarios involved in the embodiments of the present invention are described below.

With the increasingly powerful camera functions of terminals (such as smart phones, tablet computers, etc.) and the development of mobile Internet technology, more and more users like to use the video shot by the terminal and upload it to the cloud to save, so that users can use Other terminals (such as smart phones, tablet computers, etc.) to play. In the above usage scenario, the video file data captured by the user using the terminal involves user privacy, and therefore higher security protection is required for the video file data. In addition, due to the large capacity of the video file data, it takes a long time to download. In order to improve the user experience, it is necessary to support online video playback, that is, if the user does not download the complete video file, it can also be achieved by dragging the playback progress bar. Play video content at any point in time.

As shown in FIG. 3 , FIG. 3 is a schematic diagram of an application scenario of terminal video data backup and download provided by an embodiment of the present invention. In FIG. 3 , the first terminal acquires original video data. The original video data may be video data stored locally on the first terminal, for example, video data captured by the first terminal and stored locally, or other terminals. The video data sent by the device to the first terminal may also be the video data downloaded from the network to the local by the first terminal, which is not specifically limited in the present invention; then, the first terminal performs segmentation processing on the original video data to obtain N pieces of video segment data, where N is a positive integer; then, the first terminal encrypts the N pieces of video segment data respectively according to the password negotiated with the key server, and sends the encrypted N pieces of video segment data to The storage server performs backup storage. When the user needs to download the backed up video data through another terminal, the second terminal obtains the corresponding encrypted video segment data (which may be N video segment data, or N video segment data) from the storage server. Part of the video block data in the data), and then according to the password negotiated with the key server, respectively decrypt the N video block data and play the decrypted video block data. The decrypted video block data is played, thereby realizing online playback of the video data.

In some application scenarios, the first terminal and the second terminal in FIG. 3 are two different terminals, such as the following application scenarios: a user shoots a video through a terminal (such as a mobile phone, a tablet computer, etc.), and logs in to the user account through the user account. Cloud, upload videos to the cloud for backup; users can download and play videos online after logging in to the cloud through user accounts on other terminals (such as other mobile phones, tablet computers, etc.).

In other application scenarios, the first terminal and the second terminal in FIG. 3 may be the same terminal, for example, the following application scenarios: a user shoots a video through the terminal, logs in to the cloud through a user account, and uploads the video to the cloud for backup ; Due to the limited storage space of the terminal, the user deletes the video stored in the terminal after uploading the video to the cloud, but as long as the user logs in to the cloud with the user account, the user can still download and play the video online.

It can be understood that, the first terminal and the second terminal in the figure are only examples to facilitate understanding of the embodiments of the present invention, and may also be multiple terminals.

Referring to FIG. 4 , FIG. 4 is a schematic diagram of the hardware architecture of the terminal involved in FIGS. 1-3 . The terminal 400 may include: a chip 410 , a memory 411 , a radio frequency (RF) module 412 , a display device 413 , an input device 414 , and a camera device 415 . These components may communicate on one or more communication buses 4104. The terminal 400 may be the first terminal or the second terminal.

The chip 410 can be integrated to include: one or more processors 4101 , a clock module 4102 and a power management module 4103 . The clock module 4102 integrated in the chip 410 is mainly used to generate the clock required for data transmission and timing control for the processor 4101 . The power management module 4103 integrated in the chip 410 is mainly used to provide a stable and high-precision voltage for the processor 410, the radio frequency module 412 and the peripheral systems. For example, when the terminal 400 is the first terminal, the processor 4101 of the first terminal is configured to execute the steps related to the processor of the first terminal involved in the method embodiment of FIG. 6 or FIG. 7; when the terminal 400 is the second terminal , the processor 4101 of the second terminal is configured to execute the steps related to the processor of the second terminal involved in the method embodiment of FIG. 6 or FIG. 7 .

Memory 411 is coupled to processor 4101 for storing various software programs and/or sets of instructions. In specific implementations, memory 411 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic disk storage devices, flash memory devices, or other non-volatile solid-state storage devices. The memory 411 may store an operating system (hereinafter referred to as a system), such as an embedded operating system such as ANDROID, IOS, WINDOWS, or LINUX. The memory 411 can also store a network communication program, which can be used to communicate with one or more terminal devices. The memory 411 can also store a user interface program, which can vividly display the content of the application program through a graphical operation interface, and receive user control operations on the application program through input controls such as menus, dialog boxes, and buttons. . The memory 411 can also store data. For example, when the terminal 400 is the first terminal, the memory 411 can be used to store the original video data involved in the method embodiment of FIG. 7 below; when the terminal 400 is the second terminal, the memory 411 can It is used to store the video block data involved in the method embodiment of FIG. 7 later. The radio frequency (RF) module 412 is used for receiving and transmitting radio frequency signals, and mainly integrates the receiver and the transmitter of the terminal 400 . A radio frequency (RF) module 412 communicates with a communication network and other communication devices via radio frequency signals. In a specific implementation, the radio frequency (RF) module 412 may include, but is not limited to, an antenna system, an RF transceiver, one or more amplifiers, a tuner, one or more oscillators, a digital signal processor, a CODEC chip, a SIM card, and storage media, etc. In some embodiments, radio frequency (RF) module 412 may be implemented on a separate chip. For example, in the method embodiment of FIG. 6 or FIG. 7 of the present invention, when the terminal 400 is the first terminal or the second terminal, the transmitter can be used to send the first ciphertext information and the data encrypted by the second cipher, etc., and the receiver It can be used to receive second ciphertext information and so on.

The display device 413 may be used to display information input by the user or information provided to the user by the terminal 400 and various graphical user interfaces of the terminal 400, which may be composed of graphics, text, icons, videos and any combination thereof. Specifically, the display device 413 may include a display panel and an audio circuit. Optionally, the display panel may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like. Although in FIG. 4 the touch-sensitive surface and the display panel are presented as two separate components, in some embodiments, the touch-sensitive surface and the display panel may be integrated to implement input and output functions. For example, the touch-sensitive surface may cover the display panel, and when the touch-sensitive surface detects a touch operation on or near it, it is transmitted to the processor 4101 to determine the type of the touch event, and then the processor 4101 displays the display panel according to the type of the touch event. The corresponding visual output is provided on the . For example, in the method embodiment of FIG. 7 of the present invention, when the terminal 400 is the first terminal, the display device 413 can be used to display and play the original video data; when the terminal 400 is the second terminal, the display device 413 can be used to display and play Video chunked data.

The input device 414 may be used to receive numerical or character information entered by the user, as well as generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and functional control. Specifically, input device 414 may include touch-sensitive surfaces as well as other input devices. A touch-sensitive surface, also known as a touch display or touchpad, collects the user's touches on or near it and drives the corresponding connection device according to a preset program. Specifically, other input devices may include, but are not limited to, one or more of physical keyboards, function keys, trackballs, mice, joysticks, and the like. For example, in the method embodiment of FIG. 7 of the present invention, when the terminal 400 is the first terminal or the second terminal, the input device 414 can be used to detect the user's operation to obtain the user's input instruction, wherein the input instruction can be performed by pressing the touch-sensitive surface Formed by operations such as swiping, touching, and clicking.

The camera device 415 may be provided with a photosensitive element such as an image sensor for capturing images or videos of the shooting scene, and the camera device 415 may be, for example, a monocular camera, a binocular camera, or a multi-camera camera. For example, in the method embodiment of FIG. 7 of the present invention, when the terminal 400 is the first terminal, the camera 415 may be used to capture video data.

Referring to FIG. 5 , FIG. 5 is a structural block diagram of a server provided by an embodiment of the present disclosure. For the servers involved in FIGS. 1-3 , especially the key server, refer to the structural block diagram of the server in FIG. 5 . The server includes: a processor 501, a memory for storing processor-executable instructions, wherein the processor is configured to: execute the method steps involved in the key server in the method embodiment of FIG. 6 or FIG. 7 .

In a possible embodiment, the server may further include: one or more input interfaces 502 , one or more output interfaces 503 and a memory 504 .

The above-mentioned processor 501 , input interface 502 , output interface 503 and memory 504 are connected through a bus 505 . The memory 502 is used to store instructions, the processor 501 is used to execute the instructions stored in the memory 502, the input interface 502 is used to receive data, such as the first ciphertext information in the method embodiment of FIG. 6 or FIG. 7, and the output interface 503 is used to output Data, such as the public key and the second ciphertext information in the method embodiment of FIG. 6 or FIG. 7 .

Wherein, the processor 501 is configured to invoke the program instructions to execute: method steps related to the processor of the key server in the method embodiment of FIG. 6 or FIG. 7 .

It should be understood that, in the embodiments of the present disclosure, the processor 501 may be a central processing unit (Central Processing Unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), special-purpose processors An integrated circuit (Application Specific Integrated Circuit, ASIC), an off-the-shelf programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The memory 504 may include read only memory and random access memory, and provides instructions and data to the processor 501 . A portion of memory 504 may also include non-volatile random access memory. For example, memory 504 may also store interface type information.

In some implementations, the above components of the server described in the embodiments of the present disclosure may be used to execute the method steps involving the key server in the method embodiment of FIG. 6 or FIG. 7 described later.

The data security protection method provided by the embodiments of the present invention is described in detail below with reference to the accompanying drawings, and the method can realize more secure protection of user personal data in the cloud backup technology.

Referring to FIG. 6, FIG. 6 is a schematic flowchart of a data security protection method provided by an embodiment of the present invention. In the embodiment of FIG. 6 , steps 601 to 609 describe the process that the first terminal encrypts data according to the password negotiated with the key server, and sends the encrypted data to the storage server; steps 701 to 710 describe The second terminal downloads the encrypted data from the storage server, decrypts the encrypted data according to the password negotiated with the key server, and obtains the decrypted data. The password used for data encryption obtained through negotiation between the first terminal and the key server and the password used for data decryption obtained through negotiation between the second terminal and the key server can be securely transmitted in the network. The description will be expanded below: first, the process of encrypting the data to be backed up by the first terminal and sending the data to the storage server will be described. The process includes but is not limited to the following steps:

601. The secret key server sends the public key to the first terminal, and correspondingly, the first terminal receives the public key sent by the secret key server.

602. The first terminal generates a first password, and encrypts the first password according to the public key to obtain first ciphertext information.

603. The first terminal sends the first ciphertext information to the secret key server, and correspondingly, the secret key server receives the first ciphertext information sent by the first terminal.

604. The key server decrypts the first ciphertext information according to the private key corresponding to the public key to obtain a first password.

605. The key server generates a second password.

606. The key server encrypts the second password according to the first password to obtain second ciphertext information.

607. The key server sends the second ciphertext information to the first terminal, and correspondingly, the first terminal receives the second ciphertext information sent by the key server.

608. The first terminal decrypts the second ciphertext information according to the first password to obtain the second password.

609. The first terminal encrypts the data according to the second password, and sends the data encrypted by the second password to the storage server. Correspondingly, the storage server receives the data encrypted by the second password sent by the first terminal.

The process of negotiating the second password between the first terminal and the key server described in the above steps 601-608 will be described in detail below, where the second password is used by the first terminal to encrypt data. Wherein, the public key (English Public Key) and the private key (English Private Key) described in this application may be a set of secret key pairs (that is, a public key and a private key) generated by the RSA asymmetric encryption algorithm. The key can be the public part of the key pair, and the private key can be the non-public part. Public keys are typically used to encrypt session keys, verify digital signatures, or encrypt data that can be decrypted with the corresponding private key. The key pair generated by the RSA asymmetric encryption algorithm is guaranteed to be unique worldwide. When using this key pair, if a piece of data is encrypted with one of the keys, it must be decrypted with the other key. For example, data encrypted with a public key must be decrypted with the private key corresponding to the public key, and if encrypted with a private key, it must also be decrypted with the public key, otherwise the decryption will not succeed.

The first password in step 602 may be a dynamic random password generated by the processor inside the first terminal according to the random number. In some embodiments, the first password may be updated after a preset time interval, or may be updated according to different The data batch updates the first password, and may also dynamically update the first password generated by the processor inside the first terminal according to other conditions, which is not specifically limited in the present invention. The dynamic update of the first password is beneficial to improve the security of the first password, and increases the difficulty for hackers to steal the first password.

In the embodiment of the present invention, after the processor inside the first terminal generates the first password, the first password is encrypted according to the public key of the key server to obtain the first ciphertext information. The first ciphertext information can be decrypted to obtain the first password only through the private key corresponding to the public key of the key server. Even if the first ciphertext information is intercepted by the hacker in the process of transmitting the first ciphertext information to the secret key server, since the hacker cannot obtain the private key corresponding to the public key, the hacker cannot decrypt the first ciphertext information to obtain the first password. The private key corresponding to the public key can be stored in the key server, and only the key server has the right to use. After receiving the first ciphertext information sent by the first terminal through the input interface, the secret key server decrypts the first ciphertext information according to the private key corresponding to the public key to obtain the first password. It can be seen that the process from generating the first password at the first terminal to sending it to the key server is safe and reliable.

The second password in step 605 may be generated by a processor inside the key server, and the second password may be a dynamic random password generated by a processor inside the key server according to random numbers. The password may be updated after a preset time interval, or the second password generated by the processor inside the key server may be dynamically updated according to other conditions, which is not specifically limited in the present invention. It needs to be explained that the second password is what the secret key server needs to send to the first terminal, and the data sent by the first terminal to the storage server is encrypted according to the second password, and the security of the second password directly determines the first terminal. Security of data sent to storage servers. It can be seen that the security of the second password is very critical.

From the above description, it can be known that the process of notifying the first password of the first terminal to the key server by the first terminal can ensure that the first password is safe and credible. Therefore, the process of encrypting the second password by the key server according to the secure and credible first password, obtaining the second ciphertext information, and sending the second ciphertext information to the first terminal is also secure and credible. In this process, even if the second ciphertext information is intercepted by the hacker in the process of transmitting the second ciphertext information to the first terminal, since the hacker cannot obtain the first password, the hacker cannot decrypt the second ciphertext information to obtain the second password. After receiving the second ciphertext information sent by the key server, the first terminal decrypts the second ciphertext information according to the existing first password inside the first terminal to obtain the second password. It can be seen that the process of sending the second password from the key server to the second terminal is safe and reliable.

In step 609, it can be seen from the above that the second password used by the first terminal to encrypt the data is safe and reliable, so the first terminal encrypts the data according to the second password, and encrypts the data encrypted by the second password. The process of sending data to the storage server is also secure and reliable. Even if the data encrypted by the second password is intercepted by the hacker during the transmission from the first terminal to the key server, since the hacker cannot obtain the second password, the data encrypted by the second password cannot be decrypted. Therefore, by implementing the above embodiment, it can be ensured that the data in the process of backing up the data to the cloud by the user through the terminal is safe and reliable.

The following describes the process of the second terminal downloading the backed up encrypted data from the storage server and decrypting it. The process includes but is not limited to the following steps:

701. The secret key server sends the public key to the second terminal, and correspondingly, the second terminal receives the public key sent by the secret key server.

702. The second terminal generates a first password, and encrypts the first password according to the public key to obtain first ciphertext information.

703. The second terminal sends the first ciphertext information to the secret key server, and accordingly, the secret key server receives the information sent by the second terminal.

the first ciphertext information.

704. The key server decrypts the first ciphertext information according to the private key corresponding to the public key to obtain a first password.

705. The key server generates a second password.

706. The key server encrypts the second password according to the first password to obtain second ciphertext information.

707. The secret key server sends the second ciphertext information to the second terminal, and accordingly, the second terminal receives the information sent by the secret key server

the second ciphertext information.

708. The second terminal decrypts the second ciphertext information according to the first password to obtain the second password.

709. The storage server sends the encrypted data to the second terminal, and the second terminal receives the encrypted data sent by the storage server. The encrypted data may be data encrypted by the first terminal according to the second password and sent to the storage server. For example, the encrypted data may be encrypted video data, picture data, text data, and the like.

710. The second terminal decrypts the encrypted data according to the second password.

Steps 701-708 are the process of negotiating the password used for data decryption between the second terminal and the key server, and this process is similar to the process in steps 601-608 that the first terminal negotiated with the key server to obtain the password used for data encryption, For the sake of brevity, details are not repeated here.

Steps 709-710 will be described below. Since steps 701-708 are the passwords used for data decryption negotiated between the second terminal and the key server, the process is similar to steps 601-608, and it can be seen from the description of steps 601-608 that , the second password used by the second terminal to decrypt the encrypted data obtained from the storage server is safe and reliable, and in step 709, the encrypted data received by the second terminal from the storage server is encrypted by the second password, and the encrypted data is encrypted with the encrypted data. data transmitted over the network in the form of text. Therefore, even if the encrypted data is intercepted by the hacker in the process of delivering the encrypted data from the storage server to the second terminal, the hacker cannot access the content in the encrypted data because the hacker cannot obtain the second password. After receiving the encrypted data sent by the storage server, the second terminal decrypts the encrypted data according to the second password inside the terminal to obtain the decrypted data content. Therefore, by implementing the above embodiments, it can be ensured that the process of downloading the backed up data from the cloud by the user through the terminal is safe and reliable.

In some embodiments, the data involved in the embodiment of FIG. 6 may be user personal data, that is, the data sent by the first terminal to the storage server, and the data sent by the storage server to the second terminal may be user personal data. The personal data of the user may be data such as address book, text messages, pictures, videos, etc., and these data will involve user privacy, so it is necessary to carry out higher security protection for the above-mentioned data. By implementing the above embodiments of the data security protection method, higher requirements for security protection of the user's personal data can be achieved.

In the method embodiment of FIG. 6 , after the first terminal encrypts the data according to the password negotiated with the secret key server, the encrypted data is sent to the storage server; after the second terminal downloads the encrypted data from the storage server, the encrypted data is The encrypted data is decrypted with the password negotiated with the key server to obtain the decrypted data. The password used for data encryption obtained through negotiation between the first terminal and the key server and the password used for data decryption obtained through negotiation between the second terminal and the key server are safe to transmit in the network. By implementing the above embodiments, the security of user privacy data in cloud backup is improved.

FIG. 7 is another data security protection method provided by an embodiment of the present invention. The main difference between the embodiment in FIG. 6 and the embodiment in FIG. 7 is that, in the embodiment in FIG. 7, an authentication server is added to the cloud, and the key server sends relevant security data (such as public key and second ciphertext information) to the terminal Previously, the authentication server was responsible for verifying the legitimacy of the logged-in user of the terminal; and, the embodiment of FIG. 7 is for security protection of video data, which can realize online playback of video data while performing security protection on video data. Below is the description:

First, the process of splitting and encrypting the video data to be backed up by the first terminal and sending it to the storage server is described. The process includes but is not limited to the following steps:

801. The first terminal sends login information to an authentication server, and accordingly, the authentication server receives the login information sent by the first terminal.

802. The authentication server sends an access password to the first terminal, and correspondingly, the first terminal receives the access password sent by the authentication server. Specifically, the access password is generated by the authentication server according to the login information sent by the first terminal.

In some implementations, the first terminal sends login information to the authentication server through the radio frequency module to request to obtain the access password, and accordingly, the authentication server receives the login information, generates the access password according to the login information, and sends the generated access password to the authentication server. An access token is sent to the first terminal. The login information is a user account, the user account includes a user name and a password, and the user account is used to identify the user. The user can use the same user account to log in to the authentication server in different terminals, and obtain the access password granted by the authentication server, wherein the access password is that after the authentication server verifies that the user account of the first terminal is a legal user account, the authentication server grants the access password to the first terminal. A password used by a terminal to obtain relevant security data (eg, the public key and the second ciphertext information described below).

803. The first terminal sends a public key acquisition request to the secret key server, where the public key acquisition request includes an access password.

804-806: In the case that the key server successfully verifies the access password through the authentication server, the key server sends the public key to the first terminal, and correspondingly, the first terminal receives the public key sent by the key server.

In some implementations, after obtaining the access password from the public key acquisition request sent by the first terminal in step 803, the secret key server sends the access password to the authentication server to verify whether the user account sending the public key acquisition request is not legitimate. Correspondingly, the authentication server receives the access password, and verifies whether the user account that sends the request for obtaining the public key is legal according to the access password, and returns the verification result to the input interface of the secret key server, where the verification result is: In a legal case, the key server sends the public key to the first terminal through the output interface, and correspondingly, the first terminal receives the public key sent by the key server through the radio frequency module.

807. The first terminal generates a first password, and encrypts the first password according to the public key to obtain first ciphertext information. For the generation method of the first password, refer to the description of step 102 in the method embodiment in FIG. 6 .

808. The first terminal sends the first ciphertext information and the access password to the secret key server, and correspondingly, the secret key server receives the first ciphertext information and the access password sent by the first terminal.

809-811. In the case that the secret key server successfully verifies the access password through the authentication server, the secret key server decrypts the first ciphertext information according to the private key corresponding to the public key, and obtains the first password.

In some implementations, the output interface of the key server sends the access password to the authentication server to verify whether the user account that sends the first ciphertext information is legal. Correspondingly, the authentication server receives the access password, verifies whether the user account sending the first ciphertext information is legal according to the access password, and returns the verification result to the input interface of the key server, where the verification result is In the case of legality, the processor of the key server decrypts the first ciphertext information according to the private key corresponding to the public key to obtain the first password.

812. The key server generates a second password. For the generation method of the second password, refer to the description of step 105 in the method embodiment in FIG. 6 .

813. The key server encrypts the second password according to the first password to obtain second ciphertext information.

814. The key server sends the second ciphertext information to the first terminal, and correspondingly, the first terminal receives the second ciphertext information sent by the key server.

815. The first terminal decrypts the second ciphertext information according to the first password to obtain the second password.

816. The first terminal divides the original video data to obtain multiple pieces of video segment data, and encrypts the multiple pieces of video segment data respectively according to the second password. The original video data may be video data stored locally on the first terminal, for example, video data captured by the first terminal and stored locally, or video data sent by other terminal devices to the first terminal, or may be The first terminal downloads the local video data from the network, which is not specifically limited in the present invention

817. The first terminal sends each video segment data encrypted by the second password to the storage server, and correspondingly, the storage server receives each video segment data encrypted by the second password sent by the first terminal.

Steps 816 and 817 are described below.

It should be noted that, if the video data is transmitted in the network in the form of plaintext, the online playback of the video can be realized through the common streaming media technology, that is, the downloaded video content is played while downloading. The video data aimed at in the present invention is encrypted, that is, the video data is transmitted in the form of cipher text in the network, and the encrypted video data cannot be played online through the conventional scheme, and the conventional scheme needs to be completely downloaded. After the encrypted video data is encrypted and the encrypted video data is decrypted, the decrypted video data can be played.

Since the usual streaming media technology is the underlying basic technology of the operating system, such as the Android operating system (Android) and the Apple operating system (iOS), if the code implementation of the usual streaming media technology is improved, for example, in the usual streaming media technology The video encryption and decryption functions are integrated in the code implementation of the . In view of this, the solution proposed by the present invention does not involve modifying the code implementation of the underlying streaming media technology of the operating system, but can realize online playback of encrypted video data, which is efficient and fast, and can save a lot of development costs. Below is the description:

In the embodiment of the present invention, the first terminal performs segmentation processing on the original video data to obtain multiple video segment data, then encrypts the multiple video segment data according to the second password, and encrypts the multiple video segment data according to the second password. The data of each video segment is sent to the storage server, so that the storage server stores a plurality of video segment data encrypted by the second password instead of the encrypted original video data. When the user downloads encrypted video data from the storage server through other terminal devices, the first terminal only needs to download one encrypted video segment data among the multiple encrypted video segment data, and after decrypting it, The decrypted video segment data is played through the usual streaming media technology, and the subsequent encrypted video segment data is continuously downloaded while playing the decrypted video segment data, thereby realizing the online playback of the encrypted video data. . By implementing the above-mentioned embodiments, not only the online playback of encrypted video data is solved, and the user experience is improved, but also the above-mentioned embodiments are efficient and fast in implementation, and can save a lot of development costs.

In an implementation manner, the first terminal performs segmentation processing on the original video data according to the segmentation rule information from the storage server, where the segmentation rule information is determined by the storage server according to the network bandwidth between the first terminal and the storage server . In a specific implementation, the first terminal sends a video data storage request to the storage server through the radio frequency module. Correspondingly, after receiving the video data storage request, the storage server determines the block rule information according to the network bandwidth between the first terminal and the storage server. , the segmenting rule information includes the size of the video segment obtained by segmenting the original video data. For example, the size of the original video data is 100M, and according to the block rule information, it is determined to divide the original video data according to the size of 4M in equal proportions, and then 25 pieces of video block data are obtained after the division. It should be noted that if the original video data is divided into equal proportions, the size of each video segment obtained by the segmentation can be the same, but the present invention also supports unequal proportion segmentation of the original video data, and each video segment obtained by segmentation Chunks can vary in size. Specifically, the size of the video block is positively correlated with the network bandwidth, that is, the larger the network bandwidth, the larger the size of the video block, for example, the size of the video block may be 4M, 8M, 16M, and so on. Since the video data is usually large, the original video data is segmented according to the segmentation rules determined by the network bandwidth, and each segmented video segment data is sent to the storage server, which can avoid excessive video segment data. network congestion caused by large scale, thereby improving the transmission speed of video segmented data from the first terminal to the storage server.

In some implementation manners, the first terminal divides the original video data, and after encrypting each video segment data obtained from the segment, can then encrypt each encrypted video segment according to the playback order of each video segment data. The data is numbered, for example, the video segment data in the original video data in the first playback order has a smaller number. Correspondingly, the storage server may store the video segment data in the order of the size of the numbers.

In some implementation manners, the first terminal may sequentially send each video segment data encrypted by the second password to the storage server according to the size of the number of each video segment data encrypted by the second password. The video segment data is sent in the first order.

In some implementation manners, steps 816 and 817 may also be implemented by the following manner: the first terminal divides the original video data, obtains a plurality of video segment data, and divides at least one of the original video data according to the second password The video segment data is encrypted; the first terminal sends at least one video segment data encrypted by the second password to the storage server, and correspondingly, the storage server receives the at least one video segment data encrypted by the second password sent by the first terminal. block data. In specific applications, there are the following application scenarios. For example, the user only wants to back up a part of the videos captured by the terminal's camera device, such as a camera, to the cloud, but does not want to back up the entire video to the cloud. Specifically, the first terminal divides the original video data, and after obtaining multiple video segment data, determines at least one video segment data from the plurality of video segment data based on the user's input instruction, wherein the at least one video segment data is The segmented data includes part of the video that the user determines from the original video that needs to be backed up to the cloud, and then the first terminal encrypts the at least one video segmented data according to the second password, and encrypts the at least one video segmented by the second password. Block data is sent to the storage server. By implementing the above embodiments, only part of the original video data can be backed up according to the user's needs, which not only improves the user experience, but also saves the storage space of the storage server.

In some implementations, at least one video segment data is determined from the plurality of video segment data based on the user's input instruction. The corresponding input command is formed. Specifically, the input command may be triggered by the user sliding the video playback bar on the touch-sensitive surface, and after the video clip corresponding to the sliding range of the video playback bar is segmented, the at least one Video segment data; alternatively, the input instruction can be triggered by the user clicking on the touch-sensitive surface to input the video playback start time and video playback end time, and the video segment determined by the video playback start time and video playback end time is segmented. After processing, the at least one video block data can be obtained. The following describes the process of the second terminal downloading the backed up encrypted video data from the storage server, and decrypting and playing it. The process includes but is not limited to the following steps:

901. The second terminal sends login information to the authentication server, and accordingly, the authentication server receives the login information sent by the first terminal, where the login information is the user's account and password.

902. The authentication server sends an access password to the second terminal, and correspondingly, the second terminal receives the access password sent by the authentication server.

903. The second terminal sends a public key acquisition request to the secret key server, where the public key acquisition request includes an access password.

904-906: In the case that the key server successfully verifies the access password through the authentication server, the key server sends the public key to the second terminal, and correspondingly, the second terminal receives the public key sent by the key server.

907. The second terminal generates a first password, and encrypts the first password according to the public key to obtain the first ciphertext.

908. The second terminal sends the first ciphertext information and the access password to the secret key server, and correspondingly, the secret key server receives the first ciphertext information and the access password sent by the second terminal.

909-911. In the case that the secret key server successfully verifies the access password through the authentication server, the secret key server decrypts the first ciphertext information according to the private key corresponding to the public key, and obtains the first password.

912. The key server generates a second password.

913. The secret key server encrypts the second password according to the first password to obtain second ciphertext information.

914. The key server sends the second ciphertext information to the second terminal, and correspondingly, the second terminal receives the second ciphertext information sent by the key server.

915. The second terminal decrypts the second ciphertext information according to the first password to obtain the second password.

Steps 901-915 are the process that the second terminal negotiates with the key server to obtain a password for video data decryption, and this process is the same as steps 801-815 that the first terminal negotiates with the key server to obtain a password for video data encryption. Similarly, for brevity, details are not repeated here.

916-919, the second terminal sends a request for downloading video segmented data to the storage server; the storage server sends the encrypted video segmented data to the second terminal according to the request for downloading video segmented data; the second terminal receives the encrypted video segmented data sent by the storage server. After decrypting the encrypted video segment data according to the second password, the decrypted video score data is played.

In some implementations, the second terminal sends a request for downloading video segmented data to the storage server through a radio frequency module, where the request for downloading video segmented data is used to request to download encrypted video data, and the encrypted video data is the first terminal It is obtained by encrypting each video block data in the original video data according to the second password. Correspondingly, the storage server receives the request, and in response to the request, sends each video block data encrypted by the second password to the second terminal. Correspondingly, in the process of receiving the video block data encrypted by the second password through the radio frequency module, whenever it receives one of the video block data encrypted by the second password, according to the terminal It is decrypted by the existing second password inside, and the decrypted video block data is played. By implementing the above-mentioned embodiments, the user can download the complete original video data that has been backed up from the cloud (ie, the storage server), and during the downloading process, it can be played online.

In some implementations, the second terminal sends a request for downloading video segmented data to the storage server through a radio frequency module, where the request for downloading video segmented data is used to request to download encrypted video data, and the encrypted video data is the first terminal It is obtained by encrypting at least one video block data in the original video data according to the second password. Correspondingly, the storage server receives the request, and in response to the request, sends at least one piece of video block data encrypted by the second password to the second terminal. Correspondingly, in the process of receiving the at least one video block data encrypted by the second password through the radio frequency module, whenever one of the at least one video block data encrypted by the second password is received, It is decrypted according to the existing second password in the second terminal, and the decrypted video block data is played. By implementing the above-mentioned embodiment, the user can download part of the video data in the backed up original video data from the cloud (ie, the storage server), and in the process of downloading, online playback can be realized. Part of the video data, thus reducing the amount of video transmission data, thereby saving bandwidth.

In order to realize fast-forward playback, fast-rewind playback, and arbitrary dragging of the progress bar for encrypted video data. The present invention also provides the following implementation: the second terminal sends a request for acquiring an encrypted video segment data to the storage server; wherein, the encrypted video segment data is one of the encrypted video segment data. One piece of video segment data is determined by the second terminal based on user input instructions, and the user input instructions may be the user clicks, touches, and slides on the touch-sensitive surface (mobile phone screen) to trigger the formation of corresponding input instructions. , Specifically, the user slides the video playback bar on the touch-sensitive surface, or clicks or touches the relevant buttons for fast-forward playback and fast-rewind playback, and the processor detects the sliding, clicking, and touch operations on the touch-sensitive surface to generate the user input instruction ; Correspondingly, the storage server receives the described request for obtaining an encrypted video block data, and after responding to the request, sends the encrypted video block data to the second terminal; Correspondingly, the second terminal passes the The radio frequency module receives an encrypted video block data from the storage server. In the specific implementation, since the video data is file data conforming to the video coding format, the file start position of the video data saves the storage position and playback time point information of all key frames of the video data in the file. Therefore, before playing the video data, the second terminal always has to download and decrypt the first video segment data of the video data, and then according to the storage location and playback time point information of the key frame of the first video segment data, It is calculated that the user fast-forwards, rewinds, or arbitrarily drags the progress bar to the starting position of the video data corresponding to the key frame at a certain point in time. Then the first terminal adds the starting position information of the key frame in the video data to the request for obtaining an encrypted video segment data, and sends them to the storage server together, and the storage server determines the target video according to the starting position information Block data, the target video block data includes key frames, and the target video block data is sent to the second terminal. After the processor of the second terminal decrypts the target video data, it is displayed on the display panel of the second terminal (for example, phone screen) to play. By implementing the above embodiments, fast-forward playback, fast-rewind playback, and playback by dragging a progress bar at will are implemented for encrypted video data, thereby improving user experience.

The following is an example to illustrate how the storage server determines the target video segment data according to the starting position information of the key frame in the video data. For example, the starting position of the video data of the key frame is the 41000th byte, and the size of the video block data obtained by dividing the video data by the first terminal is 4M, that is, 4096 bytes. The storage server By calculating 41000÷4096=10...40, it is determined that the key frame is in the 11th video block data.

In this embodiment of the present invention, the login information of the first terminal and the login information of the second terminal may be the same, but in some implementations, the login information of the two may also be designed to be different, but both have access to the cloud (for example, a secret key server, storage server) access rights. The first terminal and the second terminal may be different terminals, or may be the same terminal. The solution in which the first terminal and the second terminal are different terminals is used to realize the following application scenarios: the user shoots a video through the camera of the terminal (such as a mobile phone), logs in to the cloud through the user account, and uploads the video to the cloud for backup; Users can download and play videos online after logging in to the cloud through a user account on other terminals (such as tablet computers). The solution in which the first terminal and the second terminal are the same terminal is used to realize the following application scenarios: the user shoots a video through the camera of the terminal, logs in to the cloud through the user account, and uploads the video to the cloud for backup; due to the storage space of the terminal Limited. After uploading the video to the cloud, the user deletes the video stored in the terminal, but as long as the user logs in to the cloud with the user account, the user can still download and play the video online.

Compared with the method embodiment in FIG. 6 , in the method embodiment in FIG. 7 , an authentication server is added to the cloud, and before the key server sends the relevant security data (such as the public key and the second ciphertext information) to the terminal, it needs to pass the authentication. The server verifies the legitimacy of the logged-in user of the terminal; and, the encrypted data in the embodiment of FIG. 7 is encrypted video data, and the terminal divides the encrypted video data before backing up to obtain a plurality of video block data, thereby realizing Online playback of encrypted video. By implementing the above embodiments, the security of user privacy data (such as video data) in cloud backup is further improved, and the problem that conventional solutions cannot perform online playback of encrypted video data is also solved.

The related methods of the embodiments of the present invention are described above. Based on the same inventive concept, the related apparatuses of the embodiments of the present invention are described below.

Referring to FIG. 8 , FIG. 8 is a schematic diagram of functional modules of a data security protection system and related devices provided by an embodiment of the present invention.

FIG. 8 shows an embodiment of the first terminal 1000 , the second terminal 1100 , the key server 1200 , and the storage server 1300 provided by an embodiment of the present invention, and a schematic structural diagram of a communication system formed by the four. As shown in FIG. 8, there may be communication connections between the first terminal 1000 and the key server 1200, the first terminal 1000 and the storage server 1300, the second terminal 1100 and the key server 1200, and the second terminal 1100 and the storage server 1300, For example, a wireless connection enables data communication between the above-mentioned devices. The description is expanded below.

As shown in FIG. 8 , the first terminal 1000 may include: an encryption/decryption module 1002 and a communication module 1003. In a possible embodiment, the first terminal may further include: a segmentation module 1001, and the encryption/decryption module 1002 may operate in the foregoing embodiment of FIG. 4 The described processor 4101 and the communication unit 1003 may be implemented by the radio frequency module 412 described in FIG. 4 , and the segmentation module 1001 may run on the processor 4101 described in the embodiment of FIG. 4 , wherein:

The communication module 1003 can be configured to send the first ciphertext information to the secret key server; the first ciphertext information is obtained by the first terminal encrypting the first password according to the public key from the secret key server;

The communication module 1003 can be configured to receive the second ciphertext information sent by the secret key server; the second ciphertext information is that the secret key server decrypts the first ciphertext according to the private key corresponding to the public key After obtaining the first password, the information is obtained by encrypting the second password of the key server according to the first password;

The encryption and decryption module 1002 can be configured to decrypt the second ciphertext information according to the first password to obtain the second password;

The communication module 1003 can be configured to send the data encrypted by the second password to the storage server.

In a possible embodiment, the data is video data, and the video data encrypted by the second password is used to be delivered to the second terminal through the storage server for decryption and playback.

In a possible embodiment, the segmentation module 1001 may be configured to obtain a plurality of video segment data according to the original video data before the communication module 1003 sends the video data encrypted by the second password to the storage server; Module 1003 may be configured to send the respective video segment data encrypted by the second password to the storage server.

In a possible embodiment, the video data encrypted by the second password is at least one video block data in the original video data.

In a possible embodiment, the segmentation module 1001 may be configured to perform segmentation processing on the original video data according to the segmentation rule information from the storage server to obtain the plurality of video segmentation data; the segmentation rule information is: It is determined according to the network bandwidth between the first terminal and the storage server.

In a possible embodiment, the communication module 1003 may be configured to receive an access password sent by the authentication server before the communication module 1003 sends the first ciphertext information to the key server; The login information of the terminal is generated; a request for obtaining the public key is sent to the secret key server; the request includes the access password; the access password is successfully verified on the secret key server through the authentication server In the case of receiving the public key sent by the key server.

In a possible embodiment, the communication module 1003 may be configured to send the access password to the key server while sending the first ciphertext information to the key server; correspondingly, the communication module 1003 may be configured to receive the The second ciphertext information sent by the secret key server specifically includes: the communication module 1003 can be configured to receive the information sent by the secret key server when the secret key server successfully verifies the access password through the authentication server. the second ciphertext information.

In a possible embodiment, the login information of the first terminal and the login information of the second terminal are the same.

In a possible embodiment, the first password is a password generated by the encryption/decryption module 1002 according to a random number.

As shown in FIG. 8 , the second terminal 1100 may include: a communication module 1101 and an encryption/decryption module 1102. In a possible embodiment, the first terminal may further include: a playback module 1103. The communication unit 1101 may use the radio frequency module 412 described in FIG. For implementation, the encryption/decryption module 1102 can run on the processor 4101 described in the embodiment of FIG. 4 , and the playback module 1103 can be realized by the display device 413 described in FIG. 4 , wherein:

The communication module 1101 can be configured to send the first ciphertext information to the secret key server; the first ciphertext information is obtained by the second terminal encrypting the first password according to the public key from the secret key server;

The communication module 1101 can be configured to receive the second ciphertext information sent by the secret key server; the second ciphertext information is that the secret key server decrypts the first ciphertext according to the private key corresponding to the public key After obtaining the first password, the information is obtained by encrypting the second password of the key server according to the first password;

The encryption and decryption module 1102 can be configured to decrypt the second ciphertext information according to the first password to obtain the second password of the key server;

The encryption and decryption module 1102 decrypts the encrypted data from the storage server according to the second password of the key server.

In a possible embodiment, the encrypted data is encrypted by the first terminal according to the second password of the key server and sent to the storage server.

In a possible embodiment, the encrypted data is the video data encrypted by the first terminal according to the second password of the key server; the playback module 1103 can be used in the encryption and decryption module 1102 according to the second password of the key server. , after decrypting the encrypted data from the storage server, and then playing the decrypted video data.

In a possible embodiment, the encrypted video data is obtained by encrypting each video block data in the original video data by the first terminal according to the second password.

In a possible embodiment, the encrypted video data is obtained by encrypting at least one video block data in the original video data by the first terminal according to the second password.

In a possible embodiment, the communication module 1101 may be configured to send an encrypted video to the storage server for obtaining an encrypted video before the encryption and decryption module 1102 decrypts the encrypted data from the storage server according to the second password of the key server. A request for segmented data; the encrypted video segmented data is a piece of the encrypted each video segmented data, and the one video segmented data is determined by the second terminal based on a user input instruction; The one encrypted video segment data is received from the storage server.

In a possible embodiment, the communication module 1101 may be configured to receive an access password sent by the authentication server before the second terminal sends the first ciphertext information to the key server; log-in information is generated; a request for obtaining the public key is sent to the secret key server; the request includes the access password; when the secret key server successfully verifies the access password through the authentication server Next, receive the public key sent by the key server.

In a possible embodiment, the communication module 1101 may be configured to send the access password to the key server while sending the first ciphertext information to the key server; correspondingly, the communication module 1101 may be configured to receive the The second ciphertext information sent by the secret key server specifically includes: the communication module 1101 can be configured to receive the information sent by the secret key server when the secret key server successfully verifies the access password through the authentication server. the second ciphertext information.

In a possible embodiment, the login information of the second terminal is the same as the login information of the first terminal.

As shown in FIG. 8 , the key server 1200 may include: a communication module 1201, and an encryption and decryption module 1202, wherein:

The communication module 1201 can be configured to receive the first ciphertext information sent by the terminal, where the first ciphertext information is obtained by the terminal encrypting the first password of the terminal according to the public key from the key server;

The encryption and decryption module 1202 can be configured to decrypt the first ciphertext information according to the private key corresponding to the public key to obtain the first password;

The communication module 1201 can be configured to send second ciphertext information to the terminal, where the second ciphertext information is obtained by encrypting the second password generated by the key server according to the first password, and the second ciphertext information is obtained by encrypting the second password generated by the key server according to the first password. The password is used for security protection of the data of the terminal.

In a possible embodiment, the data is video data, and the second password is used by the terminal to encrypt the video data and send it to a storage server.

In a possible embodiment, the data is video data, and the second password is used by the terminal to decrypt the encrypted video data from the storage server.

In a possible embodiment, the communication module 1201 may be configured to, before receiving the first ciphertext information sent by the terminal, receive a request sent by the terminal for obtaining the public key; the request includes an access password; the access password is The authentication server generates in advance according to the login information of the terminal and sends it to the terminal; when the access password is successfully verified by the authentication server, the public key is sent to the terminal.

In a possible embodiment, the communication module 1201 may be configured to receive the access password while receiving the first ciphertext information sent by the terminal; correspondingly, the communication module 1201 may be configured to send the second ciphertext information to the terminal , specifically: the communication module 1201 may be configured to send the second ciphertext information to the terminal when the authentication server successfully verifies the access password.

In a possible embodiment, the second password is a password generated by the encryption/decryption module 1202 according to a random number.

As shown in FIG. 8 , the storage server 1300 may include: a communication module 1301 and a storage module 1302, wherein:

The communication module 1301 can be configured to receive the data encrypted by the second password sent by the first terminal;

The communication module 1301 can be used to send the data encrypted by the second password to the second terminal;

The storage module 1302 may be configured to store the data encrypted by the second password sent by the first terminal in a database.

It should be noted that for the content not mentioned in the embodiment of FIG. 8 and the specific implementation of each functional module, please refer to the description of the embodiment of FIG. 6 and FIG. 7 , for example, in FIG. 6 , for the first terminal 1000, the encryption and decryption module 1002 is available In executing steps 602, 608, the communication module 1003 can be used to execute steps 601, 603, 607; for the second terminal 1100, the communication module 1101 can be used to execute steps 701, 703, 707, 709, and the encryption and decryption module 1102 can be used to execute step 702 , 708, 710; for the key server 1200, the communication module 1201 can be used to execute steps 601, 603, 607, 701, 703, 707, and the encryption and decryption module 1202 can be used to execute steps 604, 605, 606, 704, 705, 706; For the storage server 1300 , the communication module 1301 can be used to perform steps 609 and 709 , and the storage module 1302 can be used to store the encrypted data of step 609 . For the sake of brevity, details are not repeated here.

The following takes the embodiment of FIG. 6 as an example to describe in detail the cooperative relationship between each module in the first terminal 1000 and each module of the key server 1200 in this embodiment of the present invention, and each module in the second terminal 1100 and the key server 1200 For the cooperation relationship of each module in the embodiment of the present invention, please refer to FIG. 9 and FIG. 10 .

Referring to FIG. 9 , the following mainly describes the interaction process between each module inside the first terminal and each component inside the key server.

1401. The communication module 1003 sends a public key request to the communication module 1201.

1402. The communication module 1201 sends the public key to the communication module 1003.

1403. The encryption and decryption module 1002 generates a first password, and encrypts it according to the public key obtained from the communication module 1003 to obtain the first ciphertext information.

1404. The communication module 1003 sends the first ciphertext information to the communication module 1201.

1405. The encryption and decryption module 1202 decrypts the first ciphertext information according to the private key corresponding to the public key to obtain the first password.

1406. The encryption and decryption module 1202 encrypts the second password according to the first password to obtain second ciphertext information.

1407. The communication module 1201 sends the second ciphertext information to the communication module 1003.

1408. The encryption and decryption module 1002 decrypts the second ciphertext information according to the first password to obtain the second password.

1409. The encryption and decryption module 1002 sends the second password to the segmentation module 1001 inside the first terminal.

1410. The segmenting module 1001 segments the original video data to obtain multiple video segment data, and encrypts the multiple video segment data according to the second password.

1411. The communication module 1003 sends the video segment data encrypted by the second password to the storage server.

1412. The storage server stores encrypted video chunked data.

Referring to FIG. 10, the following mainly describes the interaction process between each module in the second terminal and each component in the key server.

1501. The communication module 1101 sends a public key request to the communication module 1201.

1502. The communication module 1201 sends the public key to the communication module 1101.

1503. The encryption and decryption module 1102 generates a first password, and encrypts it according to the public key obtained from the communication module 1101 to obtain the first ciphertext information.

1504. The communication module 1101 sends the first ciphertext information to the communication module 1201.

1505. The encryption and decryption module 1202 decrypts the first ciphertext information according to the private key corresponding to the public key to obtain the first password.

1506. The encryption and decryption module 1202 encrypts the second password according to the first password to obtain second ciphertext information.

1507. The communication module 1201 sends the second ciphertext information to the communication module 1101.

1508. The encryption and decryption module 1102 decrypts the second ciphertext information according to the first password to obtain the second password.

1509. The encryption/decryption module 1102 sends the second password to the playback module 1103 inside the second terminal 1100.

1510. The playback module 1103 sends a request for downloading video segmented data to the storage server through the communication module.

1511. The storage server sends the encrypted video segment data to the communication module 1101.

1512. The playback module 1101 decrypts the encrypted video block data according to the second password.

1513. The playback module 1101 plays the decrypted video segment data.

It should be noted that FIG. 9 is only an implementation manner of the embodiment of the present invention. In practical applications, the first terminal 1000 or the key server 1200 may further include more or less components, which are not limited here. FIG. 10 is only an implementation manner of the embodiment of the present invention. In practical applications, the second terminal 1100 or the key server 1200 may further include more or less components, which are not limited here.

The above-described embodiments may be implemented in whole or in part by software, hardware, firmware, or any combination. When implemented in software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions, and when the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer may be a general purpose computer, special purpose computer, computer network or other programmable device. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a network site, computer, server, or data center Transmission to another network site, computer, server, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line) or wireless (eg, infrared, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer, or may be a data storage device such as a server, a data center, or the like that includes one or more available media integrated. The usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes, etc.), optical media (eg, DVDs, etc.), or semiconductor media (eg, solid state drives), and the like.

In the above-mentioned embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference may be made to the relevant descriptions of other embodiments.

Claims (27)

1. a data security protection method, is characterized in that, comprises: The first terminal sends first ciphertext information to the secret key server; the first ciphertext information is obtained by the first terminal encrypting the first password according to the public key from the secret key server; The first terminal receives the second ciphertext information sent by the secret key server; the second ciphertext information is that the secret key server decrypts the first ciphertext according to the private key corresponding to the public key After obtaining the first password, the information is obtained by encrypting the second password of the key server according to the first password; The first terminal decrypts the second ciphertext information according to the first password to obtain the second password; The first terminal sends the data encrypted by the second password to the storage server. 2 . The method according to claim 1 , wherein the data is video data, and the video data encrypted by the second password is used for decrypting and decrypting and sending the encrypted video data to the second terminal through the storage server. 3 . play. 3. The method according to claim 2, wherein before the first terminal sends the video data encrypted by the second password to a storage server, the method further comprises: The first terminal obtains a plurality of video block data according to the original video data; Correspondingly, the first terminal sends the video data encrypted by the second password to the storage server, which specifically includes: The first terminal sends each video segment data encrypted by the second password to the storage server. 4. The method according to claim 2, wherein the video data encrypted by the second password is at least one video block data in the original video data. 5. The method according to claim 3, wherein the first terminal obtains a plurality of video block data according to the original video data, comprising: The first terminal performs segmentation processing on the original video data according to the segmentation rule information from the storage server, and obtains the plurality of video segmentation data; the segmentation rule information is based on the segmentation rule information from the first terminal. The network bandwidth with the storage server is determined. 6. The method according to any one of claims 1-5, wherein before the first terminal sends the first ciphertext information to the secret key server, the method further comprises: the first terminal receives an access password sent by the authentication server; the access password is generated by the authentication server according to the login information of the first terminal; The first terminal sends a request for obtaining the public key to the secret key server; the request includes the access password; The first terminal receives the public key sent by the key server when the access password is successfully verified by the key server through the authentication server. 7. The method of claim 6, wherein The first terminal also sends the access password to the secret key server while sending the first ciphertext information to the secret key server; Correspondingly, the first terminal receiving the second ciphertext information sent by the key server specifically includes: In the case that the access password is successfully verified by the key server through the authentication server, the first terminal receives the second ciphertext information sent by the key server. 8 . The method according to claim 2 , wherein the login information of the first terminal and the login information of the second terminal are the same. 9 . 9 . The method according to claim 1 , wherein the first password is a password generated by the first terminal according to a random number. 10 . 10. A data security protection method, comprising: The second terminal sends the first ciphertext information to the secret key server; the first ciphertext information is obtained by the second terminal encrypting the first password according to the public key from the secret key server; The second terminal receives the second ciphertext information sent by the secret key server; the second ciphertext information is that the secret key server decrypts the first ciphertext according to the private key corresponding to the public key After obtaining the first password, the information is obtained by encrypting the second password of the key server according to the first password; The second terminal decrypts the second ciphertext information according to the first password, and obtains the second password of the key server; The second terminal decrypts the encrypted data from the storage server according to the second password of the key server. The method according to claim 10, wherein the encrypted data is encrypted by the first terminal according to the second password of the key server and sent to the storage server. 12. The method according to claim 11, wherein the encrypted data is video data encrypted by the first terminal according to the second password of the key server; After decrypting the encrypted data from the storage server, the method further includes: the second terminal playing the decrypted video data. 13 . The method according to claim 12 , wherein the encrypted video data is obtained by respectively encrypting each video block data in the original video data by the first terminal according to the second password. 14 . The method according to claim 12, wherein the encrypted video data is obtained by encrypting at least one video block data in the original video data by the first terminal according to the second password. 15. The method according to claim 13, wherein before the second terminal decrypts the encrypted data from the storage server according to the second password of the secret key server, the method further comprises: The second terminal sends a request for obtaining an encrypted video segment data to the storage server; the encrypted video segment data is a piece of the encrypted video segment data, and the A piece of video block data is determined by the second terminal based on a user input instruction; The second terminal receives the one encrypted video segment data from the storage server. 16. The method according to any one of claims 10-15, wherein before the second terminal sends the first ciphertext information to the secret key server, the method further comprises: the second terminal receives the access password sent by the authentication server; the access password is generated by the authentication server according to the login information of the second terminal; The second terminal sends a request for obtaining the public key to the secret key server; the request includes the access password; In the case that the access password is successfully verified by the key server through the authentication server, the second terminal receives the public key sent by the key server. 17. The method of claim 16, wherein: The second terminal also sends the access password to the key server while sending the first ciphertext information to the key server; Correspondingly, the second terminal receiving the second ciphertext information sent by the key server specifically includes: In the case that the access password is successfully verified by the key server through the authentication server, the second terminal receives the second ciphertext information sent by the key server. The method according to any one of claims 11-17, wherein the login information of the second terminal is the same as the login information of the first terminal. 19. A data security protection method, comprising: The secret key server receives the first ciphertext information sent by the terminal, where the first ciphertext information is obtained by the terminal encrypting the first password of the terminal according to the public key from the secret key server; The secret key server decrypts the first ciphertext information according to the private key corresponding to the public key to obtain the first password; The secret key server sends second ciphertext information to the terminal, where the second ciphertext information is obtained by encrypting the second password generated by the secret key server according to the first password, and the second ciphertext information is obtained by encrypting the second password generated by the secret key server according to the first password. The password is used for security protection of the data of the terminal. 20 . The method according to claim 19 , wherein the data is video data, and the second password is used by the terminal to encrypt the video data and send it to a storage server. 21 . 21. The method according to claim 19, wherein the data is video data, and the second password is used by the terminal to decrypt the encrypted video data from a storage server. 22. The method according to any one of claims 19-21, wherein before the key server receives the first ciphertext information sent by the terminal, the method further comprises: The secret key server receives the request sent by the terminal for obtaining the public key; the request includes an access password; the access password is pre-generated by the authentication server according to the login information of the terminal and sent to the terminal of; In the case that the key server successfully verifies the access password through the authentication server, the key server sends the public key to the terminal. 23. The method of claim 22, wherein The key server also receives the access password while receiving the first ciphertext information sent by the terminal; Correspondingly, the secret key server sends the second ciphertext information to the terminal, specifically: In the case that the key server successfully verifies the access password through the authentication server, the key server sends the second ciphertext information to the terminal. 24. The method according to any one of claims 19-23, wherein the second password is a password generated by the key server according to a random number. 25. A terminal used as a first terminal, comprising a display device, an input device, an output device, one or more memories, and one or more processors; wherein the one or more memories store a or more programs; characterized in that, when the one or more processors are executing the one or more programs, the terminal is caused to implement the method according to any one of claims 1 to 9. 26. A terminal used as a second terminal, comprising a display device, an input device, an output device, one or more memories, and one or more processors; wherein the one or more memories store a or more programs; characterized in that, when the one or more processors are executing the one or more programs, the terminal is caused to implement the method according to any one of claims 10 to 18 . 27. A server, comprising an input device, an output device, one or more memories, and one or more processors; wherein the one or more memories store one or more programs; The one or more processors, when executing the one or more programs, cause the server to implement the method of any one of claims 19 to 24.