A secure storage method supporting intelligent unmanned cluster data access mode protection

Abstract

The application discloses a security storage method supporting intelligent unmanned cluster data access mode protection, comprising the following steps: one device in the cluster sends the collected data to any device for storage after encryption and compression; when the device queries a target device storing the data to be accessed according to the identification of the data to be accessed, the identification is sent; the target device determines an access path from the ORAM tree structure of the target device according to the identification, accesses each node of the path, for each node, if there is a data block of the identification in the node, the data block is taken as the obtained encrypted data block, if not, the data block of other devices in the node is taken as the obtained encrypted data block, and the obtained encrypted data block is sent to the device after compression; the device obtains the data to be accessed by decompression and decryption, obtains the data to be stored according to the operation of the user on the data to be accessed, sends the data to be stored to the target device or any device in the cluster for storage after encryption, and updates a position mapping table.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data security, and particularly relates to a secure storage method supporting intelligent unmanned cluster data access mode protection. BACKGROUND

[0002] The intelligent unmanned cluster technology develops rapidly, and navigation positioning, task planning and collaborative control and other task collaborations are widely applied in the fields of agriculture, logistics, remote sensing and emergency. The intelligent unmanned cluster provides services such as information interaction, task execution and data acquisition due to the characteristics of unmanned and intelligent. When there is a device in the intelligent unmanned cluster that is utilized by an attacker or an unlicensed device intrudes into the cluster without being found in time, the data stored in the intelligent unmanned cluster is vulnerable to malicious analysis by the attacker, and confidential data is stolen. The existing intelligent unmanned cluster protection mechanism mainly protects the data by access control and authentication in the face of resource sharing among cluster devices. For the intelligent unmanned cluster with a large number of devices, when there is an illegal intrusion of intelligent unmanned devices, the data access mode between devices needs to be protected to ensure that illegal devices cannot obtain the data information of other devices in the cluster, thereby providing security for the execution of high-value and high-confidentiality tasks.

[0003] In the aspect of intelligent unmanned cluster access mode protection, ORAM (Oblivious RAM, Oblivious RAM) is often used to protect the data access mode. In the existing Ring ORAM storage scheme, a fixed number of real data blocks and virtual data blocks are stored in each bucket node under a certain bandwidth condition. In the access process, one data block information of each bucket in the entire path is obtained, the virtual data block is used to confuse the access mode, and the client obtains data information containing the virtual data block. While protecting the access mode, a large amount of storage space is wasted. In the N-node Ring ORAM data access mode protection scheme, the node bucket is set to a fixed size of Z real blocks and S virtual blocks, and the metadata containing the data block information will cause N*S*Block size waste of space. In order to ensure the effectiveness of the Ring ORAM security mechanism, Z and S are set to 1:1. As a result, half of the storage space is usually wasted.

[0004] The Path ORAM storage scheme is a scheme for protecting the data access mode on a single server. In the Path ORAM data access mode protection mechanism, data is also stored in a tree-type structure storage medium. When a user accesses data, all the data needs to be taken back to the user end that issues the request from the leaf node to the root node. When the storage space has N data nodes, and each node has a size of Block size , when a user requests a size of Block sizeWhen the data block is returned to the requesting user, the bandwidth overhead of the server side is 2*log(N)*Block size The bandwidth delay caused by the above has an impact on the normal data operation of the user.

[0005] In distributed storage applications, user-oriented authorization protection is mainly provided through various authorization access strategies such as identity authentication and access control, fine-grained access control is implemented by using KP-ABE and CP-ABE, or the security of user access to data in the cluster is ensured by auditing the integrity of the access user data through a third-party auditor, but the distributed storage technology fails to provide a security mechanism for access mode protection. When the server is illegally intruded by an attacker, the user accesses the confidential data stored in the device, and the illegal user can obtain confidential data information by analyzing the user access mode, which also causes the leakage of private information.

[0006] That is, there is no data storage method in the related art that can protect the data access mode between devices in an unmanned cluster and reduce the storage space of unmanned devices and the network bandwidth between unmanned devices during data access. SUMMARY

[0007] In order to solve the above problems existing in the related art, the present application provides a security storage method supporting data access mode protection of an intelligent unmanned cluster. The technical problem to be solved by the present application is solved by the following technical scheme:

[0008] The present application provides a security storage method supporting data access mode protection of an intelligent unmanned cluster, comprising:

[0009] When any unmanned device in the intelligent unmanned cluster collects data, the unmanned device is selected from the intelligent unmanned cluster according to the size of the data, the data is divided into at least one data block, each data block is encrypted by using the encryption key of the unmanned device, and the encrypted data block is compressed and sent to the selected unmanned device for storage; the intelligent unmanned cluster includes a plurality of unmanned devices, each unmanned device is used for data collection and for storing its own encrypted data and encrypted data sent by other unmanned devices in the intelligent unmanned cluster; the encryption keys of different unmanned devices are different;

[0010] When the any unmanned device receives a query instruction of an authorized user, the location mapping table of the any unmanned device is queried according to the identifier of the to-be-accessed data in the query instruction, when the device identifier of the target unmanned device storing the to-be-accessed data is queried, the data access request carrying the identifier of the to-be-accessed data is sent to the target unmanned device; the location mapping table records the device identifier of the unmanned device storing the data collected by the any unmanned device, and the identifier of the data stored by each unmanned device;

[0011] The target unmanned device determines an access path of the to-be-accessed data from an ORAM tree structure of itself according to an identifier of the to-be-accessed data and an address mapping table of itself; each unmanned device stores data through the ORAM tree structure, each node of the ORAM tree structure includes a preset number of encrypted data blocks, the preset number of encrypted data blocks include an encrypted data block of the unmanned device itself and an encrypted data block of at least one other unmanned device; the access path is a path from a root node to a leaf node; the address mapping table includes an identifier of data stored in each leaf node and a device identifier of an unmanned device to which the stored data belongs;

[0012] The target unmanned device accesses each path node on the access path according to the identifier of the to-be-accessed data, for any path node, when it is determined that the identifier of the to-be-accessed data corresponds to a data block exists in the path node, the data block is obtained as an encrypted data block, and when the identifier of the to-be-accessed data corresponds to a data block does not exist in the path node, a data block of other unmanned devices in the path node is obtained as an encrypted data block;

[0013] The target unmanned device stores the obtained encrypted data block into a stash of itself for compression to obtain compressed data of a preset size, and sends the compressed data to the any unmanned device;

[0014] The any unmanned device decompresses and decrypts the compressed data to obtain the to-be-accessed data;

[0015] When the any unmanned device receives an obtaining operation or an updating operation of the access data by the authorized user, the any unmanned device obtains to-be-stored data, encrypts the to-be-stored data by using an encryption key of itself, sends the obtained encrypted data block to the target unmanned device or any other unmanned device in the intelligent unmanned cluster for storage, and updates a position mapping table of itself.

[0016] The present application has the following beneficial technical effects:

[0017] Aiming at the characteristics of high confidentiality of data and limited cluster resources in the execution of tasks by intelligent unmanned clusters, the present invention applies the RingORAM solution to the cluster environment to protect the data access mode between devices in the intelligent unmanned cluster, and enables each node of the ORAM tree structure of each unmanned device in the intelligent unmanned cluster to store its own encrypted data and the encrypted data of other devices in the unmanned cluster. In addition, each unmanned device can only decrypt the data of its own device and cannot decrypt the stored data of other unmanned devices. Compared with the existing Ring ORAM solution in which nodes store real data blocks and virtual data blocks, the encrypted data of other unmanned devices is used to replace the virtual data blocks, which reduces the filling space of virtual data, reduces the waste of storage space, and improves the security of data storage, thereby achieving the technical effect of improving data confidentiality while reducing bandwidth overhead. In addition, the present invention extends the user-side temporary Stash storage in a single-server scenario to the unmanned cluster environment, and at the same time, by compressing the data information in the request path into data of a preset size and sending the compressed data to the unmanned device accessed by the authorized user, the network bandwidth for data access between devices in the cluster is reduced, and the bandwidth for data access is stabilized.

[0018] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 An optional flowchart of a secure storage method supporting intelligent unmanned cluster data access mode protection provided by an embodiment of the present invention;

[0020] Figure 2A A schematic diagram of the architecture of an exemplary intelligent unmanned cluster provided by an embodiment of the present invention;

[0021] Figure 2B A schematic diagram of the ORAM tree structure of each unmanned device in an exemplary intelligent unmanned cluster provided by an embodiment of the present invention;

[0022] Figure 3 A partial flow chart of an exemplary authorized user accessing data of an authorized unmanned device through an authorized unmanned device in an intelligent unmanned cluster provided by an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of an exemplary access path and data information contained in each node on the access path provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0025] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0026] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification.

[0027] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art can understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple situations. A single processor or other unit can implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0028] Figure 1 This is an optional flow chart of a secure storage method supporting intelligent unmanned cluster data access mode protection provided by an embodiment of the present invention, such as Figure 1 As shown, the method includes the following steps:

[0029] S101. When any unmanned device in the intelligent unmanned cluster collects data, an unmanned device is selected from the intelligent unmanned cluster based on the size of the data, the data is divided into at least one data block, each data block is encrypted using its own encryption key, and the encrypted data block is compressed and sent to the selected unmanned device for storage; the intelligent unmanned cluster includes multiple unmanned devices, each of which is used for data collection and for storing its own encrypted data and encrypted data sent by other unmanned devices in the intelligent unmanned cluster; different unmanned devices have different encryption keys.

[0030] In an embodiment of the present invention, the intelligent unmanned cluster includes multiple unmanned devices, each unmanned device m has a public key and a private key, and the public keys and private keys of different unmanned devices are different. Each unmanned device m can use its own private key to encrypt the data collected by itself (for example, the data collected by itself through the collection device, and the data uploaded to the device itself by the authorized user), and store the encrypted data block in itself or send it to at least one unmanned device other than itself in the intelligent unmanned cluster for storage; and each unmanned device can use its own private key to successfully decrypt its own encrypted data block obtained from other unmanned devices in the cluster. Each unmanned device m stores data through the ORAM tree structure and temporarily stores the received data through stash. In addition, each unmanned device m maintains a location mapping table and an address mapping table. The location mapping table of each unmanned device m records the device identification of the unmanned device that stores the data collected by the unmanned device m, as well as the identification of the data stored by the unmanned device. For example, Figure 2A As shown, the cluster includes three unmanned devices A, B and C. Unmanned device A can distribute and store its own encrypted data to unmanned devices B and C. Similarly, unmanned device B can distribute and store its own encrypted data to unmanned devices A and C, and the same applies to unmanned device C. And, as Figure 2B As shown, the storage structure of each unmanned device is an ORAM tree structure, and the upper layer of the ORAM tree structure includes a stash temporary storage area.

[0031] In some embodiments, different unmanned devices are used to collect different data according to different mission configuration information; and each unmanned device can be at least a drone or an unmanned vehicle.

[0032] When the unmanned device is a drone, the above cluster is a drone cluster, so that the drone cluster can perform some flight missions, etc.; when the unmanned device is an unmanned vehicle, the above cluster is an unmanned vehicle cluster, so that it can perform some road condition information collection tasks, etc.

[0033] S102. When any unmanned device receives a query instruction from an authorized user, it queries its own location mapping table according to the identifier of the data to be accessed in the query instruction. When the device identifier of the target unmanned device storing the data to be accessed is found, a data access request carrying the identifier of the data to be accessed is sent to the target unmanned device; the location mapping table records the device identifier of the unmanned device that stores the data collected by any unmanned device, as well as the identifier of the data stored by each unmanned device.

[0034] In the present application, each unmanned device m corresponds to one or more authorized users, and the authorized users can control the corresponding unmanned device through user equipment or through control instructions of the authorized users to the corresponding unmanned device. When each unmanned device m receives some instructions of the user, it can first verify whether the user is an authorized user, and if so, respond to the instructions of the authorized user to perform corresponding operations.

[0035] Here, when the authorized user needs to upload data to the corresponding unmanned device, the corresponding unmanned device can first query whether the data to be uploaded has been stored in the intelligent unmanned cluster, that is, send a query instruction containing the identification of the data to be accessed to the corresponding unmanned device; or when the authorized user needs to download data from the corresponding unmanned device, or needs to update the stored data of the corresponding unmanned device, the corresponding unmanned device can first query whether the data to be downloaded or the data to be updated has been stored in the intelligent unmanned cluster, that is, send a query instruction containing the identification of the data to be accessed to the corresponding unmanned device.

[0036] S103, the target unmanned device determines the access path of the data to be accessed from the ORAM tree structure of itself according to the identification of the data to be accessed and the address mapping table of itself; each unmanned device stores data through the ORAM tree structure, and each node of the ORAM tree structure includes a preset number of encrypted data blocks, and the preset number of encrypted data blocks include encrypted data blocks of the unmanned device itself and encrypted data blocks of at least one other unmanned device; the access path is a path from a root node to a leaf node; the address mapping table includes the identification of the data stored in each node and the device identification of the unmanned device to which the stored data belongs.

[0037] In the embodiment of the present application, the target unmanned device determines the leaf node containing the data to be accessed from the ORAM tree structure of itself according to the address mapping table of itself, obtains the target leaf node, and takes the path from the target leaf node to the root node of the ORAM tree structure as the access path.

[0038] Here, the preset number can be set according to actual needs, and the present application does not limit this.

[0039] For example, the data to be accessed can be data to be uploaded by the authorized user to the corresponding unmanned device, or data to be downloaded by the authorized user from the corresponding unmanned device, or data to be updated by the authorized user to the corresponding unmanned device. Figure 3As shown, when the unmanned device B determines that part of the data to be accessed is stored in the unmanned device A and another part is stored in the unmanned device C according to the identification of the data to be accessed in the query instruction of the authorized user Y and the device mapping table of the unmanned device B, and sends the identification of the data to be accessed to the unmanned devices A and C respectively, the unmanned device A determines the target leaf node j3 by querying the identification of the data stored in each leaf node recorded in the address mapping table of the unmanned device A and the device identification of the unmanned device to which the stored data belongs, and determines the access path S1 according to the target leaf node j3. Similarly, the unmanned device C determines the target leaf node i2 by querying the identification of the data stored in each leaf node recorded in the address mapping table of the unmanned device C and the device identification of the unmanned device to which the stored data belongs, and determines the access path S2 according to the target leaf node i2.

[0040] In the embodiment of the application, each node in the ORAM tree structure of each unmanned device m can include its own data (local data), data of other unmanned devices in the cluster, metadata information and a counter. The metadata information includes the identification of the data stored in each storage location of the node and the device identification of the unmanned device to which the stored data belongs. The counter is used to count the number of times the node is accessed. Figure 4 As shown, for the unmanned device A, the height of the ORAM tree structure of the unmanned device A can be O(logN), and the target leaf node j3 in the ORAM tree structure of the unmanned device A includes the local data E(A1) and E(A2) of the unmanned device A, the index (identification) "0" of the storage location of E(A1) and the index "2" of the storage location of E(A2); the data block E(B3) of the unmanned device B, the index "1" of the storage location of E(B3); the data block E(C1) and E(C4) of the unmanned device C, the index "4" of the storage location of E(C1) and the index "3" of the storage location of E(C4); wherein the data blocks E(B3), E(C1) and E(C4) are all data of other unmanned devices, in Figure 4 the data block E(C4) is part of the data to be accessed corresponding to the identification of the data to be accessed sent by the unmanned device B, and in Figure 4 the data block E(C4) is called access data. As shown, Figure 4 the target leaf node j3 also includes a counter, and the preset access threshold value corresponding to the counter can be 2, and the current target leaf node j3 has been accessed 1 time.

[0041] In some embodiments, the storage space of each unmanned device m includes a storage sub-space for storing encrypted data of itself, and a storage sub-space corresponding to each unmanned device in the cluster except itself, for storing encrypted data transmitted by the corresponding unmanned device; for example, when the cluster includes three unmanned devices in total, the storage space of each unmanned device m includes three storage sub-spaces, the first storage sub-space is used for storing encrypted data of the unmanned device m, the second storage sub-space is used for storing encrypted data transmitted by one of the other two unmanned devices, and the third storage sub-space is used for storing encrypted data transmitted by the other of the other two unmanned devices.

[0042] In S104, the target unmanned device accesses each path node on the access path according to the identifier of the to-be-accessed data, and for any path node, when it is determined that the data block corresponding to the identifier of the to-be-accessed data exists in the path node, the data block is taken as an obtained encrypted data block, and when the data block corresponding to the identifier of the to-be-accessed data does not exist in the path node, a data block of another unmanned device in the path node is taken as an obtained encrypted data block.

[0043] In the embodiments of the present application, the target unmanned device queries the to-be-accessed data from each access node on the access path according to the identifier of the to-be-accessed data and the metadata information of each path node on the access path, and obtains an encrypted data block from each access node.

[0044] In S105, the target unmanned device stores the obtained encrypted data block into the stash of itself for compression, obtains compressed data of a preset size, and transmits the compressed data to the any unmanned device.

[0045] In the embodiments of the present application, the target unmanned device can store the encrypted data blocks obtained from all path nodes into the stash of itself, and then obtain compressed data of a preset size by performing XOR operation on the encrypted data blocks obtained from the path nodes. The preset size of the compressed data can be determined according to actual needs, and the embodiments of the present application do not limit this.

[0046] In the embodiments of the present application, when any two unmanned devices perform encrypted data transmission, the transmitted data are all compressed data of a preset size obtained after compression.

[0047] In the embodiments of the present application, the unmanned device transmits the compressed data to the corresponding unmanned device, and compared with the Ring ORAM access strategy, by transmitting the compressed data blocks of a fixed size, the bandwidth cost can be reduced from O(logN) to O(1).

[0048] S106. Any unmanned device decompresses and decrypts the compressed data to obtain the data to be accessed.

[0049] In some embodiments, any unmanned device decompresses the compressed data to obtain recovered encrypted data blocks, and uses its own encryption key to decrypt each recovered encrypted data block, and uses the decrypted data as the data to be accessed; wherein, when a recovered encrypted data block does not belong to the data of any unmanned device, any unmanned device cannot successfully decrypt the recovered encrypted data block; and when the recovered encrypted data block belongs to the data of any unmanned device, any unmanned device successfully decrypts the recovered encrypted data block.

[0050] S107. When any unmanned device receives an access data acquisition operation or update operation from an authorized user, it obtains the data to be stored, encrypts the data to be stored using its own encryption key, sends the obtained encrypted data block to the target unmanned device or any other unmanned device in the intelligent unmanned cluster for storage, and updates its own location mapping table.

[0051] In some embodiments, the acquisition operation may include: a browsing operation or a downloading operation; when any unmanned device receives a browsing operation or a downloading operation from an authorized user for the data to be accessed, it can treat the data to be accessed as the data to be stored, use its own encryption key to encrypt the data to be stored, and send the encrypted data block to be stored to the target unmanned device for storage.

[0052] Here, after obtaining the encrypted data block to be stored, any unmanned device can first send a storage request carrying the size of the encrypted data block to be stored to the target unmanned device. After receiving the storage request, the target unmanned device can check whether the remaining space of the storage subspace corresponding to any unmanned device in its own storage space meets the size of the encrypted data block to be stored; if so, the storage address is returned to the any unmanned device, and the any unmanned device sends the encrypted data block to be stored to the storage address of the target unmanned device. After the target unmanned device receives the encrypted data block to be stored through the storage address, it stores the encrypted data block to be stored in its own stash; if not, the target unmanned device sends a storage rejection request to the any unmanned device. After receiving the storage rejection request, the target unmanned device re-selects one or more other unmanned devices from the cluster according to the size of the encrypted data block to be stored, and continues to send storage requests based on the above principle until the encrypted data block to be stored is successfully stored.

[0053] In some embodiments, when any unmanned device receives an update operation on the data to be accessed from an authorized user, it obtains the updated data of the data to be accessed, uses the updated data as the data to be stored, encrypts the data to be stored using its own encryption key, and randomly selects one or more unmanned devices from the intelligent unmanned cluster, and sends the encrypted updated data block to the selected unmanned device for storage.

[0054] Here, the principle of any unmanned device sending the encrypted update data block to the selected unmanned device for storage is the same as the principle of storing the encrypted data block to be stored.

[0055] Here, when the authorized user does not update the access data, any unmanned device will encrypt the data accessed by the authorized user and store it back to the intelligent unmanned cluster. In this way, other devices in the intelligent unmanned cluster cannot distinguish the read and write operations of the unmanned device (any unmanned device) accessed by the authorized user on the encrypted data blocks stored in the intelligent unmanned cluster, thereby further protecting the data access mode between devices in the intelligent unmanned cluster.

[0056] In an embodiment of the present invention, after any unmanned device successfully stores the encrypted data block to be stored or the encrypted updated data block, it will update the device mapping table maintained by itself according to the identifier of the encrypted data block to be stored or the identifier of the encrypted updated data block, and the device identifier of the unmanned device that stores the encrypted data block to be stored or the encrypted updated data block, and share the device mapping table to the cluster where it is located.

[0057] In the embodiment of the present application, in view of the characteristics of high data confidentiality and limited cluster resources of the intelligent unmanned cluster performing tasks, the Ring ORAM scheme is applied to the cluster environment to protect the data access mode between devices in the intelligent unmanned cluster, and each node in the ORAM tree structure of each unmanned device in the intelligent unmanned cluster stores its own encrypted data and the encrypted data of other devices in the unmanned cluster, and each unmanned device can only decrypt its own device data and cannot decrypt the data of other unmanned devices. Compared with the existing Ring ORAM scheme in which the nodes store real data blocks and virtual data blocks, the encrypted data of other unmanned devices is used instead of the virtual data blocks, reducing the filling space of the virtual data, reducing the waste of storage space, and improving the security of data storage, thereby achieving the technical effect of improving data confidentiality while reducing bandwidth overhead. In addition, the present application extends the user end temporary Stash storage in the single server scenario to the unmanned cluster environment, and compresses the data information in the request path to a preset size of data, and sends the compressed data to the unmanned device authorized by the user to access, thereby reducing the network bandwidth during data access between unmanned devices in the cluster and stabilizing the bandwidth of data access.

[0058] In some embodiments, the above method further comprises S108-S109:

[0059] S108, each unmanned device checks whether the amount of data of the received encrypted data block stored in its own stash reaches a preset storage threshold at a preset frequency.

[0060] S109, if yes, the encrypted data block exceeding the preset storage threshold is stored in the node of the ORAM tree structure of the unmanned device, and the address mapping table of the unmanned device is updated.

[0061] In the embodiment of the present application, the preset frequency and the preset storage threshold can be determined according to actual needs, and the present application is not limited thereto.

[0062] In some embodiments, if the amount of received encrypted data blocks stored in the stash of the unmanned device m itself reaches (for example, is equal to or greater than) a preset storage threshold, then the unmanned device m, for the first encrypted data block E1 exceeding the storage threshold in the stash of the unmanned device m itself, starts from the first remaining eviction path in the current remaining eviction path of the unmanned device m, and searches for a node with remaining storage space matching the size of the encrypted data block E1 from the leaf node to the root node of the path, until a node with remaining storage space matching the size of the encrypted data block E1 is found in one of the remaining eviction paths in the current remaining eviction path, the encrypted data block E1 is stored in the node, and the current remaining eviction path is updated to obtain an updated current remaining eviction path; then, for the second encrypted data block E2 exceeding the storage threshold in the stash of the unmanned device m itself, starting from the first remaining eviction path in the updated current remaining eviction path, searching for a node with remaining storage space matching the size of the encrypted data block E2 from the leaf node to the root node of the path, until a node with remaining storage space matching the size of the encrypted data block E2 is found in one of the remaining eviction paths in the updated current remaining eviction path, the encrypted data block E2 is stored in the node, and the updated current remaining eviction path is updated, until all encrypted data blocks exceeding the storage threshold in the stash of the unmanned device m itself are stored in the nodes of the ORAM tree structure of the unmanned device m, the data eviction operation is ended, and the address mapping table of the unmanned device m is updated. In this way, part of the data in the stash of the unmanned device m can be evicted to the ORAM tree structure of the unmanned device m, so as to alleviate the temporary storage pressure of the stash of the unmanned device m.

[0063] In the embodiments of the present application, the first encrypted data block and the second encrypted data block can be any two different encrypted data blocks exceeding the storage threshold in the stash of the unmanned device m itself.

[0064] In the embodiments of the present application, when the unmanned device m is searching for a storage node for the encrypted data block for the first time, the current remaining eviction path is a global eviction path; the global eviction path is a preset number of eviction paths generated by the unmanned device according to reverse dictionary order when initializing. By generating the eviction path according to the reverse dictionary order, the density of path overlap before and after eviction can be reduced, thereby reducing the frequency of eviction.

[0065] For example, when the unmanned device m is looking for a storage node for an encrypted data block for the first time, the unmanned device m starts from the first eviction path in the generated global eviction path (for example, Q paths) to look for a storage node for the encrypted data block, and stores the encrypted data block when a node for storing the encrypted data block is found in the second eviction path; at this time, the remaining paths are the third to Qth paths, and the unmanned device m starts from the third path to continue to look for a storage node for another encrypted data block, and so on, until the encrypted data blocks exceeding the storage threshold in the stash of the unmanned device m are evicted to the nodes.

[0066] In some embodiments, each unmanned device corresponds to a preset eviction number, and when each unmanned device m evicts a data block to the ORAM tree structure of the unmanned device m, one data eviction is completed. After the encrypted data blocks exceeding the storage threshold in the stash of each unmanned device m are all evicted, the unmanned device m can determine whether the eviction number executed by the unmanned device m reaches the preset eviction number. If the eviction number is less than the preset eviction number, the unmanned device m continues to generate a plurality of eviction paths for any one data block in the stash of the unmanned device m, and only accesses the nodes in each eviction path. At the end of the access, one false eviction is completed, so that the eviction number of the unmanned device m increases by one. The step is repeated until the eviction number of the unmanned device m reaches the preset eviction number. In this way, the eviction period can be kept consistent, and malicious analysis of the eviction frequency of the unmanned device m by other unmanned devices can be prevented, so that the leakage of access information is not easy.

[0067] In the embodiments of the present application, the preset number threshold can be determined according to actual needs, and the embodiments of the present application do not limit this.

[0068] In some embodiments, after S104, the method further includes:

[0069] S110, the target unmanned device queries the current access number of any node, and determines whether the current access number reaches a preset number threshold; the any node includes a counter for recording the access number of the any node in real time.

[0070] S111, if the current access number of the any node reaches the preset number threshold, the encrypted data block in the any node is transferred to the stash of the target unmanned device, the encrypted data block is randomly obtained from the stash of the target unmanned device and stored in the any node, and the address mapping table of the target unmanned device is updated.

[0071] In an embodiment of the present invention, when each unmanned device m accesses a node of its own, the number of visits to the node will increase once. After the unmanned device m has completed accessing a node of its own, it will query the number of visits to the node, and when it finds that the number of visits to the node has reached a preset threshold, it will transfer the encrypted data block in the node to its own stash, and randomly obtain the encrypted data block from its own stash and store it in the node. After that, the metadata information of the node can be updated, and the address mapping table of the unmanned device m itself can be updated according to the updated metadata information of the node.

[0072] In some embodiments, the above method further includes: S201 to S206:

[0073] S201. When any unmanned device does not obtain any device identification by querying its own location mapping table, it indicates that the data to be accessed is not stored in the intelligent unmanned cluster. Any unmanned device randomly selects at least one unmanned device from the intelligent unmanned cluster as a storage device and sends a storage request to each storage device.

[0074] In an embodiment of the present invention, when any unmanned device does not obtain any device identification by querying its own location mapping table, it indicates that the data to be accessed is not stored in the intelligent unmanned cluster. At this time, the authorized user can control any unmanned device to randomly select at least one unmanned device from the intelligent unmanned cluster as a storage device to store the data to be uploaded by the authorized user.

[0075] Here, when any unmanned device randomly selects an unmanned device, it can select itself or other unmanned devices in the cluster except itself; and, any unmanned device can randomly select an unmanned device based on the size of the data to be uploaded by the authorized user; for example, if the data is large, multiple unmanned devices are selected; if the data is small, one unmanned device is selected.

[0076] Here, each storage request may carry the size of the data to be stored in the storage device.

[0077] S202: Each storage device determines whether there is any remaining space in the storage subspace corresponding to any unmanned device in its own storage space according to the storage request.

[0078] S203. If yes, send the storage address of the storage subspace corresponding to any unmanned device to any unmanned device; the storage space of each unmanned device contains storage subspaces corresponding to all other unmanned devices in the intelligent unmanned cluster, and the storage subspaces are used to store the encrypted data sent by the corresponding unmanned device.

[0079] In an embodiment of the present invention, each storage device that receives a storage request determines whether there is remaining space in the storage subspace corresponding to any unmanned device in its own storage space that can meet the size of the data to be stored based on the size of the data to be stored carried in the storage request; if so, the storage address of the storage subspace corresponding to any unmanned device is sent to any unmanned device.

[0080] S204: Any unmanned device obtains the data uploaded to it by the authorized user, divides the uploaded data into at least one data block, and encrypts and compresses each data block using its own encryption key.

[0081] Here, after receiving the data uploaded to itself by the authorized user and the storage address sent by each storage device, any unmanned device can divide the data uploaded by the authorized user into data blocks of the same number as the number of storage devices according to the size of the quantity to be stored in each storage device, and encrypt it using its own encryption key to obtain one or more encrypted data blocks, and compress each encrypted data block through an XOR operation.

[0082] S205: Send the compressed data to a storage address for storage.

[0083] Here, any unmanned device may send each compressed encrypted data block to a corresponding storage device according to the data amount of each encrypted data block.

[0084] S206: Each storage device decompresses the received compressed data and stores it in its own stash.

[0085] It should be noted that the numbers of the various steps in the present invention are merely exemplary and are not intended to limit the execution order of the various steps.

[0086] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A secure storage method supporting intelligent unmanned cluster data access mode protection, characterized in that: include: When any unmanned device in the intelligent unmanned cluster collects data, an unmanned device is selected from the intelligent unmanned cluster based on the size of the data, the data is divided into at least one data block, each data block is encrypted using its own encryption key, the encrypted data block is compressed and sent to the selected unmanned device for storage; the intelligent unmanned cluster includes multiple unmanned devices, each of which is used for data collection and for storing its own encrypted data and encrypted data sent by other unmanned devices in the intelligent unmanned cluster; different unmanned devices have different encryption keys; When any of the unmanned devices receives a query instruction from an authorized user, it queries its own location mapping table according to the identifier of the data to be accessed in the query instruction. When the device identifier of the target unmanned device storing the data to be accessed is found, a data access request carrying the identifier of the data to be accessed is sent to the target unmanned device. The location mapping table records the device identifier of the unmanned device storing the data collected by any of the unmanned devices, as well as the identifier of the data stored by each unmanned device. The target unmanned device determines an access path for the data to be accessed from its own ORAM tree structure based on the identifier of the data to be accessed and its own address mapping table. Each unmanned device stores data via the ORAM tree structure, and each node of the ORAM tree structure includes a preset number of encrypted data blocks, including the unmanned device's own encrypted data blocks and at least one encrypted data block of another unmanned device. The access path is a path from a root node to a leaf node. The address mapping table includes the identifier of the data stored in each leaf node and the device identifier of the unmanned device to which the stored data belongs. The target unmanned device accesses each path node on the access path according to the identifier of the data to be accessed. For any path node, if it is determined that a data block corresponding to the identifier of the data to be accessed exists in the path node, the data block is used as an encrypted data block. If the data block corresponding to the identifier of the data to be accessed does not exist in the path node, a data block of another unmanned device in the path node is used as an encrypted data block. The target unmanned device stores the obtained encrypted data block in its own stash for compression to obtain compressed data of a preset size, and sends the compressed data to any of the unmanned devices; Any unmanned device decompresses and decrypts the compressed data to obtain the data to be accessed; When any unmanned device receives the authorized user's acquisition operation or update operation on the access data, it obtains the data to be stored, encrypts the data to be stored using its own encryption key, sends the obtained encrypted data block to the target unmanned device or any other unmanned device in the intelligent unmanned cluster for storage, and updates its own location mapping table.

2. The secure storage method supporting intelligent unmanned cluster data access mode protection according to claim 1 is characterized in that: The method further comprises: Each unmanned device checks at a preset frequency whether the amount of received encrypted data blocks stored in its own stash has reached a preset storage threshold; If it is reached, the encrypted data blocks exceeding the preset storage threshold are stored in the nodes of its own ORAM tree structure, and its own address mapping table is updated.

3. The secure storage method supporting intelligent unmanned cluster data access mode protection according to claim 1 is characterized in that: The method further comprises: When any unmanned device does not obtain any device identification by querying its own location mapping table, indicating that the data to be accessed is not stored in the intelligent unmanned cluster, any unmanned device randomly selects at least one unmanned device from the intelligent unmanned cluster as a storage device and sends a storage request to each storage device; Each storage device determines whether there is any remaining space in the storage subspace corresponding to any unmanned device in its own storage space according to the storage request; If yes, the storage address of the storage subspace corresponding to any unmanned device is sent to any unmanned device; the storage space of each unmanned device contains a storage subspace corresponding to all other unmanned devices in the intelligent unmanned cluster, and the storage subspace is used to store the encrypted data sent by the corresponding unmanned device; Any unmanned device obtains the data uploaded to it by the authorized user, divides the uploaded data into at least one data block, and encrypts and compresses each data block using its own encryption key; Sending the compressed data to the storage address for storage; Each storage device decompresses the received compressed data and stores it in its own stash.

4. The secure storage method supporting intelligent unmanned cluster data access mode protection according to claim 1 is characterized in that: The target unmanned device determines an access path for the data to be accessed from its own ORAM tree structure according to the identifier of the data to be accessed and its own address mapping table, including: The target unmanned device determines, from its own ORAM tree structure according to its own address mapping table, a leaf node containing the data to be accessed, and obtains a target leaf node; The path from the target leaf node to the root node of the ORAM tree structure is used as the access path.

5. The secure storage method supporting intelligent unmanned cluster data access mode protection according to claim 1 is characterized in that: Any unmanned device decompresses and decrypts the compressed data to obtain the data to be accessed, including: Any unmanned device decompresses the compressed data to obtain a restored encrypted data block; Use its own encryption key to decrypt each recovered encrypted data block, and use the decrypted data as the data to be accessed; wherein, when a recovered encrypted data block does not belong to the data of any of the unmanned devices, any of the unmanned devices cannot successfully decrypt the recovered encrypted data block; when the recovered encrypted data block belongs to the data of any of the unmanned devices, any of the unmanned devices successfully decrypts the recovered encrypted data block.

6. The secure storage method supporting intelligent unmanned cluster data access mode protection according to claim 1, characterized in that: The acquisition operation includes: browsing operation or downloading operation; When any unmanned device receives an acquisition operation or an update operation of the access data by the authorized user, it obtains the data to be stored, encrypts the data to be stored using its own encryption key, and sends the obtained encrypted data block to the target unmanned device or any other unmanned device in the intelligent unmanned cluster for storage, including: When any of the unmanned devices receives a browsing operation or a downloading operation of the data to be accessed by the authorized user, it uses the data to be accessed as data to be stored, encrypts the data to be stored using its own encryption key, and sends the encrypted data block to be stored to the target unmanned device for storage; or When any unmanned device receives an update operation on the data to be accessed by the authorized user, it obtains the updated data of the data to be accessed, uses the updated data as the data to be stored, and encrypts the data to be stored using its own encryption key; One or more unmanned devices are randomly selected from the intelligent unmanned cluster, and the obtained encrypted update data blocks are sent to the selected unmanned devices for storage.

7. The secure storage method supporting intelligent unmanned cluster data access mode protection according to claim 2, characterized in that: If the threshold is reached, the encrypted data blocks exceeding the preset storage threshold are stored in the nodes of its own ORAM tree structure, and its own address mapping table is updated, including: If the threshold is reached, for the first encrypted data block in its own stash that exceeds the storage threshold, starting from the first remaining eviction path in its own current remaining eviction path, search for a node whose remaining storage space matches the size of the encrypted data block from the leaf node of the remaining eviction path to the root node, until a node whose remaining storage space matches the size of the encrypted data block is found in a remaining eviction path in the current remaining eviction path, store the encrypted data block in the node, and update the current remaining eviction path to obtain an updated current remaining eviction path; wherein, when the unmanned device is searching for a storage node for an encrypted data block for the first time, the current remaining eviction path is a global eviction path; the global eviction path is a preset number of eviction paths generated by the unmanned device in reverse lexicographic order during initialization; For the second encrypted data block in its own stash that exceeds the storage threshold, starting from the first remaining eviction path in the updated current remaining eviction path, search for a node whose remaining storage space matches the size of the encrypted data block from the leaf node of the remaining eviction path to the root node, until a node whose remaining storage space matches the size of the encrypted data block is found in a remaining eviction path in the updated current remaining eviction path, store the encrypted data block in the node, and update the updated current remaining eviction path. When the encrypted data block in its own stash that exceeds the storage threshold is stored in a node in its own ORAM tree structure, the data eviction operation ends and its own address mapping table is updated.

8. The secure storage method supporting intelligent unmanned cluster data access mode protection according to claim 1, characterized in that: After the target unmanned device accesses each path node on the access path according to the identifier of the data to be accessed, and for any path node, when it is determined that a data block corresponding to the identifier of the data to be accessed exists in the path node, the data block is used as an encrypted data block; and when the data block corresponding to the identifier of the data to be accessed does not exist in the path node, a data block of another unmanned device in the path node is used as an encrypted data block, the method further includes: The target unmanned device queries the current number of visits to any node and determines whether the current number of visits reaches a preset number threshold; any node includes a counter for recording the number of visits to any node in real time; If the preset number of times is reached, the encrypted data block in any node is transferred to its own stash, an encrypted data block is randomly obtained from its own stash and stored in any node, and its own address mapping table is updated.

9. The secure storage method supporting intelligent unmanned cluster data access mode protection according to claim 1, characterized in that: Each unmanned device corresponds to a private key and a public key; the public key is used to encrypt data to obtain an encrypted data block; the private key is used to decrypt the encrypted data block.

10. The secure storage method supporting intelligent unmanned cluster data access mode protection according to claim 1, characterized in that: Different unmanned equipment is used to collect different data according to different mission configuration information; the unmanned equipment can at least be a drone or an unmanned vehicle.

Images