Storage encryption system and method

Abstract

The invention provides a storage encryption system and method, and the system comprises a connection and recognition module, a data preprocessing and preliminary encryption module, a platform building module, a pseudonym building module, a secret key generation and management module, an asymmetric encryption module, and a data storage and access control module. According to the storage encryption system and method provided by the invention, the access strategy is further encrypted by combining the pseudonyms with the leaf nodes of the binary tree, the attribute information of the user is stored by using the binary tree structure, and each leaf node is associated with one pseudonym, so that the data security is enhanced, and the user experience is improved. According to the technical scheme, unauthorized access and data leakage are effectively prevented, access rules and access control are set, a user is allowed to access a data block of a specific version instead of data blocks of all versions, data safety is improved, and unnecessary loss caused by leakage of important information is avoided.

Description

Technical Field

[0001] The present invention relates to the field of management data processing, and in particular to a storage encryption system and method. Background Art

[0002] With the continuous advancement of technology and the wide expansion of applications, the functions of terminal devices are becoming more and more powerful, which can meet the diverse needs of users. These terminal devices are equipped with a variety of hardware components and run on different operating system platforms. At present, the mainstream terminal user operating system platforms on the market include Windows, Linux, Android, iOS and Mac OS, providing users with a wealth of choices.

[0003] As people's daily life and work needs continue to grow, it has become normal for individuals to own multiple terminal devices of different platforms. This trend has led to a sharp increase in the amount of data stored on terminal devices, far exceeding the carrying capacity of built-in memory. Therefore, users are in urgent need of finding an effective data backup and transfer solution to store important data in management data.

[0004] In this context, USB smart storage devices have gradually become the preferred tool for data backup and transfer due to their advantages such as portability, large capacity and high transmission speed. In particular, USB storage devices with advanced security encryption functions are highly favored because they can provide additional data protection.

[0005] However, although these USB storage devices perform well in data backup and transmission, they still have significant defects in data security. Specifically, when these devices are plugged into terminal devices such as computers and mobile phones and complete the backup of files and other data, and then plugged back into other terminal devices, they often lack effective confidentiality measures. This means that unauthorized users or malicious attackers can easily access and copy private and important data stored on the USB storage devices, resulting in unnecessary losses caused by information leakage.

[0006] Therefore, it is necessary to provide a new storage encryption system and method to solve the above technical problems. Summary of the invention

[0007] In order to solve the above technical problems, the present invention provides a storage encryption system and method.

[0008] The storage encryption system provided by the present invention comprises: a connection and identification module, used for connecting and identifying a USB storage device; The data preprocessing and preliminary encryption module uses the data on the USB storage device after identification, processes the data using the time series relationship, extracts the key value feature quantity and performs preliminary encryption processing on the feature value; A platform establishment module establishes a key management platform based on the data on the USB storage device; A pseudonym establishment module, using data in the key management platform to establish multiple pseudonyms, wherein the multiple pseudonyms are recorded as a first pseudonym, a second pseudonym, and a third pseudonym; The key generation and management module generates encryption public keys and private keys according to the data in the key management platform, and stores the public keys, private keys and pseudonyms in a temporary storage area in the USB storage device; An asymmetric encryption module, used for reading the key-value feature quantity in the temporary storage area, further encrypting the pre-processed data using the public key, generating the encrypted ciphertext, storing the ciphertext in the dedicated storage area of ​​the USB smart storage device, and retaining the metadata; Data storage and access control module, which sets access policies based on stored ciphertext and metadata; The access strategy includes the following steps: Step 1, preparation phase: first define the attributes of the user in the ciphertext of the asymmetric encryption module, and according to the user attributes, subdivide the attributes in the policy into attribute names and attribute values, build a binary tree, use the leaf nodes of the binary tree to store user attribute information, and set the corresponding access rights; Step 2: Build attribute-based encryption strategy: Build attribute-based encryption strategy based on user attributes and access rights, disclose necessary attribute names, and hide specific attribute values; Step 3, generation phase: according to the attribute-based encryption strategy, generate encryption public key and private key, use the public key to further encrypt the data pre-processed by S2, generate encrypted ciphertext, store the ciphertext in the dedicated storage area of ​​the USB smart storage device, and retain the metadata; Step 4, access rule setting stage: Divide the encrypted ciphertext into multiple data blocks, assign one or more tags to each data block, define the relationship between the data blocks and set access rules; wherein, define the relationship between the data blocks, including parent-child relationship or dependency relationship, and use the parent-child relationship to set access rules; Step 5, Set up access control phase: Implement version control on each data block according to the access rules, allow users to access specific versions of data blocks, and record the version information of each modification or update; Step 6, Execution phase: According to the recorded version information of each modification or update, if a user attempts to access a data block in the USB smart storage device, the key management platform first verifies the user's identity and authority, and evaluates whether the user's request complies with the access control rules based on the user's identity and authority and the access control policy stored in the device. If the user's request complies with the rules, the private key is used to open the user to access the corresponding data block; if not, access is denied and a corresponding security alert is generated; Step 7, Maintenance phase: After the execution phase, the access policy is regularly tested.

[0009] Preferably, in the Step 1, a binary tree structure is used to store the user's attribute information, wherein each leaf node is associated with a pseudonym.

[0010] Preferably, in the Step 2, the attributes include identity, user and department, and the access rights include the required access data corresponding to the required user.

[0011] Preferably, in the Step 2, necessary attribute names are disclosed, including the user identity type, and the hidden specific attribute values ​​include the user's specific identity or user name.

[0012] Preferably, in the Step 5, the key management platform is used to record the version information of each modification or update.

[0013] Preferably, in the asymmetric encryption module and Step 3, the metadata includes a file name associated with the ciphertext and an encryption time.

[0014] Preferably, in the pseudonym establishment module, multiple pseudonyms are established using a pseudonym generation algorithm based on discrete logarithms using data in the key management platform. The specific operation steps are: a1. Initialization parameters: select a large prime number p and a primitive root g, and determine the unique identifier of the user's identity information as input; a2. Generate user private key: For each user, randomly select an integer x, calculate g^x mod p, and use the result as the user's master public key, where x is the user's private key; a3. Generate pseudonyms: Use the hash function H, take the unique identifier and g^x mod p as input, and output a fixed-length string as the pseudonym; a4. Storage and distribution: The generated pseudonym is associated with the user's unique identifier and stored in the database of the key management platform after the association is completed.

[0015] A method applicable to a storage encryption system comprises the following steps: b1. Connection and identification stage: First, insert the USB storage device into the USB interface of the computer, and automatically identify and read the device information of the USB storage device through the connection and identification module, including the name, model and capacity of the USB storage device; b2. Data preprocessing and preliminary encryption stage: read data from the USB storage device, preprocess the data using the time series relationship, extract key value features, and perform preliminary encryption on the extracted feature values; b3. Platform establishment stage: After the initial encryption, a key management platform is established based on the data on the USB storage device to store the key information and pseudonym information in the key management platform; b4, pseudonym establishment stage: using the data in the key management platform, a pseudonym generation algorithm based on discrete logarithms is used to generate multiple pseudonyms, and the generated pseudonyms are stored in a temporary storage area in the USB storage device; b5. Key generation and management stage: After the pseudonym storage is completed, the encryption public key and private key are generated according to the data in the key management platform, and the public key and private key are stored in the temporary storage area of ​​the USB storage device; b6, asymmetric encryption data stage: read the key value feature from the temporary storage area, use the public key to further encrypt the pre-processed data, generate the encrypted ciphertext, store the encrypted ciphertext in the dedicated storage area of ​​the USB smart storage device, and retain the metadata; b7, access policy setting stage: first, according to the attributes of the user in the ciphertext, the attributes in the policy are subdivided into attribute names and attribute values, a binary tree is constructed, and the leaf nodes of the binary tree are used to store the attribute information of the user, each leaf node is associated with a pseudonym, and the corresponding access rights are set. After the access rights are set, an attribute-based encryption policy is constructed, and the necessary user identity types are disclosed, and the specific identity or user name is hidden, and an encryption public key and private key are generated. The pre-processed data is further encrypted using the public key to obtain the encrypted ciphertext, and the ciphertext is stored in a dedicated storage area of ​​the USB smart storage device, and the file name and encryption time associated with the ciphertext are retained. The encrypted ciphertext is divided into multiple data blocks, and one or more tags are assigned to each data block. The relationship between the data blocks is defined, and access rules are set. Version control is implemented for each data block according to the access rules, allowing users to access specific versions of data blocks instead of the latest version or all versions. After the access is completed, the version information of each modification or update is recorded; b8. Execute access control phase: After the access policy setting phase is completed, the user first attempts to access the data block in the USB smart storage device. The key management platform first verifies the user's identity and permissions. Based on the user's identity and permissions and the access control policy stored in the device, it evaluates whether the user request complies with the access control rules. If the user request complies with the rules, the private key is used to open the user to access the corresponding data block; otherwise, access is denied and a corresponding security alert is generated; b9. Access policy maintenance phase: After the access control phase is completed, the access policy should be tested regularly. According to the security risk level of the information, a comprehensive test of USB storage devices should be conducted every quarter, half year or year. The test includes: checking whether the access policy can effectively prevent unauthorized access, evaluating whether the policy is too strict, and adjusting the attribute name and attribute value in the policy to optimize the policy.

[0016] Compared with the related art, the storage encryption system and method provided by the present invention has the following beneficial effects: The present invention firstly processes the data using a time series relationship, extracts key-value feature quantities and performs preliminary encryption processing on the feature values. After the preliminary encryption is completed, an encryption public key and a private key are used, and the encryption public key is used to further encrypt the data to obtain an encrypted ciphertext and retain metadata. An access strategy is set according to the encrypted ciphertext and metadata, and a pseudonym is used in combination with a leaf node of a binary tree to further encrypt the access strategy. A binary tree structure is used to store user attribute information, and each leaf node is associated with a pseudonym, thereby enhancing data security and effectively preventing unauthorized access and data leakage. At the same time, access rules and access control are set to allow users to access data blocks of a specific version, thereby improving data availability and security. The present invention establishes multiple pseudonyms, and the multiple pseudonyms are integrated with a binary tree constructed using user attributes, so that an isolation layer is established between the real identity of the user and the data stored on the device. Decentralized encryption helps prevent malicious attackers from launching attacks by associating user identities and data, thereby protecting the privacy rights and interests of users. If a user attempts to access a data block in a USB smart storage device, a key management platform first verifies the identity and authority of the user, and evaluates whether the user request complies with the access control rules based on the identity and authority of the user and the access control policy stored in the device. If the user request complies with the rules, a private key is used to open the user to access the corresponding data block; if not, access is denied and a corresponding security alarm is generated, thereby solving the problem that in the prior art, unauthorized users or malicious attackers can easily access and copy private and important data stored on the USB storage device, resulting in unnecessary losses caused by information leakage. The present invention uses data preprocessing and preliminary encryption modules, so that the system can encrypt key features of the data before further processing, thereby adding a layer of security barrier. In addition, the use of asymmetric encryption modules and access strategies means that even if the device is lost or stolen, unauthorized users cannot easily obtain sensitive information therein, thereby having the advantages of good confidentiality effect and high confidentiality. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of the overall storage encryption system provided by the present invention; Figure 2 A flowchart of the access policy is shown below; Figure 3 The present invention provides an overall flow chart of the storage encryption system method. DETAILED DESCRIPTION

[0018] The present invention will be further described below in conjunction with the accompanying drawings and implementation modes.

[0019] Please refer to Figures 1 to 3 ,in, Figure 1 A flowchart of the overall storage encryption system provided by the present invention; Figure 2 A flowchart of the access policy is shown below; Figure 3 The present invention provides an overall flow chart of the storage encryption system method.

[0020] In the specific implementation process, Figures 1 to 3 As shown, the storage encryption system includes: a connection and identification module, used to connect and identify the USB storage device; It should be noted that in the connection and identification module, when the USB storage device is inserted into the USB interface of the computer, the computer automatically identifies the inserted USB storage device through its own driver and obtains its model, capacity, manufacturer, data, etc. The computer authenticates the USB storage device.

[0021] The data preprocessing and preliminary encryption module uses the data on the USB storage device after identification, processes the data using the time series relationship, extracts the key value feature quantity and performs preliminary encryption processing on the feature value; It should be noted that in the data preprocessing and preliminary encryption module, the data to be encrypted is read from the USB storage device, the data is processed according to the reading order of the data or the time sequence relationship such as the timestamp to extract the key value feature quantity, and the AES encryption algorithm is used to preliminarily encrypt the extracted key value feature quantity; A platform establishment module establishes a key management platform based on the data on the USB storage device; A pseudonym creation module, using data in the key management platform to create multiple pseudonyms, and recording the multiple pseudonyms as a first pseudonym, a second pseudonym, and a third pseudonym; The key generation and management module generates encryption public keys and private keys according to the data in the key management platform, and stores the public keys, private keys and pseudonyms in a temporary storage area in the USB storage device; It should be noted that storing the generated public key, private key and previously generated pseudonym in a temporary storage area in the USB storage device can ensure the security of these keys and pseudonyms during the storage process; An asymmetric encryption module, used for reading the key-value feature quantity in the temporary storage area, further encrypting the pre-processed data using the public key, generating the encrypted ciphertext, storing the ciphertext in the dedicated storage area of ​​the USB smart storage device, and retaining the metadata; Data storage and access control module, which sets access policies based on stored ciphertext and metadata; Embodiment 1

[0022] Suppose we have a USB storage device containing sensitive information, which needs to be encrypted to ensure data security; Step 1: Insert the USB drive containing sensitive information into the USB port of the computer, start the storage encryption system in the computer, and select the connection and identification module. The system will automatically identify the USB drive information and display the manufacturer, model, data and capacity of the USB drive.

[0023] Step 2: After the display is completed, select the data preprocessing and preliminary encryption module. The system reads the financial management report .docx file on the USB flash drive, processes the file data using the time series relationship, extracts the key value feature, performs preliminary encryption on the feature value, and generates preliminary encrypted data; Step 3: After the initial encryption is completed, select the platform establishment module in the system, and the system will establish a key management platform based on the data on the USB flash drive; Step 4: After the platform is established, select the pseudonym establishment module in the system and use the data in the key management platform to generate three pseudonyms: the first pseudonym, for example, Xiao Wang, the second pseudonym, for example, Xiao Zhang, and the third pseudonym, for example, Xiao Li. The system associates these pseudonyms with the data on the USB flash drive. Step 5. Select the key generation and management module in the system, generate encryption public key and private key according to the data in the key management platform, and store the public key, private key and previously generated pseudonym in the temporary storage area in the USB flash drive. The temporary storage area is understood as: creating a folder named encryption key; Step 6: After the storage is completed, an asymmetric encryption module is selected in the system to read the key-value feature and the public key in the temporary storage area, and the initially encrypted data is further encrypted using the public key to generate an encrypted ciphertext, which is stored in a dedicated storage area of ​​the U disk smart storage device. The dedicated storage area is understood as: creating a folder named encrypted file and retaining metadata; Step 7. After the retention is completed, select the data storage and access control module in the system and set the access policy based on the stored ciphertext and metadata.

[0024] In the pseudonym creation module, multiple pseudonyms are created using the discrete logarithm-based pseudonym generation algorithm using the data in the key management platform. The specific steps are as follows: a1. Initialization parameters: select a large prime number p and a primitive root g, and determine the unique identifier of the user's identity information as input; the primitive root g is an integer that can generate all non-zero elements in the multiplication group modulo p; It should be noted that the primitive root g is chosen from the multiplicative group of integers modulo p; a2. Generate user private key: For each user, randomly select an integer x, calculate g^x mod p, and use the result as the user's master public key, where x is the user's private key and is a large random number; It should be noted that g is the primitive root, x is the user's private key, and p is a large prime number. The result of the calculation is an integer in the sense of modulo p, which serves as the user's master public key. The user's private key x is securely stored so that only authorized users can access it.

[0025] a3. Generate pseudonym: Use hash function H, take unique identifier and g^x mod p as input, and output a fixed length string as pseudonym; wherein unique identifier, such as user ID, and user's master public key, i.e. g^x mod p, are input to hash function H; It should be noted that the choice of hash function ensures the uniqueness and collision resistance of the output; a4. Storage and distribution: The generated pseudonym is associated with the user's unique identifier and stored in the database of the key management platform after the association is completed; It should be noted that associating the generated pseudonym with the user's unique identifier can be achieved by creating a record in the database of the key management platform, the record including the user's unique identifier and the corresponding pseudonym; It should be noted that when selecting a large prime number p, it is necessary to select a large prime number p from the number set in the USB storage device to ensure that p is large enough to resist the existing discrete logarithm attack.

[0026] References Figure 2As shown, the access policy includes the following steps: Step 1, preparation phase: first define the attributes of the user in the ciphertext of the asymmetric encryption module, and according to the user attributes, subdivide the attributes in the policy into attribute names and attribute values, build a binary tree, use the leaf nodes of the binary tree to store user attribute information, and set corresponding access rights; each leaf node is associated with a pseudonym; Step 2, attribute-based encryption strategy construction phase: According to user attributes and access rights, an attribute-based encryption strategy is constructed to disclose the user identity type and hide the user's specific identity or user name; the attributes include identity, user, and department, and the access rights include the required user corresponding to the required access data; Step 3, generation phase: according to the attribute-based encryption strategy, generate encryption public key and private key, use the public key to further encrypt the data pre-processed by S2, generate encrypted ciphertext, store the ciphertext in the dedicated storage area of ​​the USB smart storage device, and retain the metadata; It should be noted that in the asymmetric encryption module and Step 3, the metadata includes the file name associated with the ciphertext and the encryption time; Step 4, setting access rules: Divide the encrypted ciphertext into multiple data blocks, assign one or more tags to each data block, define the relationship between the data blocks and set access rules; the relationship between the data blocks is defined, including parent-child relationship or dependency relationship, and the access rules are set using the parent-child relationship. Only when the user can access the parent data block can the child data block be accessed; Step 5, Set up access control phase: Implement version control for each data block according to the access rules, allow users to access specific versions of data blocks, and use the key management platform to record the version information of each modification or update; Step 6, Execution phase: According to the recorded version information of each modification or update, if a user attempts to access a data block in the USB smart storage device, the key management platform first verifies the user's identity and authority, and evaluates whether the user's request complies with the access control rules based on the user's identity and authority and the access control policy stored in the device. If the user's request complies with the rules, the private key is used to open the user to access the corresponding data block; if not, access is denied and a corresponding security alert is generated; Step 7, Maintenance phase: After the execution phase, the access policy is regularly tested. Embodiment 2

[0027] Suppose there is a USB smart storage device containing sensitive financial data, which needs to be stored in encrypted form and ensure that only employees in specific departments and positions can access the relevant data.

[0028] Data: financial data files on a USB smart storage device, such as 2023 Financial Report.xlsx, and preset user attributes, such as Identity: Finance Department Manager, User: Zhang San, Department: Finance Department; To perform the analysis, there are the following steps: Phase 1, preparation phase: define user attributes, including identity, user, and department. After the definition is completed, build a binary tree. The leaf nodes store user attribute information. The identity is recorded as the manager of the financial department, the user is recorded as Zhang San, and the department is recorded as the financial department. Set a pseudonym for each leaf node. Pseudonym 1 corresponds to the identity: the manager of the financial department, pseudonym 2 corresponds to the user: Zhang San, and pseudonym 3 corresponds to the department: the financial department. At this time, set the access rights. Only users with the identity of the manager of the financial department can access the 2023 financial report.xlsx; Phase 2: Build an attribute-based encryption strategy based on user attributes and access rights, disclose user identity types, such as finance department manager, finance department employee, etc., but hide specific user names, such as Zhang San, etc., and set access rights so that only the finance department manager can access "2023 Financial Report.xlsx"; Phase 3: Generate encryption public and private keys according to the attribute-based encryption strategy, use the public key to further encrypt the 2023 financial report.xlsx, generate encrypted ciphertext, store the encrypted ciphertext in the dedicated storage area of ​​the USB smart storage device, and retain metadata, that is, the file name is 2023 financial report.xlsx, and the encryption time is 2024-12-01 10:00; Phase 4: Divide the encrypted ciphertext into multiple data blocks, divided by chapter or data category, assign one or more labels to each data block, such as financial data, first chapter, etc., define the parent-child relationship between data blocks, in which case financial data is the parent data block and the first chapter is the child data block, set access rules, and only users who can access financial data can access the first chapter of its child data block; Phase 5: Implement version control for each data block, record the version information of each modification or update, use the key management platform to record the version information, and set access control policies to allow specific users to access specific versions of data blocks; Stage 6: When a user attempts to access a data block in a USB smart storage device, such as accessing the first chapter, the key management platform verifies the user's identity and authority, and evaluates whether the user's request complies with the access control rules based on the user's identity and authority and the access control policy stored in the device. If the user's request complies with the rules, the private key is used to open the user's access to the corresponding data block; if not, access is denied and a corresponding security alert is generated, where the security alert is: access is denied, user Zhang San does not have the right to access the first chapter; Stage 7: Regularly test access policies, such as checking for unauthorized access attempts or security vulnerabilities. Based on the test results, update access policies or strengthen security measures, and record and analyze security alerts.

[0029] refer to Figures 1 to 3 As shown, the method for storing the encryption system includes the following steps: b1. Connection and identification stage: First, insert the USB storage device into the USB interface of the computer, and automatically identify and read the device information of the USB storage device through the connection and identification module, including the name, model and capacity of the USB storage device; b2. Data preprocessing and preliminary encryption stage: read data from the USB storage device, preprocess the data using the time series relationship, extract key value features, and perform preliminary encryption on the extracted feature values; b3. Platform establishment stage: After the initial encryption, a key management platform is established based on the data on the USB storage device to store the key information and pseudonym information in the key management platform; b4, pseudonym establishment stage: using the data in the key management platform, a pseudonym generation algorithm based on discrete logarithms is used to generate multiple pseudonyms, and the generated pseudonyms are stored in a temporary storage area in the USB storage device; b5. Key generation and management stage: After the pseudonym storage is completed, the encryption public key and private key are generated according to the data in the key management platform, and the public key and private key are stored in the temporary storage area of ​​the USB storage device; b6, asymmetric encryption data stage: read the key value feature from the temporary storage area, use the public key to further encrypt the pre-processed data, generate the encrypted ciphertext, store the encrypted ciphertext in the dedicated storage area of ​​the USB smart storage device, and retain the metadata; b7, access policy setting stage: first, according to the attributes of the user in the ciphertext, the attributes in the policy are subdivided into attribute names and attribute values, a binary tree is constructed, and the leaf nodes of the binary tree are used to store the attribute information of the user, each leaf node is associated with a pseudonym, and the corresponding access rights are set. After the access rights are set, an attribute-based encryption policy is constructed, and the necessary user identity types are disclosed, and the specific identity or user name is hidden, and an encryption public key and private key are generated. The pre-processed data is further encrypted using the public key to obtain the encrypted ciphertext, and the ciphertext is stored in a dedicated storage area of ​​the USB smart storage device, and the file name and encryption time associated with the ciphertext are retained. The encrypted ciphertext is divided into multiple data blocks, and one or more tags are assigned to each data block. The relationship between the data blocks is defined, and access rules are set. Version control is implemented for each data block according to the access rules, allowing users to access specific versions of data blocks instead of the latest version or all versions. After the access is completed, the version information of each modification or update is recorded; It should be noted that by constructing a binary tree and setting access rights, the accuracy of data access control is improved, ensuring that only legitimate users can access the data; b8. Execute access control phase: After the access policy setting phase is completed, the user first attempts to access the data block in the USB smart storage device. The key management platform first verifies the user's identity and permissions. Based on the user's identity and permissions and the access control policy stored in the device, it evaluates whether the user request complies with the access control rules. If the user request complies with the rules, the private key is used to open the user to access the corresponding data block; otherwise, access is denied and a corresponding security alert is generated; b9. Access policy maintenance phase: After the access control phase is completed, the access policy should be tested regularly. According to the security risk level of the information, a comprehensive test of USB storage devices should be conducted every quarter, half year or year. The test includes: checking whether the access policy can effectively prevent unauthorized access, evaluating whether the policy is too strict, and adjusting the attribute name and attribute value in the policy to optimize the policy.

[0030] It should be noted that regular testing and optimization of access policies can ensure the timeliness and effectiveness of access policies and improve overall security; It should be noted that through multi-level and multi-step encryption processing, data security is greatly enhanced to prevent unauthorized access and data leakage; It should be noted that by establishing multiple pseudonyms, multiple pseudonyms are integrated with the binary tree constructed using user attributes, so that an isolation layer is established between the user's real identity and the data stored on the device. Decentralized encryption helps prevent malicious attackers from launching attacks by associating user identities and data, thereby protecting the user's privacy rights and interests. If a user attempts to access a data block in a USB smart storage device, the key management platform first verifies the user's identity and authority, and evaluates whether the user request complies with the access control rules based on the user's identity and authority and the access control policy stored in the device. If the user request complies with the rules, the private key is used to open the user to access the corresponding data block; if not, access is denied and a corresponding security alert is generated; It should be noted that the data is first processed using a time series relationship, key-value features are extracted, and the feature values ​​are preliminarily encrypted. After the preliminary encryption is completed, the encryption public key and private key are used to further encrypt the data with the encryption public key to obtain the encrypted ciphertext and retain the metadata. The access policy is set according to the encrypted ciphertext and metadata, and the access policy is further encrypted by combining pseudonyms with leaf nodes of a binary tree. A binary tree structure is used to store user attribute information, and each leaf node is associated with a pseudonym, which enhances the security of the data and effectively prevents unauthorized access and data leakage. At the same time, access rules and access controls are set to allow users to access specific versions of data blocks, thereby improving the availability and security of the data.

[0031] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. For those skilled in the art, it is obvious that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is defined by the attached claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention, and any figure mark in the claims should not be regarded as limiting the claims involved.

[0032] In addition, it should be understood that although the present specification is described according to implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment may also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.

Claims

1. A storage encryption system, characterized in that: include: A connection and identification module, used for connecting and identifying USB storage devices; The data preprocessing and preliminary encryption module is used to process the data on the USB storage device according to the identified data using a time sequence relationship, extract key value feature quantities and perform preliminary encryption processing on the feature values; A platform establishment module, used to establish a key management platform according to the data on the USB storage device; A pseudonym creation module, used to create multiple pseudonyms based on data in the key management platform; A key generation and management module, used to generate encryption public keys and private keys according to the data in the key management platform, and store the public keys, private keys and pseudonyms in a temporary storage area in the USB storage device; An asymmetric encryption module, used for reading key-value feature quantities in the temporary storage area, further encrypting the pre-processed data using a public key, generating encrypted ciphertext, and storing the ciphertext in a dedicated storage area of ​​a USB smart storage device, and retaining metadata; The data storage and access control module is used to set access policies based on stored ciphertext and metadata.

2. The storage encryption system according to claim 1, characterized in that: The access strategy includes the following steps: Step 1, preparation phase: first define the attributes of the user in the ciphertext of the asymmetric encryption module, and according to the user attributes, subdivide the attributes in the policy into attribute names and attribute values, build a binary tree, use the leaf nodes of the binary tree to store user attribute information, and set the corresponding access rights; Step 2: Build attribute-based encryption strategy: Build attribute-based encryption strategy based on user attributes and access rights, disclose necessary attribute names, and hide specific attribute values; Step 3, generation phase: according to the attribute-based encryption strategy, generate encryption public key and private key, use the public key to further encrypt the data preprocessed in the data preprocessing and preliminary encryption module, generate encrypted ciphertext, store the ciphertext in the dedicated storage area of ​​the USB smart storage device, and retain the metadata; Step 4, setting access rules: Divide the encrypted ciphertext into multiple data blocks, assign one or more tags to each data block, define the relationship between the data blocks and set access rules; Step 5, Set up access control phase: Implement version control on each data block according to the access rules, allow users to access specific versions of data blocks, and record the version information of each modification or update; Step 6, Execution phase: According to the recorded version information of each modification or update, if a user attempts to access a data block in the USB smart storage device, the key management platform first verifies the user's identity and authority, and evaluates whether the user's request complies with the access control rules based on the user's identity and authority and the access control policy stored in the device. If the user's request complies with the rules, the private key is used to open the user to access the corresponding data block; if not, access is denied and a corresponding security alert is generated; Step 7, Maintenance phase: After the execution phase, the access policy is regularly tested.

3. The storage encryption system according to claim 2, characterized in that: In the Step 1, a binary tree structure is used to store the user's attribute information; wherein each leaf node is associated with a pseudonym, and in the Step 2, the attributes include identity, user, and department, and the access rights include the required access data corresponding to the required user.

4. The storage encryption system according to claim 3, characterized in that: In the Step 2, necessary attribute names are disclosed, including user identity type, and the hidden specific attribute values ​​include specific identity or user name.

5. The storage encryption system according to claim 4, characterized in that: In the pseudonym creation module, the plurality of pseudonyms are recorded as a first pseudonym, a second pseudonym, and a third pseudonym.

6. The storage encryption system according to claim 5, characterized in that: In the Step 4, the relationship between data blocks is defined, including the parent-child relationship or dependency relationship, and the access rules are set using the parent-child relationship.

7. The storage encryption system according to claim 6, characterized in that: In the Step 5, the key management platform is used to record the version information of each modification or update.

8. The storage encryption system according to claim 7, characterized in that: In the asymmetric encryption module and Step 3, the metadata includes the file name associated with the ciphertext and the encryption time.

9. The storage encryption system according to claim 8, characterized in that: In the pseudonym establishment module, multiple pseudonyms are established using a pseudonym generation algorithm based on discrete logarithms using data in the key management platform. The specific operation steps are as follows: a1. Initialization parameters: select a large prime number p and a primitive root g, and determine the unique identifier of the user's identity information as input; a2. Generate user private key: For each user, randomly select an integer x, calculate g^x mod p, and use the result as the user's master public key, where x is the user's private key; a3. Generate pseudonyms: Use the hash function H, take the unique identifier and g^x mod p as input, and output a fixed-length string as the pseudonym; a4. Storage and distribution: The generated pseudonym is associated with the user's unique identifier and stored in the database of the key management platform after the association is completed.

10. A method for storing an encryption system according to any one of claims 1 to 9, characterized in that: The steps are as follows: b1. Connection and identification stage: First, insert the USB storage device into the USB interface of the computer, and automatically identify and read the device information of the USB storage device through the connection and identification module, including the name, model and capacity of the USB storage device; b2. Data preprocessing and preliminary encryption stage: read data from the USB storage device, preprocess the data using the time series relationship, extract key value features, and perform preliminary encryption on the extracted feature values; b3. Platform establishment stage: After the initial encryption, a key management platform is established based on the data on the USB storage device to store the key information and pseudonym information in the key management platform; b4, pseudonym establishment stage: using the data in the key management platform, a pseudonym generation algorithm based on discrete logarithms is used to generate multiple pseudonyms, and the generated pseudonyms are stored in a temporary storage area in the USB storage device; b5. Key generation and management stage: After the pseudonym storage is completed, the encryption public key and private key are generated according to the data in the key management platform, and the public key and private key are stored in the temporary storage area of ​​the USB storage device; b6, asymmetric encryption data stage: read the key value feature from the temporary storage area, use the public key to further encrypt the pre-processed data, generate the encrypted ciphertext, store the encrypted ciphertext in the dedicated storage area of ​​the USB smart storage device, and retain the metadata; b7, access policy setting stage: first, according to the attributes of the user in the ciphertext, the attributes in the policy are subdivided into attribute names and attribute values, a binary tree is constructed, and the leaf nodes of the binary tree are used to store the attribute information of the user, each leaf node is associated with a pseudonym, and the corresponding access rights are set. After the access rights are set, an attribute-based encryption policy is constructed, and the necessary user identity types are disclosed, and the specific identity or user name is hidden, and an encryption public key and private key are generated. The pre-processed data is further encrypted using the public key to obtain the encrypted ciphertext, and the ciphertext is stored in a dedicated storage area of ​​the USB smart storage device, and the file name and encryption time associated with the ciphertext are retained. The encrypted ciphertext is divided into multiple data blocks, and one or more tags are assigned to each data block. The relationship between the data blocks is defined, and access rules are set. Version control is implemented for each data block according to the access rules, allowing users to access specific versions of data blocks instead of the latest version or all versions. After the access is completed, the version information of each modification or update is recorded; b8. Execute access control phase: After the access policy setting phase is completed, the user first attempts to access the data block in the USB smart storage device. The key management platform first verifies the user's identity and permissions. Based on the user's identity and permissions and the access control policy stored in the device, it evaluates whether the user request complies with the access control rules. If the user request complies with the rules, the private key is used to open the user to access the corresponding data block; Otherwise, access is denied and a corresponding security alert is generated; b9. Access policy maintenance phase: After the access control phase is completed, the access policy should be tested regularly. According to the security risk level of the information, a comprehensive test of USB storage devices should be conducted every quarter, half year or year. The test includes: checking whether the access policy can effectively prevent unauthorized access, evaluating whether the policy is too strict, and adjusting the attribute name and attribute value in the policy to optimize the policy.

Images