CN115396185A - Scientific research data sharing system, method and medium based on encryption - Google Patents

Abstract

The present disclosure relates to an encryption-based scientific research data sharing system, method, and medium. The system comprises local equipment and a server, wherein the local equipment comprises an encryption algorithm module and a server software module, the encryption algorithm module is used for encrypting a data plaintext of a first local fixed path to generate a data ciphertext and storing the data ciphertext to a second local fixed path, and storing a first secret key used for encryption to a local third fixed path; the server software module is used for uploading the data ciphertext in the second local fixed path to the server within the set fixed time; the server is used for acquiring the data ciphertext in the second local fixed path; the login request of the appointed user of the assigned account is received, and the access of the fourth storage position is allowed according to the account authority.

Description

An encryption-based scientific research data sharing system, method and medium

technical field

The present disclosure relates to the field of scientific research data management, in particular to an encryption-based scientific research data sharing system, method and medium.

Background technique

Existing scientific research management systems usually use open or local LAN systems for management. For example, large companies usually have their own servers to manage the entire process of scientific research, and are isolated from the external network in order to realize the research and development process and results. However, the scientific research process and scientific research results of universities are generally stored locally, which is difficult to share, and there are also security risks, such as irreparable damage to computer hardware or leaks by unrelated personnel, etc., and the personnel involved in scientific research Instability, such as turnover caused by resignation, makes project tracking management slack, and scientific research information and results are difficult to manage. The existing scientific research management system is more about process management, but it is not very useful for the promotion and application of results. Can not provide decision-making basis for the unit.

For this reason, some third-party scientific research management systems have appeared in the existing technology, such as the all-round scientific research management information system purchased by universities and embedded in the university management system. This information system usually assigns accounts to leaders or managers at all levels. , and scientific researchers need to upload scientific research progress or results to the information system, and leaders or managers at all levels can log in to the account to view or manage the scientific research progress or results. However, once the account is assigned, different people will have the authority to Data operations, and even the safe use of accounts cannot be guaranteed, which makes it difficult to manage. Although there are login and browsing records, the security of key data, information or results is still difficult to guarantee. The motivation of scientific researchers to upload scientific research results or processes to the information system is not strong.

Contents of the invention

To this end, this disclosure provides an encryption-based scientific research data sharing system, method, and medium. Under the condition of ensuring data security, the server is used to track and evaluate the scientific research process, phased results or final results, so that scientific researchers can The control of data security is stronger, which is convenient for authorized third-party managers to view, and it is also beneficial for scientific research participants to realize data sharing while ensuring data security. The present disclosure provides the following technical solutions to solve the above technical problems:

As an aspect of the embodiments of the present disclosure, an encryption-based scientific research data sharing system is provided, including:

The local device includes an encryption algorithm module and a server software module, the encryption algorithm module is used to encrypt the data plaintext of the first local fixed path to generate data ciphertext and save it to the second local fixed path, and store the first secret used for encryption The key is saved to the local third fixed path; the server software module is used to upload the data ciphertext in the second local fixed path to the server within the set fixed time;

The server is configured to obtain the data ciphertext in the second local fixed path; save the data ciphertext to the fourth storage location, and feed back the fourth storage location to the local device; the server assigns the specified user Accounts with different permissions are divided into accounts with read-write permissions, accounts with writable permissions, and accounts with readable permissions. Among them, accounts with read-write permissions can read and write data ciphertext stored in the server after logging in. Write, the writable permission account can write the data ciphertext but does not need to read and modify, the readable permission account can realize the reading and viewing of data but does not allow copying, modification and writing; Assigning a login request to the designated user of the account and allowing access to the fourth storage location according to the account authority.

Optionally, the local device further includes an authorized periodic deletion module, configured to associate the data ciphertext in the fourth storage location stored in the server with the first secret key, and store the Asymmetrically encrypt the first secret key to obtain the second secret key, send the second secret key to the fourth storage location of the server according to the application approval status, and decrypt the asymmetrically encrypted third secret key of the second secret key Authorized to a designated user for a limited time.

Optionally, the specified user logs in to the access server within a limited time, decrypts the second key according to the third key to obtain the first key to decrypt the corresponding data ciphertext to obtain the data plaintext, and decrypts the data ciphertext The plaintext data of the text is temporarily stored in the server for access, and the second key and the plaintext data temporarily stored in the server are deleted after the specified time expires or after the specified user issues an instruction to end the access.

As another aspect of the embodiments of the present disclosure, an encryption-based scientific research data sharing method is provided, which is applied to a local device, and is characterized in that it includes the following steps:

Encrypting the data plaintext of the first local fixed path to generate the data ciphertext is saved to the second local fixed path, and the first secret key used for encryption is saved to the third local fixed path;

uploading the data ciphertext in the second local fixed path to the server within the set fixed time;

The data ciphertext storage path fed back by the server is corresponding to the first secret key and then stored in a local third fixed path.

Optionally, after receiving the data ciphertext storage path fed back by the server corresponding to the first secret key and storing it in the local third fixed path, the following steps are further included:

performing asymmetric encryption on the first secret key to obtain a second secret key;

Sending the second secret key to the fourth storage location of the server according to the application approval status;

Authorize the asymmetrically encrypted third key for decrypting the second key to a designated user for use within a limited time;

After the end of the limited time or after receiving an instruction from the specified user to view the end, issue an instruction to delete the data plaintext and the second secret key in the server.

Optionally, encrypting the data plaintext of the first local fixed path to generate the data ciphertext adopts a symmetric encryption algorithm.

As another aspect of the embodiments of the present disclosure, an encryption-based scientific research data sharing method is provided, which is applied to a server and includes the following steps:

Receiving the data ciphertext encrypted by the local device, storing the data ciphertext in a fourth storage location, and sending the data ciphertext storage path of the fourth storage location to the local device;

According to the approval status of the application, multiple accounts with different permissions are assigned to designated users, which are divided into accounts with read-write permissions, accounts with write permissions, and accounts with read permissions. Among them, accounts with read-write permissions can be saved in the server after logging in. The ciphertext of the data can be read and written. The writable permission account can write the data ciphertext but does not need to read and modify it. The readable permission account can realize the reading and viewing of the data but does not allow copying , modification and writing;

Receive the second secret key and the data ciphertext storage path sent by the local device, authorize the access right of the specified user after logging in and allow access to the storage path consistent with the data ciphertext storage path;

Decrypting the second key into the first key according to the third key, decrypting the data ciphertext into data plaintext according to the first key, and caching the data plaintext for viewing by a designated user.

Optionally, after decrypting the data ciphertext into data plaintext according to the first secret key, and caching the data plaintext for viewing by a specified user, the following steps are further included:

Receive an instruction to delete the data plaintext and the second secret key from the local device;

The data plaintext and the secret key are deleted according to the instruction for deleting the data plaintext and the secret key.

Optionally, after assigning multiple accounts with different permissions to the designated user according to the application approval status, the following steps are also included:

Assign access rights and access locations according to the login status of assigned accounts with different permissions; the access location is determined by the received data ciphertext storage path sent by the local device.

As another aspect of the embodiments of the present disclosure, there is provided a computer-readable storage medium on which a computer program is stored, wherein when the program is executed by a processor, the steps of the above encryption-based scientific research data sharing method are implemented .

The beneficial effects of the present disclosure are as follows: the present disclosure adopts the local device to encrypt the scientific research data in the fixed path according to the encryption algorithm and uploads it to the server. The key is sent to the storage location of the server visible to the designated user after logging in, and the designated user can view the decrypted scientific research data within the set time. Through the system or method in the present disclosure, scientific research personnel can be authorized to view scientific research data within a specific authority after the results are shared. It can also be shared in the public domain through limited authorization. Under the condition of ensuring the safety of scientific research results, it can assist the decision-making of management or researchers, and also guide the development direction of the industry.

Description of drawings

FIG. 1 is a workflow diagram of an encryption-based scientific research data sharing system in an embodiment of the present disclosure;

FIG. 2 is a flowchart of an encryption-based scientific research data sharing method applied to a local device in Embodiment 2 of the present disclosure;

FIG. 3 is a flowchart of an encryption-based scientific research data sharing method applied to a server in Embodiment 3 of the present disclosure;

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present disclosure with reference to the accompanying drawings in the embodiments of the present disclosure. Apparently, the described embodiments are only some of the embodiments of the present disclosure, not all of them. Based on the embodiments in the present disclosure, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present disclosure.

Example 1

As an aspect of the embodiments of the present disclosure, an encryption-based scientific research data sharing system is provided, as shown in Figure 1, including a local device and a server, wherein the local device includes an encryption algorithm module, a server software module and an authorized periodic deletion module, so The encryption algorithm module is used to encrypt the data plaintext of the first local fixed path to generate data ciphertext and save it to the second local fixed path, and save the first secret key used for encryption to the local third fixed path; the server software The module is used to upload the data ciphertext in the second local fixed path to the server within the set fixed time; the local device also includes an authorized periodical deletion module, and the authorized periodical deletion module is used to The data ciphertext in the fourth storage location stored in the server corresponds to the first secret key, asymmetrically encrypts the first secret key to obtain a second secret key, and sends the second secret key according to the application approval status to the fourth storage location of the server, and authorize the designated user to use the asymmetrically encrypted third key for decrypting the second key for a limited time.

In some embodiments, the local device may be a computing device such as a desktop computer, a notebook, or a local server. The encryption algorithm module can be a software module or a hardware encryption module that realizes a symmetric encryption algorithm, and the symmetric encryption algorithm can be a DES (Data Encryption Standard) encryption algorithm, that is, 64-bit plaintext is used as the input of DES to generate a 64-bit encryption algorithm. Text output can also be symmetric encryption algorithms such as AES (Advanced Encryption Standard) encryption algorithm, SM1 symmetric encryption algorithm (this algorithm needs to be called through the interface of the encryption chip) and other symmetric encryption algorithms. The use of symmetric encryption algorithms for data plaintext can make the encryption speed fast.

In some embodiments, the server software module is software that is compatible with the server and can run on the local device. According to different server operators, it can be set to store in a fixed path within a fixed time. Data transfer/backup to the server. For example, Baidu Netdisk can back up files with a fixed path to the set location of Baidu Cloud Disk at regular intervals.

In some embodiments, the authorized periodical deletion module can at least realize the following functions:

(1) as the master device (Master) to control and complete the account allocation in the server;

(2) Encrypt the first secret key in the local third fixed path into a second secret key through an asymmetric encryption algorithm, and the decryption key of the second secret key (used by the asymmetric encryption algorithm) is the third secret key; The asymmetric encryption algorithm used can be RSA algorithm, ECC algorithm or SM2 algorithm;

(3) Assigning server access accounts and third secret keys to designated users;

(4) Send the second secret key to the storage location of the data ciphertext corresponding to it, that is, the fourth storage location;

(5) Monitor and record the access records of the designated user, and delete the data plaintext and the second secret key within a limited time or after receiving an instruction from the designated user to view the end.

Wherein, the server is used to obtain the data ciphertext in the second local fixed path; and save the data ciphertext to the fourth storage location, and feed back the fourth storage location to the local device; the server is a designated user Assign multiple accounts with different permissions, which are divided into accounts with read-write permissions, accounts with writable permissions, and accounts with readable permissions. Among them, accounts with read-write permissions can read the data ciphertext stored in the server after logging in. and write, the writable permission account can write the data ciphertext but does not need to read and modify, the readable permission account can realize the reading and viewing of data but does not allow copying, modification and writing; receive The designated user who is assigned an account requests to log in and allows access to the fourth storage location according to the account authority.

In some embodiments, the server is a third-party server, such as cloud disks such as Baidu Cloud and Tencent Cloud, and functions such as account allocation and operation of decrypting ciphertext using a secret key need to be opened for corresponding permissions.

In this embodiment, the data ciphertext is stored in the third-party server, and the function that the data ciphertext cannot be copied and edited can be realized through the account function setting. Similarly, after the data ciphertext is decrypted by the third key, the first key When the key decrypts the data ciphertext and the plaintext of the data is stored in the server, it is also non-copyable and non-editable.

In some embodiments, the server can accept the account login of the designated user and automatically jump to the fourth storage location where the data ciphertext is stored. The third secret key is used for decryption. After obtaining the first secret key, the ciphertext of the data can be decrypted to obtain the plaintext of the data that can be viewed. In the embodiment of the present disclosure, a symmetric encryption algorithm is used to encrypt the data plaintext to obtain the first secret key, and then the first secret key to decrypt the data ciphertext is encrypted. This encryption and decryption method can not only ensure the decryption speed, but also ensure the key It is more difficult to crack, ensuring data security.

In some embodiments, the specified user logs in to the access server within a limited time, decrypts the second key according to the third key to obtain the first key to decrypt the corresponding data ciphertext to obtain the data plaintext, and decrypts the The data plaintext of the data ciphertext is temporarily stored in the server for access, and the second key and the data plaintext temporarily stored in the server are deleted after the specified time expires or after the specified user issues an instruction to end the access.

Example 2

As another aspect of the embodiments of the present disclosure, an encryption-based scientific research data sharing method is provided, which is applied to a local device, as shown in FIG. 2 , including the following steps:

S110. Encrypt the data plaintext of the first local fixed path to generate data ciphertext and store it in the second local fixed path, and save the first secret key used for encryption in the local third fixed path;

S120. Upload the data ciphertext in the second local fixed path to the server within a set fixed time;

S130. Receive the data ciphertext storage path fed back by the server corresponding to the first key and store it in a third local fixed path.

In some embodiments, after receiving the data ciphertext storage path fed back by the server corresponding to the first secret key and storing it in the local third fixed path, the following steps are further included:

S140. Perform asymmetric encryption on the first secret key to obtain a second secret key;

S150. Send the second secret key to the fourth storage location of the server according to the application approval status;

S160. Authorize the asymmetrically encrypted third key for decrypting the second key to a designated user for use within a limited time;

S170. Send an instruction to delete the data plaintext and the second secret key in the server after the end of the limited time or after receiving an instruction from the designated user to end viewing.

In some embodiments, encrypting the data plaintext of the first local fixed path to generate the data ciphertext adopts a symmetric encryption algorithm. In the embodiment of the present disclosure, a symmetric encryption algorithm is used to encrypt the data plaintext to obtain the first secret key, and then the first secret key to decrypt the data ciphertext is encrypted. This encryption and decryption method can not only ensure the decryption speed, but also ensure the key It is more difficult to crack, ensuring data security.

Example 3

As another aspect of the embodiments of the present disclosure, an encryption-based scientific research data sharing method is provided, which is applied to a server, as shown in FIG. 3 , including the following steps:

S210. Receive the data ciphertext encrypted by the local device, store the data ciphertext in a fourth storage location, and send the data ciphertext storage path of the fourth storage location to the local device;

S220. Assign multiple accounts with different permissions to the designated user according to the application approval situation, which are divided into accounts with readable and writable permissions, accounts with writable permissions, and accounts with readable permissions. The data ciphertext in the server is read and written. The writable account can write the data ciphertext but does not need to read and modify it. The readable account can read and view the data but not Copying, modification and writing are permitted;

S230. Receive the second secret key and the data ciphertext storage path sent by the local device, authorize the access right of the designated user after logging in and allow access to the storage path consistent with the data ciphertext storage path;

S240. Decrypt the second key into the first key according to the third key, decrypt the data ciphertext into data plaintext according to the first key, and cache the data plaintext for viewing by a specified user.

In some embodiments, after decrypting the data ciphertext into data plaintext according to the first secret key, and caching the data plaintext for viewing by a specified user, the following steps are further included:

S250. Receive an instruction from the local device to delete the data plaintext and the second secret key;

S260. Delete the data plaintext and the secret key according to the instruction for deleting the data plaintext and the secret key.

In some embodiments, after assigning multiple accounts with different permissions to the designated user according to the application approval situation, the following steps are further included:

Assign access rights and access locations according to the login status of assigned accounts with different permissions; the access location is determined by the received data ciphertext storage path sent by the local device.

Example 4

As another aspect of the embodiments of the present disclosure, an encryption-based scientific research data sharing method is provided, which is applied to local devices and servers, as shown in FIG. 1 , including the following steps:

S1. Obtain the plaintext of the data and encrypt the plaintext of the data;

S2. Encrypt the data plaintext of the first local fixed path to generate data ciphertext and store it in the second local fixed path, and save the first secret key used for encryption in the local third fixed path;

S3. Upload the data ciphertext in the second local fixed path to the server within a set fixed time;

S4. Receive the data ciphertext encrypted by the local device, store the data ciphertext in a fourth storage location, and send the data ciphertext storage path of the fourth storage location to the local device;

S5. Obtain the first secret key and use an asymmetric encryption algorithm to encrypt the first secret key to obtain a second secret key, and save the third secret key used by the asymmetric encryption algorithm when encrypting the first secret key; Designate the user to assign the account number and the third secret key for logging in to the server;

S6. Upload the second secret key to the fourth storage location;

S7. The designated user logs in to the server account, and accesses the fourth storage location, wherein the fourth storage location has been associated with the account when the account is assigned, that is, the assigned account can only access the fourth storage location of the server;

S8. The designated user decrypts the second secret key uploaded in S6 according to the third secret key distributed by the local device to obtain the first secret key;

S9. Decrypt the data ciphertext according to the first secret key into data plaintext;

S10. The specified user checks the data plaintext in the server according to the user authority;

S11. When the limited time expires or the designated user sends an end-of-view instruction, the server executes the deletion of the data plaintext and the second secret key after receiving the post-deletion instruction.

Through the above steps, the encryption of the data plaintext and the decryption of the data ciphertext and the viewing of the data plaintext authorized to a designated user in the server can be realized, so as to realize the security management and tracking of scientific research data; in addition, as another embodiment of the present disclosure In this way, the authority of the account can also be set to read and write, then the local storage and update of the data plaintext can be realized, and then the data plaintext can be encrypted and uploaded through the local device, so that the scientific research data can be realized. Supplement and update, using this system can also realize the automatic backup and update of scientific research data, that is, the data plaintext, while in the third-party server, it maintains authorized viewing and reading and writing, and the plaintext of the data when viewing can also be based on the viewing time or whether it is At the end, the data plaintext and secret key are deleted, which can realize the automatic management of scientific research data.

Example 5

This embodiment provides a computer-readable storage medium, the readable storage medium stores a computer program, and when the program is executed by a processor, the encryption-based scientific research data sharing method in any one of embodiments 1-3 is implemented. step.

Wherein, the readable storage medium may more specifically include but not limited to: portable disk, hard disk, random access memory, read-only memory, erasable programmable read-only memory, optical storage device, magnetic storage device or any of the above-mentioned the right combination.

In a possible implementation manner, the present disclosure may also be implemented in the form of a program product, which includes program code, and when the program product is run on a terminal device, the program code is used to make the terminal device execute The steps of the encryption-based scientific research data sharing method in any one of Embodiments 1-3.

Wherein, the program code for executing the present disclosure may be written in any combination of one or more programming languages, and the program code may be completely executed on the user equipment, partially executed on the user equipment, or used as an independent The package executes, partly on the user device and partly on the remote device, or entirely on the remote device.

Although the embodiments of the present disclosure have been shown and described, those skilled in the art can understand that various changes, modifications and substitutions can be made to these embodiments without departing from the principle and spirit of the present disclosure. and modifications, the scope of the present disclosure is defined by the appended claims and their equivalents.

Claims (10)

1. An encryption-based scientific research data sharing system, comprising:

the local equipment comprises an encryption algorithm module and a server software module, wherein the encryption algorithm module is used for encrypting a data plaintext of a first local fixed path to generate a data ciphertext and storing the data ciphertext to a second local fixed path, and storing a first secret key used for encryption to a local third fixed path; the server software module is used for uploading the data ciphertext in the second local fixed path to the server within the set fixed time;

the server is used for acquiring a data ciphertext in the second local fixed path; storing the data ciphertext to a fourth storage position, and feeding the fourth storage position back to the local equipment; the server allocates a plurality of accounts with different permissions for a designated user, and the accounts are divided into a readable and writable permission account, a writable permission account and a readable permission account, wherein the readable and writable permission account can read and write a data ciphertext stored in the server after logging in, the writable permission account can write the data ciphertext without reading and modifying, and the readable permission account can read and view data but does not allow copying, modifying and writing; and receiving a login request of a specified user of the assigned account and allowing access to the fourth storage position according to the account authority.

2. The encryption-based scientific research data sharing system according to claim 1, wherein the local device further comprises an authorized periodic deletion module, the authorized periodic deletion module is configured to correspond a data cipher text stored in the server at a fourth storage location with the first secret key, asymmetrically encrypt the first secret key to obtain a second secret key, send the second secret key to the fourth storage location of the server according to an application approval condition, and authorize a third secret key used for decrypting the asymmetric encryption of the second secret key to a specified user within a limited time.

3. The encryption-based scientific research data sharing system according to claim 2, wherein the designated user logs in to the access server within a limited time, decrypts the second secret key according to the third secret key to obtain the first secret key, decrypts the corresponding data ciphertext to obtain the data plaintext, temporarily stores the data plaintext decrypted by the data ciphertext into the server for access, and deletes the second secret key and the data plaintext temporarily stored in the server after the limited time is over or after the designated user issues an access end instruction.

4. A scientific research data sharing method based on encryption is applied to local equipment and is characterized by comprising the following steps:

encrypting a data plaintext of the first local fixed path to generate a data ciphertext, storing the data ciphertext to a second local fixed path, and storing a first secret key used for encryption to a local third fixed path;

uploading the data ciphertext in the second local fixed path to a server within a set fixed time;

and receiving a data ciphertext storage path fed back by the server, corresponding to the first secret key, and storing the data ciphertext storage path to a local third fixed path.

5. The encryption-based scientific research data sharing method according to claim 4, wherein after receiving the data ciphertext storage path fed back by the server, the data ciphertext storage path corresponds to the first secret key and is stored in a local third fixed path, the method further comprises the following steps:

carrying out asymmetric encryption on the first secret key to obtain a second secret key;

sending the second secret key to a fourth storage position of the server according to the application approval condition;

authorizing a third asymmetric encryption secret key for decrypting the second secret key to a specified user within a limited time;

and sending an instruction for deleting the data plaintext and the second secret key in the server after the limited time is over or after an instruction for appointing the user to finish the viewing is received.

6. The encryption-based scientific data sharing method according to claim 4 or 5, wherein the encryption for encrypting the data plaintext of the first local fixed path to generate the data ciphertext uses a symmetric encryption algorithm.

7. A scientific research data sharing method based on encryption is applied to a server and is characterized by comprising the following steps:

receiving a data ciphertext encrypted by the local equipment, storing the data ciphertext to a fourth storage position, and sending a data ciphertext storage path of the fourth storage position to the local equipment;

distributing a plurality of accounts with different permissions to a specified user according to the application approval condition, wherein the accounts are divided into a readable and writable permission account, a writable permission account and a readable permission account, the readable and writable permission account can read and write a data ciphertext stored in a server after logging in, the writable permission account can write the data ciphertext without reading and modifying, and the readable permission account can read and view data but does not allow copying, modifying and writing;

receiving a second secret key and a data ciphertext storage path sent by local equipment, authorizing an access right after a specified user logs in and allowing access to the storage path consistent with the data ciphertext storage path;

and decrypting the second secret key into a first secret key according to the third secret key, decrypting the data ciphertext into a data plaintext according to the first secret key, and caching the data plaintext for a specified user to view.

8. The encryption-based scientific data sharing method according to claim 7, wherein after decrypting the data cipher text into data plaintext according to a first key and buffering the data plaintext for viewing by a specified user, further comprising the steps of:

receiving an instruction from the local device to delete the data plaintext and the second key;

and deleting the data plain text and the key according to the instruction for deleting the data plain text and the key.

9. The scientific research data sharing method based on encryption as claimed in claim 7 or 8, wherein after a plurality of accounts with different permissions are allocated to a specified user according to the application approval condition, the method further comprises the following steps:

distributing access authority and access position according to the login conditions of the distributed accounts with different authorities; the access position is determined by the received data ciphertext storage path sent by the local equipment.

10. A computer-readable storage medium on which a computer program is stored, the program, when executed by a processor, implementing the steps of the encryption-based scientific data sharing method according to any one of claims 4 to 9.

Images