A data security storage method, system, client and server

Abstract

The present disclosure proposes a data security storage method, system, client and server, and the storage method includes the following steps: the client obtains identity authentication information, extracts the hash value of the identity authentication information, and transmits it to the server; the server verifies the hash value of the identity authentication information sent by the client; when the verification is passed, the client sends the encrypted ciphertext of the data to the server for storage; or / and, the client obtains the ciphertext stored on the server and then decrypts it. The present disclosure encrypts the data at the software level, and the key verification and data encryption and decryption operations are all performed on the client, that is, locally. All the network transmissions are ciphertexts, and the server stores ciphertexts as well. The data can be securely stored in a relatively unreliable server environment, thereby ensuring the security of the core data.

Description

Technical Field

[0001] The present disclosure relates to the technical field related to big data storage, and more specifically, to a data security storage method, system, client, and server. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

[0003] With the gradual popularization of Internet and Internet of Things applications, the amount of data is growing faster and faster, and cloud storage of enterprise data has also become a trend. Therefore, how to store data securely has become a more important issue. Although the cloud computing infrastructure provides a certain degree of security, if the system data is stolen, it will undoubtedly bring huge losses.

[0004] Cloud storage is an important service type provided by cloud service providers to users. Since users store data in the cloud, the transparency of cloud services makes users lose the management and control of data. At the same time, the credibility of cloud service providers is not easy to evaluate and guarantee. Therefore, while users widely use cloud storage services, it is necessary to establish a security mechanism for cloud storage services to ensure the security of user data. At present, data leakage incidents on the Internet are emerging in an endless stream. Under the current technical environment, there is no transparent and reliable security mechanism to ensure the security of data storage, which has caused a trust crisis between users and service providers, restricting the development of big data and the Internet of Things. Summary of the invention

[0005] In order to solve the above problems, the present disclosure proposes a data security storage method, system, client and server, which can securely store data in a relatively unreliable server environment through software-level encryption, thereby ensuring the security of core data.

[0006] In order to achieve the above objectives, the present disclosure adopts the following technical solutions:

[0007] One or more embodiments provide a data security storage method, comprising the following steps:

[0008] The client obtains the identity authentication information, extracts the hash value of the identity authentication information, and transmits it to the server;

[0009] The server verifies the hash value of the identity authentication information received from the client;

[0010] When the verification is successful, the client sends the encrypted ciphertext to the server for storage; or / and, the client obtains the ciphertext stored on the server and decrypts it.

[0011] One or more embodiments provide a data security storage system, which is characterized by comprising at least one server and one client, and the data interaction method between the server and the client adopts the above-mentioned data security storage method.

[0012] One or more embodiments provide a data security storage method, comprising the following steps:

[0013] The server obtains the hash value extracted from the identity authentication information sent by the client;

[0014] The server verifies the hash value of the identity authentication information received from the client;

[0015] When the verification is passed, if the server receives the data sent by the client, it will save the data; if it receives a data query request, the server will search for data according to the query request and send the found data to the client.

[0016] One or more embodiments provide a data security storage method, comprising the following steps:

[0017] The client obtains the identity authentication information, extracts the hash value of the identity authentication information, and transmits it to the server so that the server performs verification based on the hash value of the identity authentication information;

[0018] If the verification is successful, the client sends the encrypted ciphertext to the server for storage; or / and, the client obtains the ciphertext stored on the server and decrypts it.

[0019] One or more embodiments provide a server, wherein the server executes the above-mentioned data security storage method.

[0020] One or more embodiments provide a client, wherein the client executes the above-mentioned data security storage method.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] The disclosed data security storage method, system, client and server, key verification and data encryption and decryption operations are all performed locally on the client, all network transmissions are ciphertext, and the server stores ciphertext. Even if the server data is obtained by unauthorized personnel, the attacker can only get the one-way hash result of the ciphertext and the key, the key itself will not be leaked, and the data itself is safe. In addition, even if the communication certificate is tampered with in special circumstances, the middleman still cannot decrypt the data without the key, which improves the security of data storage.

[0023] The advantages of the present disclosure and the advantages of additional aspects will be described in detail in the following specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure. The exemplary embodiments of the present disclosure and the description thereof are used to explain the present disclosure but do not constitute a limitation of the present disclosure.

[0025] Figure 1 This is a schematic diagram of the data storage method flow in Embodiment 1 of the present disclosure;

[0026] Figure 2 is a flow chart of a data storage method according to Embodiment 1 of the present disclosure;

[0027] Figure 3 is a flowchart of a data storage method according to Embodiment 2 of the present disclosure;

[0028] Figure 4 It is a flowchart of the data storage method of embodiment 3 of the present disclosure. DETAILED DESCRIPTION

[0029] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0030] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0031] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof. It should be noted that, in the absence of conflict, the various embodiments in the present disclosure and the features in the embodiments can be combined with each other. The embodiments will be described in detail below in conjunction with the accompanying drawings.

[0032] Technical term explanation

[0033] Sha-256: sha is a secure hash standard algorithm, sha-2 is an upgraded version of sha, sha-256 is a type of sha2, and can generate a 256-bit, i.e. 32B, hash value. This disclosure is mainly used to normalize the password length and does not involve the core security part.

[0034] Argon2: It belongs to a class of key derivation functions, based on AES implementation, including Argon2d, Argon2i, and Argon2id. Argon2d can resist GPU cracking attacks to the greatest extent, Argon2i is specially optimized to resist side channel attacks, and Argon2id is a hybrid version. It follows the Argon2i method when passing through the memory in the first half, and follows the Argon2d method in subsequent traversals, combining the advantages of both. This disclosure adopts the Argon2id method to achieve secure storage of keys.

[0035] AES: The full name is Advanced Encryption Standard. It is an alternative version of DES and a mainstream algorithm in symmetric encryption. It mainly considers the efficient performance of encrypting large amounts of data. AES is divided into several modes: ECB, CBC, CFB, OFB, CTR, CCM, GCM, etc. In this disclosure, AES-GCM is selected as the data encryption algorithm, and the key length is selected to be a relatively long 256 bits to improve security.

[0036] HTTPS: The full name is Hypertext Transfer Protocol Secure, also known as HTTP over TLS, which is a transmission protocol for secure communication over computer networks. HTTPS provides identity authentication for website servers and protects the privacy and integrity of exchanged data.

[0037] The content of this disclosure includes two parts: user information verification and data storage security. On the one hand, data resources can only be accessed after the permission verification is passed. On the other hand, the data resources themselves are encrypted with user keys, and can only be automatically decrypted after verification. Even if the system data is leaked, others cannot decrypt the data, and the data itself is still safe. Based on this technical solution, the core data can be reliably stored on the shared hardware resources, which not only ensures the flexibility of the cloud, but also ensures the security of the data. The following is an explanation with a specific embodiment.

[0038] Example 1

[0039] like Figure 1 and 2 As shown, a data security storage system of this embodiment includes at least one server and one client, and the server and the client perform network communication to achieve mutual data transmission.

[0040] In the technical solutions disclosed in one or more embodiments, Figure 1 As shown, a data security storage method is used to implement data interaction between a server and a client in a system and implement secure data storage, including the following steps:

[0041] Step 1: The client obtains the identity authentication information, extracts the hash value of the identity authentication information, and transmits it to the server;

[0042] Step 2: The server verifies the hash value of the identity authentication information received from the client;

[0043] Step 3: When the verification is successful, the client sends the encrypted ciphertext to the server for storage; or / and, the client obtains the ciphertext stored on the server and decrypts it.

[0044] In this embodiment, all key verification and data encryption and decryption operations are performed locally on the client, and all network transmissions are ciphertext, and the server stores ciphertext. Even if the server data is obtained by unauthorized personnel, the attacker can only get the one-way hash result of the ciphertext and the key, and the key itself will not be leaked, and the data itself is safe. In addition, even if the communication certificate is tampered with in special circumstances, the middleman still cannot decrypt the data without the key, which improves the security of data storage.

[0045] Also included are steps for information initialization:

[0046] Step 41: The client binds the client to the user information and receives the identity setting information input by the user;

[0047] Step 42: The client generates a random salt value string according to the input identity setting information and verifies the user identity;

[0048] The method of verifying the user's identity may specifically be verification via a mobile phone text message or email.

[0049] Step 43: If the verification is successful, the client generates a one-way key using the SHA-256 algorithm using the identity setting information obtained;

[0050] Step 44: The client uses the key and salt to calculate the final authorization hash value, i.e., the Auth Hash value, using the Argon2 key derivation algorithm.

[0051] Step 45: The client sends the obtained salt value (salt) and authorization hash value (Auth Hash value) to the server for storage.

[0052] The specific process can be as follows: When a user uses the device for the first time, he can register an account and bind the device through email information and mobile phone information, and set a username and password. The program automatically generates a random salt value string locally, confirms the user's identity through the email or mobile phone verification code, and generates a one-way key through the user's input through the sha-256 algorithm. Then, the Argon2 key derivation algorithm is used to calculate the final Auth Hash value through the key (key) and salt value (salt), and the salt value and Auth Hash are securely transmitted to the server through the HTTPS protocol for storage. If you change the device to use the original account, you still need to verify the identity (such as email address, mobile phone number) before the server can send the salt value.

[0053] Optionally, in step 1, the client obtains the identity authentication information, and the method for extracting the hash value of the identity authentication information is specifically:

[0054] Step 11: Calculate the key using a secure hashing algorithm based on the identity authentication information;

[0055] Specifically, the secure hash standard algorithm may adopt the SHA-256 algorithm;

[0056] The key is used for user authentication and data encryption and decryption.

[0057] Step 12: Use a hash algorithm to generate a hash value for the obtained key. The hash value is the hash value.

[0058] Optionally, the hash algorithm may use a key derivation function, specifically the Argon2 algorithm.

[0059] The identity authentication information may be the user name and password information input by the customer to be authorized.

[0060] In step 2, the server verifies the hash value of the identity authentication information received from the client, including the following steps:

[0061] Step 21: The client obtains the identity setting information, extracts the authorization hash value of the identity setting information, and transmits it to the server for storage.

[0062] The identity setting information may include the user name and password initially set by the customer.

[0063] Step 22: The server compares the hash value of the identity authentication information with the pre-stored authorization hash value. If they are consistent, the authentication is successful. Otherwise, the authentication fails and the server denies access.

[0064] Optionally, the client and the server use the HTTPS protocol for data transmission.

[0065] In this embodiment, the specific process of authorization in steps 1 and 2 is as follows: the user enters the user name and password information on the client, and the sha-256 algorithm is used on the client to calculate the key, which is used for user verification and data encryption and decryption operations. Then the key is calculated by the Argon2 key derivation algorithm using the locally stored salt value to calculate the hash value for authentication, and finally the hash value is securely transmitted to the server through the HTTPS protocol and compared with the Auth Hash stored on the server. If the comparison is successful, the authorization is passed, otherwise the authorization fails and access is denied.

[0066] If the user does not have a pre-stored salt value locally, it will be re-initialized and obtained from the server. When registering an account for the first time, it will be generated locally and saved to the server. The salt value can be changed. In order to improve security, it can support re-encryption of data. At this time, the salt value will be regenerated. You can choose to execute it regularly or when the user changes the password.

[0067] In step 3, there is a method for storing and / or querying data.

[0068] Optionally, the client can encrypt the data to obtain the ciphertext by using the sha-256 key through the AES-GCM-256 algorithm to encrypt the plaintext data to generate the ciphertext. Specifically, as follows:

[0069] key=sha256(password)

[0070] ciphertext=AES-GCM-256-Seal(plaintext,key,salt)

[0071] Among them, password is the password, key is the key, plaintext is the plaintext, salt is the salt, and ciphertext is the ciphertext.

[0072] After verification, the server authorizes the client. The authorized user can obtain the ciphertext through the server and transmit the ciphertext to the client via https. The client can use the encrypted and saved sha-256 key to decrypt it and see the original data in plain text.

[0073] The client obtains the ciphertext stored on the server and then decrypts it. The ciphertext is decrypted using the AES-GCM-256 algorithm to generate plaintext, which is the reverse process of the encryption process, as follows:

[0074] According to the key, salt value and ciphertext, the plaintext is finally obtained:

[0075] Plaintext=AES-GCM-256-Open(ciphertext,key,salt)

[0076] Example 2

[0077] Based on Example 1, this embodiment provides a data security storage method, which can be implemented in a server, such as Figure 3 As shown, the following steps are included:

[0078] Step 1: The server obtains the hash value extracted from the identity authentication information sent by the client;

[0079] Step 2: The server verifies the hash value of the identity authentication information received from the client;

[0080] Step 3: When the verification is passed, if the server receives data sent by the client, it will save the data; if it receives a data query request, the server will search for data according to the query request and send the found data to the client.

[0081] In step 1, the method of extracting the hash value according to the identity authentication information includes the following steps:

[0082] Step 11: Calculate the key using a secure hashing algorithm based on the identity authentication information;

[0083] Specifically, the secure hash standard algorithm may adopt the SHA-256 algorithm;

[0084] The key is used for user authentication and data encryption and decryption.

[0085] Step 12: Use a hash algorithm to generate a hash value for the obtained key. The hash value is the hash value.

[0086] Optionally, the hash algorithm may use a key derivation function, specifically the Argon2 algorithm.

[0087] The identity authentication information may be the user name and password information input by the customer to be authorized.

[0088] The method for verifying the hash value of the identity authentication information sent by the client is specifically as follows: comparing the hash value of the identity authentication information with the pre-stored authorization hash value. If they are consistent, the authentication is passed; otherwise, the authentication fails and the server denies access;

[0089] The authorization hash value is obtained based on the identity setting information stored by the client for the first time, and can be obtained on the client and transmitted to the server for storage, including the following steps:

[0090] Step 21: Generate a random salt value string according to the input identity setting information;

[0091] Step 22: Generate a one-way key using the SHA-256 algorithm using the obtained identity setting information;

[0092] Step 23: Use the key and salt value to calculate the final authorization hash value, namely, the Auth Hash value, using the Argon2 key derivation algorithm.

[0093] Example 3

[0094] Based on Example 1, this embodiment provides a data security storage method, which can be implemented in the client, such as Figure 4 As shown, the following steps are included:

[0095] Step 1: The client obtains the identity authentication information, extracts the hash value of the identity authentication information, and transmits it to the server so that the server performs verification based on the hash value of the identity authentication information;

[0096] Step 2: If the verification is successful, the client sends the encrypted ciphertext to the server for storage; or / and, the client obtains the ciphertext stored on the server and decrypts it.

[0097] Also included are steps for information initialization:

[0098] Step 31: The client binds the client to the user information and receives the identity setting information input by the user;

[0099] Step 32: The client generates a random salt value string based on the input identity setting information and verifies the user identity;

[0100] The method of verifying the user's identity may specifically be verification via a mobile phone text message or email.

[0101] Step 33: After the user identity verification is successful, the client generates a one-way key using the SHA-256 algorithm using the identity setting information obtained;

[0102] Step 34: The client uses the key and salt to calculate the final authorization hash value, i.e., the Auth Hash value, using the Argon2 key derivation algorithm.

[0103] Step 35: The client sends the obtained salt value (salt) and authorization hash value (Auth Hash value) to the server for storage.

[0104] Optionally, in step 1, the client obtains the identity authentication information, and the method for extracting the hash value of the identity authentication information is specifically:

[0105] Step 11: Calculate the key using a secure hashing algorithm based on the identity authentication information;

[0106] Specifically, the secure hash standard algorithm may adopt the SHA-256 algorithm;

[0107] The key is used for user authentication and data encryption and decryption.

[0108] Step 12: Use a hash algorithm to generate a hash value for the obtained key. The hash value is the hash value.

[0109] Optionally, the hash algorithm may use a key derivation function, specifically the Argon2 algorithm.

[0110] The identity authentication information may be the user name and password information input by the customer to be authorized.

[0111] In step 2, it is a method for storing and / or querying data.

[0112] Optionally, the client can encrypt the data to obtain the ciphertext by using the sha-256 key through the AES-GCM-256 algorithm to encrypt the plaintext data to generate the ciphertext. Specifically, as follows:

[0113] key=sha256(password)

[0114] ciphertext=AES-GCM-256-Seal(plaintext,key,salt)

[0115] Among them, password is the password, key is the key, plaintext is the plaintext, salt is the salt, and ciphertext is the ciphertext.

[0116] After verification, the server authorizes the client. The authorized user can obtain the ciphertext through the server and transmit the ciphertext to the client via https. The client can use the encrypted and saved sha-256 key to decrypt it and see the original data in plain text.

[0117] The client obtains the ciphertext stored on the server and then decrypts it, using the AES-GCM-256 algorithm to generate plaintext, which is the reverse process of the encryption process, as follows:

[0118] According to the key, salt value and ciphertext, the plaintext is finally obtained:

[0119] Plaintext=AES-GCM-256-Open(ciphertext,key,salt)

[0120] Example 4

[0121] Based on Example 2, this example provides a server, and the server executes the method described in Example 2.

[0122] Example 5

[0123] Based on Example 3, this embodiment provides a client, which executes the method described in Example 3.

[0124] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

[0125] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Technical personnel in the relevant field should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A data security storage method, characterized in that: The steps include: The client obtains identity authentication information, specifically: The client binds the client to the user information and receives the identity setting information entered by the user; The client generates a random salt value string based on the input identity setting information and verifies the user's identity, wherein the method of verifying the user's identity is through mobile phone text message or email verification; Extract the hash value of the identity authentication information and transmit it to the server; the extraction of the hash value of the identity authentication information is specifically as follows: after the user identity authentication is passed, the client generates a one-way key by using the sha-256 algorithm with the obtained identity setting information; the client uses the Argon2 key derivation algorithm to calculate the final authorized hash value with the key and the salt value; the client sends the obtained salt value and the authorized hash value to the server for storage; The server verifies the hash value of the identity authentication information received from the client; When the verification is successful, the client sends the encrypted ciphertext to the server for storage; or / and, the client obtains the ciphertext stored on the server and decrypts it.

2. A data security storage method as claimed in claim 1, characterized in that: The server verifies the hash value of the identity authentication information sent by the client, including the following steps: The client obtains the identity setting information, extracts the authorization hash value of the identity setting information, and transmits it to the server for storage; The server compares the hash value of the identity authentication information with the pre-stored authorization hash value. If they match, the authentication is successful. Otherwise, the authentication fails and the server denies access. The client encrypts data to obtain ciphertext by: encrypting the plaintext data using the SHA-256 key through the AES-GCM-256 algorithm to generate ciphertext; Alternatively, the client obtains the ciphertext stored on the server and then decrypts it, and decrypts the ciphertext using the AES-GCM-256 algorithm to generate plaintext.

3. A data security storage system, characterized by: It comprises at least one server and one client, and the data interaction method between the server and the client adopts a data security storage method as described in any one of claims 1-2.

4. A data security storage method, characterized in that: The steps include: The server obtains the hash value extracted from the identity authentication information sent by the client, and verifies the hash value received from the client; When the verification is passed, if the server receives the encrypted ciphertext data sent by the client, the server will save the ciphertext data; if it receives a data query request, the server will search for data according to the query request and send the found ciphertext data to the client; The server obtains the hash value extracted from the identity authentication information sent by the client, including the following steps: The client binds the client to the user information and receives the identity setting information entered by the user; The client generates a random salt value string based on the input identity setting information and verifies the user's identity, wherein the method of verifying the user's identity is through mobile phone text message or email verification; After the user identity authentication is passed, the client will use the SHA-256 algorithm to generate a one-way key using the identity setting information obtained; the client will use the Argon2 key derivation algorithm to calculate the final authorization hash value using the key and salt value.

5. A data security storage method, characterized in that: The steps include: The client obtains identity authentication information, specifically: The client binds the client to the user information and receives the identity setting information entered by the user; The client generates a random salt value string based on the input identity setting information and verifies the user's identity, wherein the method of verifying the user's identity is through mobile phone text message or email verification; After the user identity authentication is passed, the hash value of the identity authentication information is extracted so that the server can perform verification based on the hash value of the identity authentication information; if the verification is passed, the client sends the encrypted ciphertext of the data to the server for storage; or / and, the client obtains the ciphertext stored on the server and then decrypts it; The client encrypts data to obtain ciphertext by: encrypting the plaintext data using the SHA-256 key through the AES-GCM-256 algorithm to generate ciphertext; The client obtains the ciphertext stored on the server and then decrypts it, using the AES-GCM-256 algorithm to decrypt the ciphertext and generate plaintext; The hash value of the extracted identity authentication information is specifically: The client uses the SHA-256 algorithm to generate a one-way key using the identity setting information it obtains. The client uses the Argon2 key derivation algorithm to calculate the final authorized hash value using the key and salt value. The client sends the obtained salt value and authorized hash value to the server for storage.

6. A server, characterized in that: The server executes the data security storage method described in claim 4.

7. A client, characterized by: The client executes the data security storage method described in claim 5.

Images