CN102567673A - Data safety protection method and device - Google Patents

Abstract

The invention provides a data security protection method and device. It involves the application field of computer technology; it solves the problem that existing data security methods cannot guarantee data security. The method includes: when a user creates a data protection task, searching for a public key corresponding to the user, and assigning the public key obtained through the search to the data protection task for encryption; and performing data transmission in the data protection task , the data is encrypted using the public key corresponding to the user. The technical scheme provided by the invention is suitable for large-capacity data storage, and realizes a high-safety data storage and recovery mechanism.

Description

Data security protection method and device

technical field

The invention relates to the application field of computer technology, in particular to a data security protection method and device.

Background technique

In today's information and networked society, computers are playing an increasingly important role in our work and life. More and more enterprises, merchants, government agencies and individuals use computers to obtain and process information, and at the same time save their most important information in the form of data files in the computer. Once a disaster occurs to these important data, it will cause an enterprise to stop functioning, and if the data is lost, an enterprise may face bankruptcy. As a result, people began to pay attention to how to ensure the integrity of data, and data protection technology is the only solution.

The existing data recovery technology uses multiple backup data to achieve the purpose of rapid recovery, but does not take any storage security measures for the backup data, and there are hidden dangers in data storage security; at the same time, it requires a link between local and remote The frequent interaction between the two networks results in a large amount of network transmission, which not only delays the data recovery time, but also brings hidden dangers to transmission security. In this case, the data to be protected and restored can be encrypted to improve the security of data protection, but this method is consistent for all data. That is to say, the privacy of different backup data is not considered. The final backup data can be accessed on the backup server. In fact, the data backed up by the client may protect the customer’s sensitive data such as bank account information. Back up and restore by yourself, and don't want to be viewed arbitrarily on the backup server. Therefore, the existing data security methods cannot guarantee the real security of client data.

Contents of the invention

The invention provides a data security protection method and device, which solves the problem that the existing data security methods cannot guarantee data security.

A data security protection method, comprising:

When a user creates a data protection task, look up the public key corresponding to the user, and assign the public key obtained from the search to the data protection task for encryption;

When data is sent in the data protection task, the data is encrypted with the public key corresponding to the user.

Preferably, the above data security protection method also includes:

generating a public key and a private key for the user when the user registers for the first time;

An association relationship is established between the public key and the user, and the private key is sent to the client of the user for storage.

Preferably, the above data security protection method also includes:

Back up the sent data;

Record the backed up data in a recoverable data list.

Preferably, the above data security protection method also includes:

When the user chooses to restore the data in the recoverable data list, obtain the user's private key;

matching the private key of the user with the public key corresponding to the user;

When the matching is successful, the data selected by the user is restored.

Preferably, restoring the data selected by the user is specifically as follows:

The data is decrypted by the private key, and the data is restored to the location specified by the user.

The present invention also provides a data security protection device, comprising:

The public key management module is used to search for the public key corresponding to the user when the user creates a data protection task, and assign the public key obtained by the search to the data protection task for encryption;

The data encryption module is used to encrypt the data by using the public key corresponding to the user when sending data in the data protection task.

Preferably, the above-mentioned data security protection device also includes:

The key generation module is used to generate a public key and a private key for the user when the user registers for the first time, establish an association relationship between the public key and the user, and use the private key Sent to the user's client save.

Preferably, the above-mentioned data security protection device also includes:

The backup module is used to back up the sent data, and record the backed up data in a recoverable data list.

Preferably, the above-mentioned data security protection device also includes:

A data recovery module, configured to obtain the user's private key when the user selects to restore the data in the recoverable data list, and match the user's private key with the corresponding public key of the user, and then When the matching is successful, the data selected by the user is restored.

The present invention provides a method and device for data security protection. When a user creates a data protection task, the public key corresponding to the user is searched, and the public key obtained from the search is assigned to the data protection task for encryption. When sending data in the data protection task, the data is encrypted through the public key corresponding to the user, and the encryption is completed through the public key corresponding to a single user, which enhances the security of the data and solves the problem of existing data security. The problem of data security cannot be guaranteed by the method.

Description of drawings

FIG. 1 is a flowchart of a data security protection method provided by Embodiment 1 of the present invention;

FIG. 2 is a schematic structural diagram of a data security protection device provided by Embodiment 2 of the present invention;

FIG. 3 is a schematic structural diagram of a data security protection system provided by Embodiment 3 of the present invention;

FIG. 4 is a flowchart of a data security protection method provided by Embodiment 3 of the present invention.

Detailed ways

Encrypting the data to be protected and restored can improve the security of data protection, but this method is consistent for all data. That is to say, the privacy of different backup data is not considered. The final backup data can be accessed on the backup server. In fact, the data backed up by the client may protect the customer’s sensitive data such as bank account information. Back up and restore by yourself, and don't want to be viewed arbitrarily on the backup server. Therefore, the existing data security methods cannot guarantee the real security of client data.

In order to solve the above problems, embodiments of the present invention provide a data security protection method and device. Embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined arbitrarily with each other.

First, Embodiment 1 of the present invention will be described with reference to the accompanying drawings.

The embodiment of the present invention provides a method for data security protection. The process of encrypting and recovering data using this method is shown in Figure 1, including:

Step 101, when the user registers for the first time, generate a public key and a private key for the user;

In this step, when the user registers the data protection system for the first time, the system generates a public key and a private key for the user.

Step 102, establishing an association relationship between the public key and the user, and sending the private key to the user's client for storage;

For the key generated in step 101, the user's public key is stored on the data protection system server, and the user's private key is downloaded to the client and stored by the user.

Step 103. When a user creates a data protection task, search for the public key corresponding to the user, and assign the obtained public key to the data protection task for encryption;

In this step, when a user creates a data protection task, the system specifies to use the user's public key for the data encryption of this task according to the user name.

Step 104. When sending data in the data protection task, encrypt the data with the public key corresponding to the user;

In this step, when the file of the protected data is sent for modification, the user public key is used to encrypt the changed data, so as to achieve data storage security.

Step 105, back up the sent data, and record the backed up data in a recoverable data list;

In this step, the data protected through network transmission is backed up, and the data is saved on the server side of the data protection system to complete the data protection process. At the same time, create a list of recoverable data, and record the backed up data in the list of recoverable data.

Step 106, when the user chooses to restore the data in the recoverable data list, obtain the user's private key;

In this step, the user browses the backed-up recoverable data list according to the protection task created by the user, selects the data to be restored, and submits the corresponding private key at the same time.

Step 107, matching the private key of the user with the public key corresponding to the user;

In this step, the system matches the private key with the encrypted public key of the restored data. If the match is successful, the data recovery process is performed; otherwise, no recovery is performed.

In the embodiment of the present invention, when restoring data, the private key is generally used for decryption and the data is restored to a location specified by the user.

Embodiment 2 of the present invention will be described below with reference to the accompanying drawings.

An embodiment of the present invention provides a data security protection device, the structure of which is shown in Figure 2, including:

The public key management module 201 is configured to search for the public key corresponding to the user when the user creates a data protection task, and assign the public key obtained from the search to the data protection task for encryption;

The data encryption module 202 is configured to encrypt the data by using the public key corresponding to the user when sending data in the data protection task.

Preferably, the above-mentioned data security protection device also includes:

The key generation module 203 is used to generate a public key and a private key for the user when the user registers for the first time, establish an association relationship between the public key and the user, and convert the private key to the user. The key is sent to the user's client for storage.

Preferably, the above-mentioned data security protection device also includes:

The backup module 204 is configured to back up the sent data, and record the backed up data in a recoverable data list.

Preferably, the above-mentioned data security protection device also includes:

The data recovery module 205 is configured to obtain the user's private key when the user selects to restore the data in the recoverable data list, and match the user's private key with the corresponding public key of the user, When the matching is successful, the data selected by the user is restored.

Embodiment 3 of the present invention will be described below with reference to the accompanying drawings.

The embodiment of the present invention provides a data security protection system, the structure of which is shown in Figure 3. A general data protection system includes a data protection client and a data protection server, and the data protection client mainly runs on the protected server The data protection system saves the data to be protected to the data protection server through the network through the backup protection client. The data protection server is mainly used to store the data protected by users, and at the same time generate their own public and private keys for encrypting and decrypting data for users.

The embodiment of the present invention also provides a data security protection method. Based on the above data security protection system, the process of implementing data security protection is shown in Figure 4, including:

Step 401. Generate a private key and a public key when the user registers: when the user registers the data protection system, the system automatically generates a public key and a private key for the user, the public key is used for data encryption of the user's data protection task, and the private key Data decryption for user protection tasks.

Step 402, user-created task designation is encrypted with the user's public key: each user can create multiple different data protection tasks, and each task adopts the same public key encryption method for each user.

Step 403: Encrypt the backup data with the user's public key: the data protection client encrypts the changed data with the public key of the task when performing data protection, that is, the public key of the user who created the task.

Step 404: Protect the encrypted data through the network: the client transmits the data encrypted with the user's public key to the server through the network, and saves it.

Step 405. User browses the protected data: the user can browse the completed data protection tasks in the system, mainly to protect some basic information of this data protection task, such as start and end time, data size, source, but cannot browse the data Content.

Step 406, the user provides the corresponding private key when choosing to restore: when choosing to restore the protected data, require

The user provides a personal private key, and only the system matches the private key with the encrypted public key for recovering data. If the match is successful, the data recovery process will be performed, otherwise the data will not be recovered.

Step 407, recovering data through the user's private key: if the private key is verified to be correct, the system recovers the encrypted data through the user's private key.

The data security protection method provided by the embodiment of the present invention can be combined with the data security protection device and the data security protection system provided by the embodiment of the present invention. Key, assign the public key obtained from the search to the data protection task for encryption. When sending data in the data protection task, the data is encrypted with the public key corresponding to the user. The public key corresponding to the user is encrypted, which enhances the security of the data and solves the problem that the existing data security methods cannot guarantee data security.

By adopting the private key and public key of different users for the protected data, the security policy control of the data protection system is realized, so as to ensure that the user data is not browsed by others on the data protection server, thereby ensuring the privacy of the user data and real data security.

Those of ordinary skill in the art can understand that all or part of the steps of the above-mentioned embodiments can be implemented using a computer program flow, the computer program can be stored in a computer-readable storage medium, and the computer program can be run on a corresponding hardware platform (such as system, device, device, device, etc.), and when executed, includes one or a combination of the steps of the method embodiment.

Optionally, all or part of the steps in the above embodiments can also be implemented using integrated circuits, and these steps can be fabricated into individual integrated circuit modules, or multiple modules or steps among them can be fabricated into a single integrated circuit module accomplish. As such, the present invention is not limited to any specific combination of hardware and software.

The devices/functional modules/functional units in the above embodiments can be realized by general-purpose computing devices, and they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices.

When each device/functional module/functional unit in the above-mentioned embodiments is realized in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. The computer-readable storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, and the like.

Any person familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present invention, and all should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope described in the claims.

Claims (9)

1. a data security protection method is characterized in that, comprising:

When the user creates the data protection task, search the pairing PKI of said user, the said PKI of searching acquisition is specified to said data protection task encrypt use;

When in said data protection task, carrying out the data transmission,, data are encrypted through the PKI corresponding with said user.

2. data security protection method according to claim 1 is characterized in that, this method also comprises:

When said user registers for the first time, for said user generates a PKI and a private key;

Between said PKI and said user, set up incidence relation, said private key is sent to said user client preserve.

3. data security protection method according to claim 1 is characterized in that, this method also comprises:

Data to sending back up;

But backed up data is recorded among the restore data tabulation.

4. data security protection method according to claim 3 is characterized in that, this method also comprises:

During the data among but the user chooses the said restore data tabulation of recovery, obtain said user's private key;

Said user's private key and the pairing PKI of said user are mated;

When mating successfully, the data that said user chooses are recovered.

5. data security protection method according to claim 4 is characterized in that, the data that said user chooses are recovered to be specially:

Through said private key said data are deciphered, and said data are returned to said user's appointed positions.

6. a data security protecting device is characterized in that, comprising:

The public key management module is used for when the user creates the data protection task, searches the pairing PKI of said user, the said PKI of searching acquisition is specified to said data protection task encrypt use;

Data encryption module is used for when said data protection task is carried out the data transmission, through the PKI corresponding with said user, data being encrypted.

7. data security protecting device according to claim 6 is characterized in that, this device also comprises:

Key production module is used for when said user registers for the first time, for said user generates a PKI and a private key, between said PKI and said user, sets up incidence relation, said private key is sent to said user client preserve.

8. data security protecting device according to claim 6 is characterized in that, this device also comprises:

Backup module be used for the data of sending are backed up, but backed up data is recorded among the restore data tabulation.

9. data security protecting device according to claim 8 is characterized in that, this device also comprises:

Data recovery module; Be used for when but the user chooses the data of recovering among the said restore data tabulation, obtaining said user's private key, said user's private key and the pairing PKI of said user mated; When mating successfully, the data that said user chooses are recovered.

Images