Patent Application
20220070005
The present invention relates to the field of software methods, and in particular to a two-dimensional code technology.
Generally, the prior art meets corresponding needs in the form of network requests for the use of a two-dimensional code, and the data contents are stored in a terminal. Although the prior art can achieve many functions, the security of the information is unreliable.
Firstly, because most of the two-dimensional code generating and analyzing technologies in the prior art are disclosed technologies, it is easy to tamper the data in a two-dimensional code and change the URL network address. This is one of the weakness in the prior art, which can be used by lawless persons to allow users to download the contents through the address tampered by the lawless persons to achieve an illegal purpose.
Secondly, the prior art has no good security protection for the downloaded contents. Generally, the downloaded contents will be displayed. Thus, a series of problems will be caused. First, the users cannot obtain required contents; and second, the users may obtain some contents which carry a Trojan horse. From the perspective of a service provider, the service provider may cause data disorder when a terminal server is maintained, so that the users obtain some information of other users, resulting in irreparable consequences.
Therefore, according to the prior art, a set of secure information protection process is designed, so that no error occurs in the process of information circulation in the network, to prevent information tampering and ensure information security.
To solve the technical problems of easy tampering and poor security when data is stored and acquired based on the two-dimensional code in the prior art and realize safe and reliable information protection, the present invention proposes a file acquisition method based on a two-dimensional code, comprising:
step 1: analyzing the two-dimensional code to obtain two-dimensional code encoding data, and the encoding data comprising a first unique value, encrypted data and signature data;
step 2: verifying the signature data;
step 3: if verification of the signature data is passed, decrypting the encrypted data to obtain an encrypted file address and an nth data segment In; analyzing the nth data segment In to obtain an nth part An of the encrypted file and a storage address Sn−1 of an (n−1)th data segment In−1 located on a server, wherein n is the number of data segments obtained after file splitting;
step 4: acquiring the (n−i)th data segment In−i of the encrypted file according to the storage address Sn−i of the (n−i)th data segment and analyzing the (n−i)th data segment In−i to obtain the (n−i)th part An−i of the encrypted file and the storage address Sn−(i+1) of the n−(i+1)th data segment In−(i+1), i=1,2,3, . . . , n−2; acquiring the first data segment of the encrypted file according to the storage address S1 of the first data segment Ii, and analyzing the first data segment to obtain the first part A1 of the encrypted file; integrating the first part A1 to the nth part An of the encrypted file to obtain the encrypted file;
step 5: verifying the encrypted file according to the first unique value to obtain a decrypted file.
Preferably, the step 5 comprises:
step 5.1: calculating the unique value of the encrypted file to obtain a second unique value of the encrypted file;
step 5.2: comparing the second unique value with the first unique value; if the second unique value is equal to the first unique value, decrypting the encrypted file; and if the second unique value is not equal to the first unique value, stopping a file decryption process.
Preferably, the step 2 comprises:
verifying the signature data by using a digital certificate; if the digital certificate verifies that the signature is correct, executing step 3; and if verification fails, stopping executing the file acquisition method based on the two-dimensional code.
Preferably, the nth data segment is formed by splicing a header character xn and the nth part An of the encrypted file; the xn comprises a displacement T; the analysis of the nth data segment is mapping of the head character xn to obtain an (n−1)th storage address Sn−1; the header character xn corresponds to a server storage address one by one; or the storage address is calculated by using a functional relationship between a preset server storage address and the displacement T.
A two-dimensional code generating method, comprises:
step 1: making calculation for the encrypted file to obtain a first unique value;
step 2: splitting the encrypted file to obtain the first part A1, the second part A2 to the nth part An of the encrypted file; storing the first part A1, the second part A2 to the (n−1)th part An−1 of the encrypted file into n−1 storage addresses S1, S2 to Sn−1 on a server; and obtaining an encrypted file address;
step 3: conducting encryption for the nth data segment In and the encrypted file address to obtain encrypted data, and analyzing the nth data segment In to obtain the storage address Sn−1 of the (n−1)th data segment on the server and the data segment of part An of the encrypted file;
step 4: signing for the first unique value and the encrypted data to obtain signature data;
step 5: encoding the first unique value, the encrypted data and the signature data to form a two-dimensional code.
Preferably, the step 3 of making calculation for the file comprises: acquiring a data information algorithm or cryptographic hash function algorithm irreversibly.
Preferably, the step 4 comprises signing for the first unique value and the encrypted data by using a digital certificate.
Preferably, the nth data segment is formed by splicing a header character xn and the nth part An of the encrypted file; the xn comprises a displacement T; the analysis of the nth data segment is mapping of the head character xn to obtain an (n−1)th storage address Sn−1; the header character xn corresponds to a server storage address one by one; or the storage address is calculated by using a functional relationship between a preset server storage address and the displacement T.
A file acquisition device based on a two-dimensional code, comprises:
a scanning and analyzing unit for acquiring and analyzing the two-dimensional code to obtain encoding data;
a data processing unit for obtaining encrypted data, a first unique value and signature data according to the encoding data;
a data decrypting unit for verifying the signature data;
if verification of the signature data is passed, decrypting the encrypted data to obtain an encrypted file address and an nth data segment In; analyzing the nth data segment In to obtain an nth part An of the encrypted file and a storage address Sn−1 of an (n−1)th data segment In−1 located on a server, wherein n is the number of data segments obtained after file splitting; acquiring the (n−i)th data segment In−i of the encrypted file according to the storage address Sn−i of the (n−i)th data segment In−i, and analyzing the (n−i)th data segment In−i to obtain the (n−i)th part An−i of the encrypted file and the storage address Sn−(i+1) of the n−(i+1)th data segment In−(i+1), i=1,2,3, . . . , n−2; acquiring the first data segment of the encrypted file according to the storage address S1 of the first data segment Ii, and analyzing the first data segment to obtain the first part A1 of the encrypted file;
a file downloading and combining unit, wherein the file downloading unit is used for downloading the encrypted file according to the encrypted file address, and integrating the first part A1, the second part A2 to the nth part An of the encrypted file to obtain the encrypted file;
a file verifying unit for verifying the encrypted file.
Preferably, the file verifying unit comprises:
a unique value calculating subunit for making calculation for the encrypted file to obtain a second unique value;
a comparison subunit for comparing the first unique value with the second unique value, decrypting the encrypted file if the second unique value is equal to the first unique value, and stopping a file decryption process if the second unique value is not equal to the first unique value.
Preferably, the data decrypting unit verifies the signature data by using the digital certificate, executes step 3 if verification is passed, and stops executing the file acquisition method based on the two-dimensional code if verification fails.
Preferably, the nth data segment is formed by splicing a header character xn and the nth part An of the encrypted file; the xn comprises a displacement T; the analysis of the nth data segment is mapping of the head character xn to obtain an (n−1)th storage address Sn−1; the header character xn corresponds to a server storage address one by one; or the storage address is calculated by using a functional relationship between a preset server storage address and the displacement T.
In the file acquisition method and device based on the two-dimensional code, and the two-dimensional code generating method provided by the present invention, the signature data, the unique values and the website data are encoded and stored into the two-dimensional code; and a data certificate technology and a unique value verification technology are flexibly used to ensure both the safety of download links in the two-dimensional code and the reliability of downloaded documents.
The technical solution in the embodiments of the present invention will be clearly and fully described below in combination with the drawings in the embodiments of the present invention. Apparently, the described embodiments are merely part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by those ordinary skilled in the art without contributing creative labor will belong to the protection scope of the present invention.
In view of the technical problems of easy tampering and poor security when data is stored and acquired based on the two-dimensional code in the existing methods, the present invention provides a file acquisition method and device based on a two-dimensional code, and a two-dimensional code generating method.
The present embodiment provides a two-dimensional code encoding method, as shown in
1. Calculating a file unique value. The unique value is an irreversible value, i.e., it is possible to inversely calculate the contents of a text through the unique value anyway. This can protect the information of the text from being disclosed. Calculation methods of the unique value comprise cryptographic hash function algorithms of SHA-256 and SM3.
2. Converting a file into a 16-bit data file, splitting the 16-bit data file into n parts to obtain n data segments, and storing the above data segments into n positions in a service area; and randomly selecting a number Y within 10.
A first header file 00000000 and the first data segment are spliced to obtain the first data group which is stored in the first data area; the first data area is calculated according to the functional relationship which is preset in the local or two-dimensional code to obtain position x1; the position parameter x1 and Y are treated by the functional relationship to obtain a second header file; then the second header file is integrated with the second data segment and stored in the second data area; the first data area is calculated according to the functional relationship which is preset in the local or two-dimensional code to obtain position x2; the third data segment of the file is stored into the third data area, and so on. A data table is saved when the length of the nth data segment is less than 32 bits. The nth header file related to xn−1 and the remaining number of the end data segments are written into the last data group of the two-dimensional code.
A network address or a mapping address of the network address is obtained.
The above process of storing the text can be uploaded by the user or completed by the agent of the service provider. The type of the text can be binary information files of images, words, videos and audio.
3. Encrypting the network address and the end data group by a private key of the digital certificate to generate encrypted data.
The above digital certificate may be a CA with a national digital certificate license or a digital certificate produced by the service provider. The encryption process must be the private key of the certificate. This can ensure that a decryption device contains only a public key of the certificate and does not need to expose the private key.
4. Signing for the unique value A and the encrypted data by using the digital certificate to generate signature information.
5. Integrating the signature information, the unique value A and the encrypted data to generate the two-dimensional code.
The present invention adds information security protection measures at the download address data level of the two-dimensional code and the document data level, which can effectively prevent the information from being tampered and prevent the document from being swapped and modified. The present invention adopts split storage which is a storage mode in which the storage address is calculated in a progressive way through preset mapping, which can save storage space, effectively protect the information of the text and prevent the file from being tampered.
The present embodiment provides a two-dimensional code generating method and device, as shown in
1. A scanning and analyzing module: which is used for capturing the image of the two-dimensional code and trying to analyze the image to obtain the data in the two-dimensional code.
2. A data processing module: which is used for separating the data in the two-dimensional code to obtain the encrypted data, the unique value A and the signature information.
3. A data verification module: which is used for verifying the authenticity of the information obtained in the two-dimensional code by using the digital certificate. If the verification of the digital certificate is successful, it indicates that the encrypted data and the unique value A are valid information and have not been tampered. If the verification of the digital certificate fails, it indicates that the data in the two-dimensional code may be at risk of being tampered and next operation will not be carried out.
A data decoding module: the digital certificate is used to decode the data according to the encryption address. After the decoding is successful, a network request address URL and the end data group in which the two-dimensional code is written are obtained. The end data group is separated to obtain an end data segment and 8-bit data located in the head of the end data group. The above 8-bit data is processed according to a preset function or a corresponding table to obtain a file storage position of a; the data group of the penultimate segment is obtained from the storage position of the penultimate segment; the penultimate data segment is separated to obtain the 8-bit data corresponding to the head of the segment to obtain the storage position of an antepenultimate segment; and this process is circulated until all data segments of the file are obtained.
4. A document download module: the document is downloaded through the URL; and the data segments in all the positions are combined into a file, and the downloaded document is not allowed to be opened immediately, to prevent virus threats.
5. A file verification module: unique value processing is conducted on a plurality of data segments which are downloaded in combination to obtain the unique value B, and the unique values A and B are compared. If the data are consistent, it indicates that the obtained document is the original data stored at that time. If the data are inconsistent after comparison, it indicates that the downloaded document has been tampered and the information is incorrect. Or, the downloaded document may be a virus, has a risk, and is not allowed to be opened to protect the use security of the user.
The analyzing process comprises:
analyzing the two-dimensional code to obtain the encryption address, the unique value A and the signature information in the two-dimensional code;
verifying the data information;
decrypting the encrypted information to obtain a website link;
downloading the document through the website link, and calculating the unique value B of the document;
comparing the unique value A with the unique value B.
If A and B are inconsistent, it indicates that the document has a risk and the operation is stopped. If A and B are consistent, it indicates that the downloaded document is the document uploaded by the user and can be downloaded securely.
The present invention encodes the signature data, the unique values obtained by calculation and the website together into the two-dimensional code, and flexibly uses the digital certificate technologies, including the encryption, decryption and verification technologies of the digital certificate to ensure the security of the information. Through a unique value verification mechanism, by using the principle that the same data after unique value operation generates the same value, the unique values of the same information are compared in different stages, so as to prove whether the information is tampered to ensure that the information is secure and not disclosed.
To sum up, a data carrier acquisition method of a two-dimensional code provided by embodiments of the present invention has the following beneficial effects:
(1) Through the combination of the encryption, decryption and signature methods of the two-dimensional code and the digital certificate, the present invention improves the security of the data and effectively prevents the data from being tampered.
(2) In the encoding and decoding processes of the two-dimensional code of the present invention, the security of the download address data is enhanced by the asymmetric encryption setting which verifies the reliability of the data.
(3) The two-dimensional code information protection method of the present invention can verify the security of text information in the final step, ensure that the downloaded text is the initial uploaded text, and ensure the one-to-one correspondence of information acquisition.
(4) The present invention adopts split storage which is a storage mode in which the storage address is calculated in a progressive way through preset mapping, which can save storage space, effectively protect the information of the text and prevent the file from being tampered.
The purposes, technical solutions and beneficial effects of the present invention are further described in detail through the above specific embodiments. It shall be understood that the above only describes specific embodiments of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and the principle of the present invention shall be included within the protection scope of the present invention.
| Number | Date | Country | Kind |
|---|---|---|---|
| 201910881097.4 | Sep 2019 | CN | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/CN2020/078469 | 3/9/2020 | WO | 00 |
