Method and terminal for secure data storage

Abstract

The application discloses a kind of data security storage method and terminal, the keyword of data to be stored is convolutional encryption, obtain first distributed ciphertext, extract the preset byte of each ciphertext in first distributed ciphertext, constitute data block, and the extracted part is replaced with random number, obtain second distributed ciphertext, so the original ciphertext has been modified at this time, according to convolutional encryption principle, as long as the previous ciphertext data has a little change, it will lead to the ciphertext data after decryption algorithm decryption and original plaintext are completely different. Receive the first public key sent by client, encrypt the data block using the first public key, obtain the first ciphertext block and send to the client, so the client has part of the information of the ciphertext, if there is no client participation, the key field cannot be decrypted, so the key sensitive field information is divided into two pieces, distributed storage is implemented, the client retains one of them, can make the user participate in the process of data security storage.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data storage, in particular to a data security storage method and terminal. BACKGROUND

[0002] Generally, the storage protection of key sensitive fields adopts an encryption storage scheme or a data distributed storage scheme. For the former, encryption protection is implemented at the system end, and the client cannot perceive and determine whether the data is safe and controllable. For the latter, if the data is evenly distributed, the storage amount of the client is large, and if the data is unevenly distributed, the data amount of the service end can be interpreted with a high probability, and the security cannot be guaranteed.

[0003] Therefore, the current data security storage is implemented at the system service end, and the client cannot feel the difference. If a part of data is distributed on the client, the data amount and data storage security problems will be faced. SUMMARY

[0004] The technical problem to be solved by the present application is to provide a data security storage method and terminal, which can improve the security of data storage when users participate in data storage.

[0005] In order to solve the above technical problems, the technical scheme adopted by the present application is:

[0006] A data security storage method, comprising the steps of:

[0007] convoluting encryption of key fields of to-be-stored data to obtain first distributed ciphertext;

[0008] extracting preset bytes of each ciphertext in the first distributed ciphertext to form a data block, and replacing the part of the extracted bytes in each ciphertext with a random number to obtain second distributed ciphertext;

[0009] receiving a first public key generated by a security storage device of the client, encrypting the data block using the first public key to obtain a first ciphertext block;

[0010] sending the first ciphertext block to the client and storing it in the security storage device of the client.

[0011] In order to solve the above technical problems, another technical scheme adopted by the present application is:

[0012] A data security storage terminal, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0013] The key field of the data to be stored is convolutedly encrypted to obtain a first distributed ciphertext;

[0014] A preset byte of each ciphertext in the first distributed ciphertext is extracted to form a data block, and a random number is used to replace the extracted part of each ciphertext to obtain a second distributed ciphertext;

[0015] The first public key generated by the secure storage device of the receiving client is received, and the data block is encrypted by using the first public key to obtain a first ciphertext block;

[0016] The first ciphertext block is sent to the client and stored in the secure storage device of the client.

[0017] The key of the data to be stored is convolutedly encrypted to obtain a first distributed ciphertext, a preset byte of each ciphertext in the first distributed ciphertext is extracted to form a data block, and a random number is used to replace the extracted part to obtain a second distributed ciphertext, so that the original ciphertext is modified at this time, according to the principle of convolutional encryption, as long as the previous ciphertext data has a little change, the decrypted data after the decryption algorithm will be completely different from the original plaintext. The first public key sent by the receiving client is used to encrypt the data block to obtain a first ciphertext block and send it to the client, so that part of the information of the ciphertext is stored in the client, and the key field cannot be decrypted without the participation of the client, so the key sensitive field information is divided into two parts, and distributed storage is implemented, one of which is reserved by the client, so that the user can participate in the data security storage process. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 A flow chart of a data security storage method according to an embodiment of the application;

[0019] Figure 2 A schematic diagram of a data security storage terminal according to an embodiment of the application;

[0020] Figure 3 A convolutional encryption flow chart of a data security storage method according to an embodiment of the application;

[0021] Figure 4 A data storage flow chart of a data security storage method according to an embodiment of the application;

[0022] Figure 5 A data reading flow chart of a data security storage method according to an embodiment of the application;

[0023] LABEL EXPLANATION

[0024] 1. A data security storage terminal; 2. A memory; 3. A processor. DETAILED DESCRIPTION

[0025] To describe the technical solutions in the present application in detail, achieve the objectives and effects, the following will be described in conjunction with the embodiments and the accompanying drawings.

[0026] Please refer to Figure 1 The embodiment of the present application provides a data security storage method, comprising the steps of:

[0027] Convolutional encryption is performed on the key field of the data to be stored to obtain a first distributed ciphertext;

[0028] A preset byte of each ciphertext in the first distributed ciphertext is extracted to form a data block, and a random number is used to replace the extracted part of each ciphertext to obtain a second distributed ciphertext;

[0029] A first public key generated by a security storage device of a client is received, and the data block is encrypted using the first public key to obtain a first ciphertext block;

[0030] The first ciphertext block is sent to the client and stored in the security storage device of the client.

[0031] From the above description, the beneficial effects of the present application are that the key of the data to be stored is convolutionally encrypted to obtain a first distributed ciphertext, a preset byte of each ciphertext in the first distributed ciphertext is extracted to form a data block, and a random number is used to replace the extracted part to obtain a second distributed ciphertext, so that the original ciphertext has been modified at this time. According to the principle of convolutional encryption, as long as there is a little change in the front ciphertext data, it will lead to the fact that the decrypted data after the decryption algorithm is completely different from the original plaintext. The first public key sent by the client is received, the data block is encrypted using the first public key to obtain a first ciphertext block and sent to the client, so that part of the information of the ciphertext is stored in the client. If the client does not participate, the key field cannot be decrypted, so the key sensitive field information is divided into two parts, and distributed storage is implemented, the client retains one part, and the user can participate in the data security storage process.

[0032] Further, after the first ciphertext block is sent to the client and stored in the security storage device of the client, the following steps are included:

[0033] A non-symmetric key pair is generated, the second public key in the non-symmetric key pair is sent to the client, so that after the client decrypts the first ciphertext block using the first private key to obtain a data block, the decrypted data block is encrypted using the second public key to obtain a second ciphertext block;

[0034] The second ciphertext block sent by the client is received, and the second ciphertext block is decrypted using the second private key in the non-symmetric key pair to obtain the data block.

[0035] recovering the first distributed cipher text using the data block.

[0036] As described above, by generating the second key pair, the data block can be encrypted and decrypted during transmission, preventing attackers from intercepting, eavesdropping and modifying during data transmission.

[0037] Further, recovering the first distributed cipher text using the data block comprises:

[0038] According to the position of the preset byte of each cipher text, the preset byte of the second distributed cipher text is replaced in sequence using the data block.

[0039] As described above, according to the position of the preset byte of each cipher text, the preset byte of the second distributed cipher text is replaced in sequence, thereby restoring the first distributed cipher text.

[0040] Further, after recovering the first distributed cipher text using the data block, the method further comprises:

[0041] decrypting the first distributed cipher text to obtain the decrypted key field, wherein the decrypted key field includes the expiration date of the key field, and if the expiration date of the decrypted key field has expired, the decrypted key field is destroyed.

[0042] As described above, after the key field is decrypted, the key field needs to be used within a predetermined use period, and after the expiration date, the key field can be destroyed, thereby improving the security of data storage.

[0043] Further, the convolutional encryption of the key field of the data to be stored to obtain the first distributed cipher text comprises:

[0044] The key field of the data to be stored is grouped in plaintext, and the first encryption information is obtained by encrypting the initial vector, and then the first encryption information is XOR calculated with the first plaintext to obtain the first cipher text.

[0045] After the first cipher text is encrypted to obtain the second encryption information, the second encryption information is XOR calculated with the second plaintext to obtain the second cipher text, and until the encryption information is XOR calculated with the last plaintext to obtain the last cipher text.

[0046] According to all the cipher texts calculated by XOR, the first distributed cipher text is obtained.

[0047] As described above, by the convolutional encryption method, the plaintext is grouped, and each cipher text is encrypted by layer-by-layer progressive encryption. As long as any data is tampered with, the same cipher text cannot be obtained.

[0048] Please refer to Figure 2 Another embodiment of the present application provides a terminal for secure storage of data, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0049] performing convolutional encryption on a key field of the data to be stored to obtain first distributed ciphertext;

[0050] extracting a preset byte of each ciphertext in the first distributed ciphertext to form a data block, and replacing the extracted byte with a random number to obtain second distributed ciphertext;

[0051] receiving a first public key generated by a secure storage device of the client, encrypting the data block using the first public key to obtain a first ciphertext block;

[0052] sending the first ciphertext block to the client and storing it in the secure storage device of the client.

[0053] As can be seen from the above description, the beneficial effects of the present application are as follows: the key of the data to be stored is encrypted by convolution to obtain first distributed ciphertext, the preset byte of each ciphertext in the first distributed ciphertext is extracted to form a data block, and the extracted part is replaced with a random number to obtain second distributed ciphertext, so the original ciphertext has been modified at this time, according to the principle of convolutional encryption, as long as there is a little change in the front ciphertext data, it will lead to the fact that the decrypted data after the decryption algorithm is completely different from the original plaintext. The first public key sent by the client is received, the data block is encrypted using the first public key to obtain a first ciphertext block and sent to the client, so part of the information of the ciphertext is stored in the client, if there is no client involved, the key field cannot be decrypted, therefore the key sensitive field information is divided into two parts, distributed storage is implemented, the client retains one part, and the user can participate in the process of secure storage of data.

[0054] Further, after the first ciphertext block is sent to the client and stored in the secure storage device of the client, the following steps are included:

[0055] generating an asymmetric key pair, sending a second public key in the asymmetric key pair to the client, so that after the client decrypts the first ciphertext block using a first private key to obtain a data block, the decrypted data block is encrypted using the second public key to obtain a second ciphertext block;

[0056] receiving the second ciphertext block sent by the client and decrypting the second ciphertext block using a second private key in the asymmetric key pair to obtain the data block;

[0057] using the data block to restore the first distributed ciphertext.

[0058] From the above description, by generating a second key pair, the encryption and decryption of the data block during transmission can be performed to prevent the interception, eavesdropping and modification of the attacker during data transmission.

[0059] Further, the recovery of the first distributed ciphertext using the data block comprises:

[0060] According to the position of the preset byte of each ciphertext, the preset byte of the second distributed ciphertext is replaced in sequence by the data block.

[0061] From the above description, according to the position of the preset byte of each ciphertext, the preset byte of the second distributed ciphertext is replaced in sequence, thereby recovering the first distributed ciphertext.

[0062] Further, after the recovery of the first distributed ciphertext using the data block, the following steps are performed:

[0063] The first distributed ciphertext is decrypted to obtain the decrypted key field, wherein the use-by date of the key field is included in the decrypted key field, and if the use-by date of the decrypted key field has expired, the decrypted key field is destroyed.

[0064] From the above description, after the decryption of the key field, the key field needs to be used within the preset use-by date, and after the expiration, the key field can be destroyed, thereby improving the security of data storage.

[0065] Further, the convolutional encryption of the key field of the data to be stored to obtain the first distributed ciphertext comprises:

[0066] The key field of the data to be stored is plaintext grouped, the initial vector is encrypted to obtain first encryption information, and the first encryption information is XOR calculated with the first plaintext to obtain the first ciphertext;

[0067] The first ciphertext is encrypted to obtain second encryption information, and the second encryption information is XOR calculated with the second plaintext to obtain the second ciphertext, and the encryption information is XOR calculated with the last plaintext to obtain the last ciphertext;

[0068] According to all the ciphertexts calculated by XOR, the first distributed ciphertext is obtained.

[0069] From the above description, by the convolutional encryption method, the plaintext is grouped, and each ciphertext is encrypted by layer-by-layer progressive encryption. As long as any data is tampered with, the same ciphertext cannot be obtained in the end.

[0070] The data security storage method and terminal can be used for the security storage of sensitive key fields, and will be described below through specific embodiments.

[0071] Embodiment one

[0072] Please refer to Figure 1 , Figure 4 and Figure 5 , a data security storage method comprises the following steps:

[0073] S1, performing convolutional encryption on a key field of to-be-stored data to obtain a first distributed ciphertext.

[0074] Specifically, the key field of the to-be-stored data is grouped in plaintext, the initial vector is encrypted to obtain first encryption information, and then the first encryption information is XOR calculated with the first plaintext to obtain first ciphertext;

[0075] After the first ciphertext is encrypted to obtain second encryption information, the second encryption information is XOR calculated with the second plaintext to obtain second ciphertext, and the encryption information is XOR calculated with the last plaintext to obtain the last ciphertext.

[0076] According to all the XOR calculated ciphertexts, a first distributed ciphertext is obtained.

[0077] In the convolutional encryption, a random number of a fixed length is first added before the effective data, and then a symmetric key algorithm such as SM4 or AES is used to perform convolutional encryption operation.

[0078] In this embodiment, please refer to Figure 3 , the system end uses a secure encryption device to perform symmetric key CFB mode encryption on the key sensitive field. In the CFB encryption mode, IV is the initial vector, Px is the plaintext grouping, and Cx is the ciphertext grouping. The encryption mode is similar to convolution, using the initial value IV as the seed, XORing the first block of ciphertext after encryption with the plaintext to obtain the first block of ciphertext, and using the ciphertext as the data source for the next encryption, XORing the second block of ciphertext after encryption with the plaintext to obtain the second block of ciphertext, and so on, until all the plaintexts are encrypted.

[0079] Therefore, as long as any several bytes in IV are changed, the Cx obtained by encrypting the same Px will be completely different. Similarly, the Px cannot be decrypted from the Cx.

[0080] S2, extracting a preset byte of each ciphertext in the first distributed ciphertext to form a data block, and replacing the extracted byte in each ciphertext with a random number to obtain a second distributed ciphertext.

[0081] In the embodiment, the first 2-8 bytes of each ciphertext are extracted to form a data block N, and the corresponding original bytes in the first distributed ciphertext are replaced by random numbers to obtain a modified second distributed ciphertext.

[0082] The preset bytes have the characteristics of small amount and fixed position. The first distributed ciphertext can be in the order of KB or even MB, and the amount of the extracted preset bytes is small, generally only 2-64 bytes, and the position of the extracted preset bytes is generally close to the head of the first ciphertext.

[0083] For example, the preset byte extraction positions are 1, 3, 7, 11, 13, and the like, which are set in the head region of the ciphertext as much as possible and have a relatively random interval.

[0084] S3, the first public key generated by the secure storage device of the receiving client is used to encrypt the data block to obtain a first ciphertext block.

[0085] Specifically, the client generates an asymmetric key pair through a secure storage device (UKey), sends the public key to the system side, and the system side uses a secure encryption device to encrypt the data block N with the public key to form a ciphertext block S1.

[0086] S4, the first ciphertext block is sent to the client and stored in the secure storage device of the client.

[0087] S5, an asymmetric key pair is generated, and the second public key in the asymmetric key pair is sent to the client, so that after the client decrypts the first ciphertext block using the first private key to obtain the data block, the decrypted data block is encrypted with the second public key to obtain a second ciphertext block.

[0088] Specifically, the system side generates an asymmetric key pair through a secure encryption device, and sends the public key to the client. The client encrypts the data block N with the second public key inside the UKey to form a ciphertext block S2.

[0089] S6, receiving the second ciphertext block sent by the client and decrypting the second ciphertext block using the second private key in the asymmetric key pair to obtain the data block.

[0090] S7, using the data block to restore the first distributed ciphertext.

[0091] Specifically, according to the position of the preset bytes of each ciphertext, the corresponding preset bytes of the second distributed ciphertext are sequentially replaced by the data block.

[0092] In the embodiment, the second distributed ciphertext is read from the database and stored in the memory, the bytes in the data block N at the system end are extracted, the preset bytes of the second distributed ciphertext are replaced in the memory, and the head of each key sensitive field ciphertext is put back;

[0093] S8, the first distributed ciphertext is decrypted to obtain the decrypted key field, the use period of the key field is included in the decrypted key field, and if the use period of the decrypted key field has expired, the decrypted key field is destroyed.

[0094] Specifically, the system end uses a secure encryption device to perform symmetric key CFB mode decryption on the key sensitive field, and the key sensitive field decrypted by the system end is placed in the memory for use and destroyed when expired.

[0095] Therefore, the CFB decryption mode is selected, which has the effect of convolution, and only a few bytes in the front need to be changed to change all the ciphertexts in the back. Therefore, the user only needs to control a small amount of data to ensure that most of the data cannot be cracked. Through the customized UKey, which is specially used to save the small data fragments of the user end, various stealing methods can be effectively prevented. Moreover, the data blocks in the UKey are protected by public key encryption when being written or read, which can effectively prevent stealing on the transmission line.

[0096] Embodiment two

[0097] Please refer to Figure 2 A terminal 1 for secure data storage, comprising a memory 2, a processor 3, and a computer program stored in the memory 2 and executable on the processor 3, wherein the processor 3 implements each step of the method for secure data storage of embodiment one when executing the computer program.

[0098] In summary, the method and terminal for secure data storage provided by the application perform convolution encryption on the key of the data to be stored to obtain a first distributed ciphertext, extract preset bytes of each ciphertext in the first distributed ciphertext to form a data block, and replace the extracted part with a random number to obtain a second distributed ciphertext. Therefore, the original ciphertext has been modified at this time. According to the convolution encryption principle, as long as the data of the front ciphertext changes a little, the decrypted data of the rear ciphertext will be completely different from the original plaintext after the decryption algorithm is used. The first public key sent by the receiving client is used to encrypt the data block to obtain a first ciphertext block and send it to the client. Therefore, part of the information of the ciphertext is stored in the client. If the client does not participate, the key field cannot be decrypted. Although the size of the data fragments is not uniform, the encryption algorithm can still ensure that the original data cannot be restored even from the side with more data. Therefore, the key sensitive field information is divided into two pieces, and distributed storage is implemented. The client retains one of the two pieces, which enables the user to participate in the data security storage process.

[0099] The above merely illustrates the embodiments of the present application, and is not intended to limit the patent scope of the present application. Any equivalent variation or direct or indirect application in the related technical field made according to the content of the present application specification and drawings shall be included in the patent protection scope of the present application.

Claims

1. A method of secure storage of data, characterized by, The method comprises the steps of: performing convolutional encryption on a key field of data to be stored to obtain first distributed ciphertext; extracting preset bytes of each ciphertext in the first distributed ciphertext to form a data block, and replacing a part of the extracted bytes in each ciphertext with a random number to obtain second distributed ciphertext; receiving a first public key generated by a secure storage device of a client, encrypting the data block using the first public key to obtain a first ciphertext block; sending the first ciphertext block to the client and storing the first ciphertext block in the secure storage device of the client; generating an asymmetric key pair, sending a second public key in the asymmetric key pair to the client, so that the client encrypts the data block obtained by decrypting the first ciphertext block using a first private key using the second public key to obtain a second ciphertext block; receiving the second ciphertext block sent by the client and decrypting the second ciphertext block using a second private key in the asymmetric key pair to obtain the data block; restoring the first distributed ciphertext using the data block: sequentially replacing preset bytes corresponding to the second distributed ciphertext with the data block according to the positions of the preset bytes of each ciphertext.

2. The method of claim 1, wherein, After the first distributed ciphertext is restored using the data block, the method further comprises the steps of: decrypting the first distributed ciphertext to obtain decrypted key fields, wherein the decrypted key fields include a use-by date of the key fields, and if the use-by date of the decrypted key fields has expired, the decrypted key fields are destroyed.

3. The method of claim 1 or 2, wherein, The convolutional encryption on the key field of the data to be stored to obtain the first distributed ciphertext comprises the steps of: performing plaintext grouping on the key field of the data to be stored, encrypting an initial vector to obtain first encrypted information, performing XOR calculation on the first encrypted information and first plaintext to obtain first ciphertext; encrypting the first ciphertext to obtain second encrypted information, performing XOR calculation on the second encrypted information and second plaintext to obtain second ciphertext, and performing XOR calculation on the encrypted information and the last plaintext to obtain the last ciphertext; obtaining the first distributed ciphertext according to all the ciphertexts obtained by the XOR calculation.

4. A terminal for secure storage of data, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the computer program, the following steps are implemented: performing convolutional encryption on a key field of data to be stored to obtain first distributed ciphertext; extracting preset bytes of each ciphertext in the first distributed ciphertext to form a data block, and replacing a part of the extracted bytes in each ciphertext with a random number to obtain second distributed ciphertext; receiving a first public key generated by a secure storage device of a client, encrypting the data block using the first public key to obtain a first ciphertext block; sending the first ciphertext block to the client and storing the first ciphertext block in the secure storage device of the client; generating an asymmetric key pair, sending a second public key in the asymmetric key pair to the client, so that the client encrypts the data block obtained by decrypting the first ciphertext block using a first private key using the second public key to obtain a second ciphertext block; receiving the second ciphertext block sent by the client and decrypting the second ciphertext block using a second private key in the asymmetric key pair to obtain the data block; receiving the second ciphertext block sent by the client, and decrypting the second ciphertext block using a second private key in the asymmetric key pair to obtain the data block; performing recovery of the first distributed ciphertext using the data block: according to the position of the preset byte of each ciphertext, sequentially replacing the preset byte corresponding to the second distributed ciphertext with the data block.

5. The data secure storage terminal according to claim 4, wherein After performing recovery of the first distributed ciphertext using the data block, the following includes: decrypting the first distributed ciphertext to obtain the decrypted key field, wherein the decrypted key field includes the expiration date of the key field, and if the expiration date of the decrypted key field has expired, the decrypted key field is destroyed.

6. A terminal for secure storage of data according to claim 4 or 5, c h a r a c t e r i z e d b y The convolutional encryption of the key field of the data to be stored to obtain the first distributed ciphertext includes: performing plaintext grouping on the key field of the data to be stored, encrypting an initial vector to obtain first encryption information, and performing XOR calculation on the first encryption information and the first plaintext to obtain first ciphertext; encrypting the first ciphertext to obtain second encryption information, and performing XOR calculation on the second encryption information and the second plaintext to obtain second ciphertext, until the encryption information and the last plaintext are subjected to XOR calculation to obtain the last ciphertext; obtaining the first distributed ciphertext according to all the ciphertexts calculated by XOR.

Images