Cloud storage method and system based on data grading and blocking encryption

Abstract

The invention provides a cloud storage method and system based on data grading and blocking encryption, and belongs to the technical field of file cloud storage. The method comprises the following steps: carrying out grading and block encryption on files in the cloud storage system; the method specifically comprises the following steps: carrying out classification and risk assessment on files in the cloud storage system, and carrying out file encryption by adopting different encryption algorithms for files with different risk levels under the same category; aiming at the file which is divided into a plurality of file blocks, independently encrypting each data block, and matching a corresponding encryption algorithm according to the data characteristics of the data blocks; after file grading and block encryption are completed, keys are managed in various modes of a key derivation structure, a hash tree and a threshold cryptographic algorithm. The method is used for remarkably improving the security of the stored data, and meanwhile, the efficient operation of the system is kept.

Description

Technical Field

[0001] The present invention belongs to the technical field of file cloud storage, and in particular relates to a cloud storage method and system based on data hierarchical and block encryption. Background Art

[0002] Data hierarchical encryption is a technology that uses different levels of encryption based on the risk level of the data. This method can enhance the security of the data because even if an attacker obtains part of the data, he cannot obtain the complete information.

[0003] For example, in the financial sector, data encryption is a key means of protecting transaction security and customer privacy. For example, personal information and transaction data in credit card transactions, online bank transfers, securities transactions, etc. are processed through encryption algorithms to ensure that only authorized parties can access these sensitive information. E-commerce platforms need to encrypt and store sensitive data such as users' personal information, payment information, and order details to protect user privacy and prevent data from being intercepted during transmission.

[0004] For example, in network communications, hardware-implemented link layer encryption, node encryption, and end-to-end encryption can be used to protect the security of data transmission. In the medical field, patients' health records and other sensitive information need to be protected by encryption technology to ensure the confidentiality and integrity of the data. It is usually necessary to process a large amount of sensitive data, including identity information, security files, etc. The secure storage and transmission of this data is crucial.

[0005] Therefore, data security and file encryption become particularly important.

[0006] However, the encryption methods used in the prior art are often simple and easy to crack, and the management of the keys is usually handed over to a third-party central node organization. When the central node fails or a third-party organization leaks information, the risks caused are immeasurable. Summary of the invention

[0007] In order to solve the above technical problems, the present invention proposes a cloud storage solution based on data hierarchical and block encryption.

[0008] The first aspect of the present invention provides a cloud storage method based on data hierarchical and block-by-block encryption, wherein the method hierarchically and block-by-block encrypts files in a cloud storage system; the method specifically comprises: Step S1: Classify and assess the risks of files in the cloud storage system, and use different encryption algorithms to encrypt files of the same category but with different risk levels; Step S2: for a file divided into several file blocks, each data block is encrypted independently, and a corresponding encryption algorithm is matched according to the data characteristics of the data block; Step S3: After completing the file classification and block encryption, the key is managed by using a variety of methods such as key derivation structure, hash tree, and threshold cryptographic algorithm.

[0009] Furthermore, in step S1, files under the same category are divided into three risk levels, and the AES-256 encryption algorithm is used to encrypt files of the first risk level, the AES-128 encryption algorithm is used to encrypt files of the second risk level, and the Blowfish encryption algorithm is used to encrypt files of the third risk level. The risk of files of the first risk level is higher than that of files of the second risk level, and the risk of files of the second risk level is higher than that of files of the third risk level.

[0010] Furthermore, in step S2: The data characteristics include data properties and data size; After each data block is independently encrypted using a corresponding encryption algorithm, the order of each data block is randomly disrupted, and data block reorganization rules are configured based on the correspondence between the disrupted order and the original order to reorganize the data during subsequent access.

[0011] Furthermore, in step S3: The key derivation structure is used to manage the key; specifically, it includes: a group key distribution protocol based on a state key tree, establishing a user hierarchy through single-layer or double-layer key derivation to achieve key management; The key is managed by using a hash tree; specifically, the key is generated by using a hash tree for different file blocks of different files; The key is managed by using a threshold cryptographic algorithm; specifically, the key is treated as a secret and the secret is divided by polynomial interpolation so that the secret can only be recovered by a certain number of participants.

[0012] Furthermore, in the method, when encrypting files in a hierarchical / block manner, the number of rounds of hierarchical encryption and / or block encryption is adaptively and dynamically adjusted according to the sensitivity of the encrypted files / file blocks. The higher the sensitivity, the more rounds of encryption are used.

[0013] A second aspect of the present invention provides a cloud storage system based on data hierarchical and block-by-block encryption, wherein the cloud storage system performs hierarchical and block-by-block encryption on files stored thereon; the cloud storage system comprises: The hierarchical encryption unit is configured to: classify and assess the risks of files in the cloud storage system, and use different encryption algorithms to encrypt files of the same category with different risk levels; The block encryption unit is configured to: for a file divided into a plurality of file blocks, perform independent encryption processing on each data block, and match a corresponding encryption algorithm according to data features of the data block; The key management unit is configured to manage the key by using a variety of methods such as key derivation structure, hash tree, and threshold cryptographic algorithm after completing file classification and block encryption.

[0014] Furthermore, the hierarchical encryption unit is specifically configured to: divide files under the same category into three risk levels, use AES-256 encryption algorithm to encrypt files of the first risk level, use AES-128 encryption algorithm to encrypt files of the second risk level, and use Blowfish encryption algorithm to encrypt files of the third risk level. The risk of files at the first risk level is higher than that of files at the second risk level, and the risk of files at the second risk level is higher than that of files at the third risk level.

[0015] Furthermore, the data features include data characteristics and data size; the block encryption unit is specifically configured as follows: After each data block is independently encrypted using a corresponding encryption algorithm, the order of each data block is randomly disrupted, and data block reorganization rules are configured based on the correspondence between the disrupted order and the original order to reorganize the data during subsequent access.

[0016] Furthermore, the key management unit is specifically configured as follows: The key derivation structure is used to manage the key; specifically, it includes: a group key distribution protocol based on a state key tree, establishing a user hierarchy through single-layer or double-layer key derivation to achieve key management; The key is managed by using a hash tree; specifically, the key is generated by using a hash tree for different file blocks of different files; The key is managed by using a threshold cryptographic algorithm; specifically, the key is treated as a secret and the secret is divided by polynomial interpolation so that the secret can only be recovered by a certain number of participants.

[0017] Furthermore, the hierarchical encryption unit / the block encryption unit is also configured to: when performing hierarchical / block encryption on files, adaptively and dynamically adjust the number of rounds of hierarchical encryption / block encryption according to the sensitivity of the encrypted files / file blocks, and the higher the sensitivity, the more encryption rounds are used.

[0018] In summary, in order to increase the difficulty of data being cracked by attackers, the present invention adopts a hierarchical and block-based hybrid encryption security mechanism to better cooperate with the file segmentation technology to achieve higher security of the cloud storage system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 The present invention is a flowchart of a cloud storage method based on data hierarchical and block encryption according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0022] For ease of understanding, the main concepts involved in the present invention are clarified here: 1. File classification and risk assessment: Based on pre-established classification rules, files uploaded by users are subjected to sensitivity analysis and classification, and divided into three risk levels: high, medium, and low.

[0023] 2. Differentiated encryption strategy: Take corresponding encryption measures for files of different risk levels: for example, use strong encryption algorithms such as AES-256 for high-risk files, use medium-strength encryption algorithms such as AES-128 for medium-risk files, and use encryption algorithms with better performance such as Blowfish for low-risk files.

[0024] 3. Algorithm performance optimization: When selecting encryption algorithms, we take into account both security performance and computational efficiency to ensure that we provide the best encryption solution for files of different sensitivities, protecting key information without placing too much burden on system performance. Through this refined security control measure, we can fully meet the file security needs of different users and provide users with reliable file storage.

[0025] In a first aspect, the present invention provides a cloud storage method based on data hierarchical and block encryption, wherein the method hierarchically and block-by-block encrypts files in a cloud storage system; the method specifically comprises (eg Figure 1 shown): Step S1: Classify and assess the risks of files in the cloud storage system, and use different encryption algorithms to encrypt files of the same category but with different risk levels; Step S2: for a file divided into several file blocks, each data block is encrypted independently, and a corresponding encryption algorithm is matched according to the data characteristics of the data block; Step S3: After completing the file classification and block encryption, the key is managed by using a variety of methods such as key derivation structure, hash tree, and threshold cryptographic algorithm.

[0026] Furthermore, in step S1, files under the same category are divided into three risk levels, and the AES-256 encryption algorithm is used to encrypt files of the first risk level, the AES-128 encryption algorithm is used to encrypt files of the second risk level, and the Blowfish encryption algorithm is used to encrypt files of the third risk level. The risk of files of the first risk level is higher than that of files of the second risk level, and the risk of files of the second risk level is higher than that of files of the third risk level.

[0027] Furthermore, in step S2: The data characteristics include data properties and data size; After each data block is independently encrypted using a corresponding encryption algorithm, the order of each data block is randomly disrupted, and data block reorganization rules are configured based on the correspondence between the disrupted order and the original order to reorganize the data during subsequent access.

[0028] Furthermore, in step S3: The key derivation structure is used to manage the key; specifically, it includes: a group key distribution protocol based on a state key tree, establishing a user hierarchy through single-layer or double-layer key derivation to achieve key management; The key is managed by using a hash tree; specifically, the key is generated by using a hash tree for different file blocks of different files; The key is managed by using a threshold cryptographic algorithm; specifically, the key is treated as a secret and the secret is divided by polynomial interpolation so that the secret can only be recovered by a certain number of participants.

[0029] Furthermore, in the method, when encrypting files in a hierarchical / block manner, the number of rounds of hierarchical encryption and / or block encryption is adaptively and dynamically adjusted according to the sensitivity of the encrypted files / file blocks. The higher the sensitivity, the more rounds of encryption are used.

[0030] 1. Hierarchical encryption In order to effectively protect various files uploaded by users, we hope to use encryption algorithms to establish a more secure file storage mechanism based on file segmentation.

[0031] These include the following key aspects: 1. File classification and risk assessment: Based on pre-established classification rules, files uploaded by users are subjected to sensitivity analysis and classification, and divided into three risk levels: high, medium, and low.

[0032] 2. Differentiated encryption strategies: Take corresponding encryption measures for files of different risk levels: for example, use strong encryption algorithms such as AES-256 for high-risk files, use medium-strength encryption algorithms such as AES-128 for medium-risk files, and use encryption algorithms with better performance such as Blowfish for low-risk files.

[0033] 3. Algorithm performance optimization: When selecting encryption algorithms, we take into account both security performance and computational efficiency to ensure that the best encryption solution is provided for files of different sensitivities, protecting key information without placing too much burden on system performance. Through this refined security control measure, we can fully meet the file security needs of different users and provide users with reliable file storage.

[0034] 2. Block encryption In order to encrypt different forms of data blocks in the split files, we can use block encryption.

[0035] The core of block encryption technology is to divide the original data into multiple smaller data blocks, each of which can be encrypted independently. This method not only improves the flexibility of data processing, but also provides more options for subsequent encryption algorithms. We can choose different encryption algorithms according to the characteristics and size of the data, thereby ensuring data security while taking into account encryption efficiency.

[0036] After encryption is completed, we can reassemble the encrypted data blocks into a complete data file according to the preset combination rules. In this process, randomized data block sequential storage technology can be used to further enhance data security. In this way, even if an attacker obtains part of the data blocks, the complete data content cannot be restored, thereby effectively protecting the confidentiality and integrity of the data. The encrypted data blocks are securely stored in the network disk or other cloud storage services. This ensures higher file security.

[0037] 3. Key Management After encryption is completed, key management is also a very important link, which can determine whether the attacker can obtain the final key to crack the user's files.

[0038] 1. Key derivation structure: A group key distribution protocol based on a state key tree establishes a user hierarchy through a single-layer or double-layer key derivation method to achieve efficient key management.

[0039] 2. Hash tree method: Use hash trees to generate different keys for different areas of large files, supporting more fine-grained security.

[0040] 3. Threshold cryptography algorithm: The threshold cryptography algorithm divides the secret through polynomial interpolation so that only a certain number of participants can recover the secret. This method improves the security of key distribution.

[0041] In some embodiments, during the encryption process, intelligent encryption can be performed according to the characteristics of the file block. The first is adaptive encryption algorithm selection. According to the content characteristics of the file block, an adaptive encryption algorithm selection strategy is adopted. For key data blocks containing sensitive information, high-intensity encryption algorithms such as AES-256 and SM4 are used; for relatively insensitive general data blocks, high-performance encryption algorithms such as ChaCha20 and Salsa20 are used.

[0042] In some embodiments, this differentiated encryption can ensure that critical information is more strictly protected while taking into account the overall encryption efficiency. Adaptive encryption round adjustment can also be considered. In addition to selecting a suitable encryption algorithm, the number of encryption rounds will be dynamically adjusted according to the sensitivity of the data block. For highly sensitive data, the number of encryption rounds can be appropriately increased to improve the ability to resist brute force cracking. For less sensitive data, the number of encryption rounds can be appropriately reduced to reduce computing overhead. Through adaptive encryption strength control, resource allocation can be optimized to ensure that critical data is more effectively protected.

[0043] In some embodiments, for files stored in each network disk, if each file block uses the same encryption method, then its security may not be that high, so heterogeneous encryption algorithms can be used. We will use different encryption algorithms to process different data blocks of the same combined file. This heterogeneous encryption method can greatly reduce the possibility of file cracking, because attackers need to face multiple encryption mechanisms to restore complete data. In addition to differential encryption, the encrypted data blocks will also be stored in random order. By disrupting the physical storage location of the data blocks, the security of the file can be further enhanced. Even if some data blocks are leaked, the complete file content cannot be pieced together.

[0044] In some embodiments, in order to further improve security, a layered encryption mechanism can be used. For most files, each data block is protected by a layer of basic encryption, such as AES-128, Blowfish and other medium-strength algorithms. For files with special needs, we can also add one or more layers of additional encryption on the basis of basic encryption. These files can use different algorithms, such as SM4, ChaCha20, etc., to form multiple protections. Even if the attacker successfully cracks the basic encryption, he still needs to face the subsequent encryption layer to obtain the plaintext data.

[0045] In some embodiments, for files stored in each network disk, if each file block therein adopts the same encryption method, then its security may not be that high. However, when we use different encryption algorithms to encrypt different blocks of the same combined file, it will greatly reduce the possibility of the file being cracked. The combination method of the file block and the encryption algorithm can also have a better coordination, so that the security is further enhanced.

[0046] By implementing the present invention, the security of stored data will be significantly improved while maintaining the efficient operation of the system. Intelligent encryption strategies will provide users with more flexible and personalized security options to meet the data protection needs of different users. In addition, the introduction of layered encryption technology will provide a more solid security barrier for cloud storage data.

[0047] A second aspect of the present invention provides a cloud storage system based on data hierarchical and block-by-block encryption, wherein the cloud storage system performs hierarchical and block-by-block encryption on files stored thereon; the cloud storage system comprises: The hierarchical encryption unit is configured to: classify and assess the risks of files in the cloud storage system, and use different encryption algorithms to encrypt files of the same category with different risk levels; The block encryption unit is configured to: for a file divided into a plurality of file blocks, perform independent encryption processing on each data block, and match a corresponding encryption algorithm according to data features of the data block; The key management unit is configured to manage the key by using a variety of methods such as key derivation structure, hash tree, and threshold cryptographic algorithm after completing file classification and block encryption.

[0048] Furthermore, the hierarchical encryption unit is specifically configured to: divide files under the same category into three risk levels, use AES-256 encryption algorithm to encrypt files of the first risk level, use AES-128 encryption algorithm to encrypt files of the second risk level, and use Blowfish encryption algorithm to encrypt files of the third risk level. The risk of files at the first risk level is higher than that of files at the second risk level, and the risk of files at the second risk level is higher than that of files at the third risk level.

[0049] Furthermore, the data features include data characteristics and data size; the block encryption unit is specifically configured as follows: After each data block is independently encrypted using a corresponding encryption algorithm, the order of each data block is randomly disrupted, and data block reorganization rules are configured based on the correspondence between the disrupted order and the original order to reorganize the data during subsequent access.

[0050] Furthermore, the key management unit is specifically configured as follows: The key derivation structure is used to manage the key; specifically, it includes: a group key distribution protocol based on a state key tree, establishing a user hierarchy through single-layer or double-layer key derivation to achieve key management; The key is managed by using a hash tree; specifically, the key is generated by using a hash tree for different file blocks of different files; The key is managed by using a threshold cryptographic algorithm; specifically, the key is treated as a secret and the secret is divided by polynomial interpolation so that the secret can only be recovered by a certain number of participants.

[0051] Furthermore, the hierarchical encryption unit / the block encryption unit is also configured to: when performing hierarchical / block encryption on files, adaptively and dynamically adjust the number of rounds of hierarchical encryption / block encryption according to the sensitivity of the encrypted files / file blocks, and the higher the sensitivity, the more encryption rounds.

[0052] In summary, in order to increase the difficulty of data being cracked by attackers, the present invention adopts a hierarchical and block-based hybrid encryption security mechanism to better cooperate with the file segmentation technology to achieve higher security of the cloud storage system.

[0053] The technical effects brought by the present invention include: 1. File classification and risk assessment: Conduct sensitivity analysis and classification of files uploaded by users into three risk levels: high, medium, and low to improve security.

[0054] 2. Differentiated encryption strategy: Different encryption measures are adopted according to the risk level of the file, such as AES-256, AES-128 and Blowfish, ensuring the security and performance of files of different sensitivities.

[0055] 3. Algorithm performance optimization: When selecting an encryption algorithm, both security performance and computational efficiency are taken into consideration to ensure that the best encryption solution is provided for files of different sensitivities and to reduce the burden on system performance.

[0056] 4. Data processing flexibility: Splitting the original data into multiple smaller data blocks improves the flexibility of data processing.

[0057] 5. Diversified encryption algorithm selection: Select different encryption algorithms according to data characteristics and size, taking into account both data security and encryption efficiency.

[0058] 6. Data reorganization security: The encrypted data blocks are reassembled into complete data files according to the preset combination rules, and the randomized data block sequence storage technology is used to enhance data security.

[0059] 7. Key derivation structure: A group key distribution protocol based on a state key tree establishes a user hierarchy to achieve efficient key management and solve the problems of storage capacity and time overhead.

[0060] 8. Hash tree method: Use hash trees to generate different keys for different areas of large files, supporting more fine-grained security, but it is necessary to solve the time overhead problem when deleting data.

[0061] 9. Threshold cryptographic algorithm: The secret is divided through polynomial interpolation method to improve the security of key distribution, but there may be problems such as large number of interactions and complex process.

[0062] Please note that the technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. The above-mentioned embodiments only express several implementation methods of the present application, and their descriptions are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, without departing from the concept of the present application, several variations and improvements can be made, which all belong to the scope of protection of the present application. Therefore, the scope of protection of the patent in this application shall be based on the attached claims.

Claims

1. A cloud storage method based on data hierarchical block encryption, characterized in that: The method encrypts files in a cloud storage system in a hierarchical and block-by-block manner; the method specifically includes: Step S1: Classify and assess the risks of files in the cloud storage system, and use different encryption algorithms to encrypt files of the same category but with different risk levels; Step S2: for a file divided into several file blocks, each data block is encrypted independently, and a corresponding encryption algorithm is matched according to the data characteristics of the data block; Step S3: After completing the file classification and block encryption, the key is managed by using a variety of methods such as key derivation structure, hash tree, and threshold cryptographic algorithm.

2. A cloud storage method based on data hierarchical block encryption according to claim 1, characterized in that: In step S1, files under the same category are divided into three risk levels. For files of the first risk level, the AES-256 encryption algorithm is used to encrypt the files. For files of the second risk level, the AES-128 encryption algorithm is used to encrypt the files. For files of the third risk level, the Blowfish encryption algorithm is used to encrypt the files. The risk of files of the first risk level is higher than that of files of the second risk level, and the risk of files of the second risk level is higher than that of files of the third risk level.

3. The cloud storage method based on data hierarchical block encryption according to claim 2 is characterized in that: In step S2: The data characteristics include data properties and data size; After each data block is independently encrypted using a corresponding encryption algorithm, the order of each data block is randomly disrupted, and data block reorganization rules are configured based on the correspondence between the disrupted order and the original order to reorganize the data during subsequent access.

4. The cloud storage method based on data hierarchical and block encryption according to claim 3 is characterized in that: In step S3: The key derivation structure is used to manage the key; specifically, it includes: a group key distribution protocol based on a state key tree, establishing a user hierarchy through single-layer or double-layer key derivation to achieve key management; The key is managed by using a hash tree; specifically, the key is generated by using a hash tree for different file blocks of different files; The key is managed by using a threshold cryptographic algorithm; specifically, the key is treated as a secret and the secret is divided by polynomial interpolation so that the secret can only be recovered when a certain number of participants are satisfied.

5. The cloud storage method based on data hierarchical and block encryption according to claim 4 is characterized in that: In the method, when encrypting files in a hierarchical / block manner, the number of rounds of hierarchical encryption and / or block encryption is adaptively and dynamically adjusted according to the sensitivity of the encrypted files / file blocks. The higher the sensitivity, the more encryption rounds are used.

6. A cloud storage system based on data hierarchical and block encryption, characterized in that: The cloud storage system performs hierarchical and block-by-block encryption on the files stored thereon; the cloud storage system comprises: The hierarchical encryption unit is configured to: classify and assess the risks of files in the cloud storage system, and use different encryption algorithms to encrypt files of different risk levels under the same category; The block encryption unit is configured to: for a file divided into a plurality of file blocks, perform independent encryption processing on each data block, and match a corresponding encryption algorithm according to data features of the data block; The key management unit is configured to manage the key by using a variety of methods such as key derivation structure, hash tree, and threshold cryptographic algorithm after completing file classification and block encryption.

7. A cloud storage system based on data hierarchical and block encryption according to claim 6, characterized in that: The hierarchical encryption unit is specifically configured to: divide files under the same category into three risk levels, use the AES-256 encryption algorithm to encrypt files of the first risk level, use the AES-128 encryption algorithm to encrypt files of the second risk level, and use the Blowfish encryption algorithm to encrypt files of the third risk level. The risk of files at the first risk level is higher than that of files at the second risk level, and the risk of files at the second risk level is higher than that of files at the third risk level.

8. A cloud storage system based on data hierarchical and block encryption according to claim 7, characterized in that: The data features include data characteristics and data size; the block encryption unit is specifically configured as follows: After each data block is independently encrypted using a corresponding encryption algorithm, the order of each data block is randomly disrupted, and data block reorganization rules are configured based on the correspondence between the disrupted order and the original order to reorganize the data during subsequent access.

9. A cloud storage system based on data hierarchical block encryption according to claim 8, characterized in that: The key management unit is specifically configured as follows: The key derivation structure is used to manage the key; specifically, it includes: a group key distribution protocol based on a state key tree, establishing a user hierarchy through single-layer or double-layer key derivation to achieve key management; The key is managed by using a hash tree; specifically, the key is generated by using a hash tree for different file blocks of different files; The key is managed by using a threshold cryptographic algorithm; specifically, the key is treated as a secret and the secret is divided by polynomial interpolation so that the secret can only be recovered when a certain number of participants are satisfied.

10. A cloud storage system based on data hierarchical block encryption according to claim 9, characterized in that: The hierarchical encryption unit / the block encryption unit is also configured to: when performing hierarchical / block encryption on files, adaptively and dynamically adjust the number of hierarchical encryption / block encryption rounds according to the sensitivity of the encrypted files / file blocks, and the higher the sensitivity, the more encryption rounds.

Images