Data storage security management method based on key shielding

Abstract

The present invention relates to a data storage security management method based on key shielding, belonging to the field of information technology, and comprising the following steps: S1, a key server collects public keys of members of a quantum-safe cryptographic system, and then generates secret vectors for the members; S2, the key server sends the member secret vectors encrypted using the member public keys; each member decrypts the received private message using its private key to extract its secret vector; S3, the key server generates a TEK and solves a linear system, sending the linear system solution in the form of a broadcast message; S4, each member opens a security lock using its own secret vector to obtain a traffic encryption key (TEK). This method can achieve data storage security and improve the security of the stored data itself, effectively improving data read and write performance, and improving the performance of data security operations compared to current standard implementations.

Description

Technical Field

[0001] The invention belongs to the field of information technology and relates to a data storage security management method based on key shielding. Background Art

[0002] Education, healthcare, and other sectors are currently leveraging cloud environments to store and process business operations. Cloud services offer vast computing resources and storage space, eliminating the need for users to maintain data on local machines. Consequently, users' data storage, availability, and integrity are completely dependent on cloud services. While cloud computing infrastructure and service providers are highly reliable and robust, data security still presents risks. Therefore, encryption technology is crucial for secure data storage.

[0003] Furthermore, the sheer volume of internet traffic has created a pressing need for cryptography designed to be secure against quantum attackers, known as "post-quantum," "quantum-safe," or "quantum-resistant" cryptography. The effectiveness of cryptographic systems, whether quantum-safe or not, crucially depends on the security of secret / private keys. Protecting information, then, becomes a matter of protecting these keys from unauthorized access.

[0004] Cryptographic key management is crucial to the effective use of cryptographic technology. As the number of assets protected by encryption increases, the number of keys requiring management also increases. Protecting the security of these keys has never been more challenging, nor more necessary. A compromised cryptographic key could trigger a massive information breach, leading to reputational damage, investor losses, and loss of customer confidence. With the exception of some quantum or quantum resistance-based cryptographic systems, quantum key management has not received sufficient attention from researchers. While cryptography is powerful in protecting information, it relies heavily on the security of secret, private encryption keys. Poor key management can compromise any robust cryptographic algorithm. Protecting information, then, becomes simply a matter of protecting these keys from unauthorized access. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a data storage security management method based on key shielding, which is used to achieve the security of data storage and improve the security of the stored data itself, while effectively improving the reading and writing performance of data, and making the performance of data security operations better than the current standard implementation.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] A data storage security management method based on key shielding. To ensure confidentiality and integrity during a session, the sender (source) shares an encryption key, called the traffic encryption key (TEK), with all valid recipients. Once an encrypted email encrypted by the TEK is received, only the valid recipient holding the TEK can decrypt the received email. Since new members can join or leave, the number of recipients is not fixed. The specific steps include:

[0008] S1. The key server collects the public keys of the members of the quantum-safe cryptography system [pk1...pk n ], then the key server generates the member's secret vector [A1...A n ];

[0009] S2. The key server sends the member secret vector encrypted with the member's public key. Each member uses its private key (sk i ) decrypts the received private message to extract its secret vector (A i );

[0010] S3, the key server generates TEK and solves the linear system; the key server sends the linear system solution [x1...x n ];

[0011] S4. Each member will open the security lock by using its own secret vector to obtain the traffic encryption key TEK.

[0012] Further, in step S2, the secret vector [A1...A n ] consists of q non-zero random numbers, each of which is A L A L Represents the key shielding building block (A i ) security parameter of the required bit strength; the bit length of the secret vector is A L =A L ×q, where A L Greater than the shared key TEK L Length; To ensure security, each element a i，j At least a L bit length and satisfies the following formula:

[0013]

[0014] In order to make the key shielding scheme immune to brute force attacks, it is necessary to ensure that the bandwidth of the matrix A is greater than 1. By doing so, it is ensured that launching a brute force attack on TEK is faster than on A. i It's easier to get on.

[0015] Furthermore, in step S3, the linear system A×X=B is shown as a distribution scheme of the key by the following equation:

[0016]

[0017] X represents the security lock that will be shared publicly, B is the vector of shared TEK, and A is the secret matrix, where each row Ai = [A i , 1...A i ,n] is assigned to a member, once the member has its own secret vector A i , the key center will generate TEK and solve the system problem; the key center solves the linear system and solves [x1...x n ] is sent to everyone. Each member will use its secret vector (A i ) obtain the shared key (A i ×X=TEK).

[0018] Furthermore, in this method, key shielding ensures that new members should not learn the previously used TEK key and secret vector A. Once a member joins, the rekeying process will begin to refresh the old TEK and regenerate new secret vectors for the affected member set. Therefore, the joining member does not know the old TEK and secret vector A. i There are three possible solutions to a linear system: no solution, a unique solution, or an infinite number of solutions. Only linear systems with unique solutions are useful, so the system must meet several conditions to ensure a unique solution; the secret coefficient matrix A should be: a square matrix, linearly independent, invertible, non-singular, and have a non-zero determinant.

[0019] Further, in step S4, each member uses its secret vector to obtain TEK, specifically through the following expression:

[0020]

[0021] Only know A i Once a compromised member is identified, key shielding changes the secret vector as well as the shared key TEK to ensure forward secrecy.

[0022] The beneficial effects of the present invention are:

[0023] This method utilizes a key shielding management scheme for key management for secure data storage and management. By finding a key management scheme based on a set of integer coefficient equations over a finite field, it ensures minimal message overhead, small memory footprint, and low computational complexity. It is also quantum-safe and resistant to brute-force attacks. In this approach, each member obtains a security lock in a public channel and uses their own secret vector to unlock the lock and obtain the TEK. Once a member has their own secret vector, the key center generates the TEK and solves the system problem. The solution is then sent to everyone in the form of a message via an open channel. This scheme ensures that every member of the communication can securely maintain the latest version of the TEK.

[0024] Other advantages, objects, and features of the present invention will be described in part in the following description and, in part, will be apparent to those skilled in the art upon examination of the following description or may be learned from practice of the present invention. The objects and other advantages of the present invention may be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below with reference to the accompanying drawings, in which:

[0026] Figure 1 Schematic diagram of the method of the present invention. DETAILED DESCRIPTION

[0027] The technical solution of the present invention is described in detail below with reference to the accompanying drawings.

[0028] Figure 1 Schematic diagram of the method of the present invention. As shown in the figure, the data storage security management method based on key shielding of the present invention specifically includes:

[0029] S1: The key server collects the public keys of the members of the quantum-safe cryptosystem [pk1...pk n ], then the key server generates the member's secret vector [A1...A n ].

[0030] S2: The key server sends the member's secret vector encrypted with the member's public key Each member uses its private key (sk i ) decrypts the received private message to extract its secret vector (A i );

[0031] S21: To ensure confidentiality and integrity during a session, the sender (source) shares an encryption key, called the Traffic Encryption Key (TEK), with all valid recipients. Once an encrypted message is received, only the valid recipient holding the TEK can decrypt the message. Since new members can join and leave, the number of recipients is not fixed.

[0032] S22: Secret vector [A1...A n ] consists of q non-zero random numbers, each of which is A L A L Represents the key shielding building block (A i ) security parameter of the required bit strength. The secret vector bit length should be A L =A L ×q, where A L Greater than the shared key TEK L To ensure safety, each element a i，j At least it should be a L The bit length satisfies the following formula:

[0033]

[0034] S23: In order to make the key shielding scheme immune to brute force attacks, it is necessary to ensure that the bandwidth of the matrix A is greater than 1. By doing so, it is ensured that launching a brute force attack on TEK is faster than on A. i It's easier to get on.

[0035] S3: The key server generates TEK and solves the linear system; the key server sends the linear system solution [x1...x n ];

[0036] S31: The linear system A×X=B is shown as the distribution scheme of the key by the following equation:

[0037]

[0038] X represents the security lock that will be shared publicly, B is the vector of shared TEK, and A is the secret matrix, where each row Ai = [A i , 1.......A i ,n] is assigned to a member, once the member has its own secret vector A i , the key center will generate TEK and solve the system problem.

[0039] S32: Key shielding ensures that new members should not learn the previously used TEK key and secret vector A. Once a member joins, the rekeying process will begin to refresh the old TEK and regenerate a new secret vector for the affected member set. Therefore, the joining member does not know the old TEK and secret vector A. i .

[0040] The number of messages required for the TEK update process is shown in the following formula:

[0041] Message = 2k + 1

[0042] Where 2k is the secret vector A sent to the subset members i The number of messages required, as well as the number of broadcast messages required to notify all system entities to obtain the new TEK. The new secret vector message takes time to be delivered to all subset members, and the required time is called the key update delay T rek， The update delay is calculated as:

[0043] T rek =max{Δ1, Δ2, ..., Δ n}

[0044] where Δ i Indicates completion of A i Time required for delivery.

[0045] S33: A linear system of equations can have three possible solutions: no solution, a unique solution, or an infinite number of solutions. Only linear systems with unique solutions are useful, so the system must satisfy several conditions to ensure a unique solution. The secret coefficient matrix A should be square, linearly independent, invertible, nonsingular, and have a nonzero determinant.

[0046] S34: The key center solves the linear system and converts the solution [x1...x n ] is sent to everyone. Each member will use its secret vector (A i ) obtain the shared key (A i ×X=TEK).

[0047] S4: Each member will obtain the TEK by using its own secret vector to open the security lock. Each member uses its secret vector to obtain the TEK, specifically through the following expression:

[0048]

[0049] Only know A i Once a compromised member is identified, key shielding changes the secret vector as well as the shared key TEK to ensure forward secrecy.

[0050] This method can achieve data storage security and improve the security of the stored data itself, while effectively improving the reading and writing performance of data, and making the performance of data security operations better than the current standard implementation.

[0051] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention can be modified without departing from the purpose and scope of the technical solutions, which should all be included in the scope of the claims of the present invention.

Claims

1. A data storage security management method based on key shielding, characterized by: The sender shares an encryption key with all valid recipients, called the traffic encryption key TEK. Once an encrypted email encrypted by the TEK is received, only the valid recipient holding the TEK can decrypt the received email. The method specifically includes the following steps: S1. The key server collects the public keys of the members of the quantum-safe cryptography system [pk1…pk n ], then the key server generates the member's secret vector [A1…A n ]; S2. The key server sends the member secret vector encrypted with the member's public key. Each member uses its private key (sk i ) decrypts the received private message to extract its secret vector (A i ); S3, the key server generates TEK and solves the linear system; the key server sends the linear system solution [x1…x n ]; S4. Each member will open the security lock by using its own secret vector to obtain the traffic encryption key TEK; In step S2, the secret vector [A1…A n ] consists of q non-zero random numbers, each of which is A L A L Represents the key shielding building block (A i ) security parameter of the required bit strength; the bit length of the secret vector is A L =A L ×q, where A L Greater than the shared key TEK L The length of each element a i,j At least a L bit length and satisfies the following formula: In order to protect the key shielding scheme from brute force attacks, it is necessary to ensure that the bandwidth of the matrix A is greater than 1, and to ensure that launching a brute force attack on TEK is faster than on A. i It is easier to go up; In step S3, the linear system A×X=B is shown as a distribution scheme of the key by the following equation: X represents the security lock that will be shared publicly, B is the vector of shared TEK, and A is the secret matrix, where each row Ai = [A i , 1·······A i ,n] is assigned to a member, once the member has its own secret vector A i , the key center will generate TEK and solve the system problem; the key center solves the linear system and converts the solution [x1…x n ] is sent to everyone; each member will use its secret vector (A i ) obtain the shared key (A i ×X=TEK); In step S4, each member uses its secret vector to obtain TEK, specifically through the following expression: Only know A i Once a compromised member is identified, key shielding changes the secret vector as well as the shared key TEK to ensure forward secrecy.

2. The data storage security management method based on key shielding according to claim 1, characterized in that: In this method, key shielding ensures that new members should not learn the previously used TEK key and secret vector A. Once a member joins, the rekeying process will start to refresh the old TEK and regenerate new secret vectors for the affected member set. Therefore, the joining member does not know the old TEK and secret vector A. i .

3. The data storage security management method based on key shielding according to claim 2, characterized in that: There are three possible solutions to a system of linear equations: no solution, a unique solution, or an infinite number of solutions. Only linear systems with unique solutions are useful, so the system must meet several conditions to ensure a unique solution; the secret coefficient matrix A should be: a square matrix, linearly independent, reversible, non-singular, and have a non-zero determinant.

Images