Method, apparatus and server for processing cloud storage data

Abstract

The present specification provides a cloud storage data processing method, device and server. Based on the method, the ciphertext data of the target file obtained by encryption can be first sampled and confused according to a preset sampling confusion rule to obtain two parts of data, namely, the confused ciphertext data of the target file and the sampled ciphertext data; then the confused ciphertext data is uploaded to a first cloud server for cloud storage, and the remaining sampled ciphertext data is stored in a private database based on a block chain, which can only be accessed by the first user terminal or a user terminal holding an authentication credential, thereby effectively protecting the data security of the target file held by the first user and avoiding leakage of the target file held by the first user to the first cloud server or other third parties.

Description

Technical Field

[0001] This manual pertains to the field of cloud storage technology, and in particular relates to cloud storage data processing methods, devices, and servers. Background Technology

[0002] With the rise and development of cloud storage technology, more and more users are getting used to uploading and storing their data files in the cloud.

[0003] However, based on existing methods, the cloud typically stores encrypted data of a user's complete data file, which poses a risk to user data security. For example, when a user no longer wants to store a certain data file in the cloud, the user cannot be sure whether the cloud has actually deleted the encrypted data of that data file. The cloud or other third parties may decrypt the encrypted data of the data file through cracking or other means, leading to the leakage of the user's data file.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This specification provides a method, apparatus, and server for processing cloud storage data, which can effectively protect the data security of target files held by a first user and prevent the leakage of target files held by the first user to a first cloud server or other third parties.

[0006] This specification provides a method for processing cloud storage data, applied to a first user terminal, including:

[0007] The target file is encrypted according to the preset encryption rules to obtain the ciphertext data of the target file, and the relevant target header ciphertext is generated.

[0008] The ciphertext data of the target file is processed according to the preset sampling and obfuscation rules to obtain the obfuscated ciphertext data and sampled ciphertext data of the target file.

[0009] The obfuscated ciphertext data of the target file is uploaded to the first cloud server; the first cloud server stores the obfuscated ciphertext data of the target file and provides feedback on the first target storage address of the obfuscated ciphertext data of the target file.

[0010] The sampled encrypted data of the target file is stored in a blockchain-based private database; wherein, the private database is configured to support access by a first user terminal or a user terminal holding an authentication token;

[0011] The association information of the target file is published on the blockchain; wherein the association information of the target file includes at least: the identification information of the target file, the target header ciphertext, and the first target storage address.

[0012] In one embodiment, the target file is encrypted according to a preset encryption rule to obtain the ciphertext data of the target file, and a related target header ciphertext is generated, including:

[0013] Perform a hash calculation on the target file to obtain a target hash value; then use the target hash value to encrypt the target file to obtain the ciphertext data of the target file;

[0014] The target hash value is signed using the first encryption private key to obtain the target signature data; and the target signature data and the target hash value are encrypted using the first attribute public key to obtain the target header ciphertext.

[0015] In one embodiment, the method further includes:

[0016] Based on the preset attribute encryption algorithm and preset access policy, generate the first user's first attribute public key and first attribute master private key;

[0017] Generate a first encrypted private key using the first attribute master private key and the attribute set of the first user;

[0018] The first user's first attribute public key is published on the blockchain.

[0019] In one embodiment, before generating the first user's first attribute public key and first attribute master private key according to a preset attribute encryption algorithm and a preset access policy, the method further includes:

[0020] A registration request is sent to the system attribute authorization module; wherein the registration request carries at least the user information of the first user, and the system attribute authorization module configures the attribute set of the first user according to the user information of the first user and generates an authentication code corresponding to the first user;

[0021] Receive the attribute set and authentication code of the first user from the system attribute authorization module.

[0022] In one embodiment, the ciphertext data of the target file is processed according to a preset sampling obfuscation rule to obtain the obfuscated ciphertext data and sampled ciphertext data of the target file, including:

[0023] According to the preset sampling and obfuscation rules, the ciphertext data of the target file is divided into multiple ciphertext data groups;

[0024] Determine the random position of each ciphertext data group in multiple ciphertext data groups; and record the random position of each ciphertext data group to obtain the position tuple;

[0025] Extract the data values ​​at random positions in each ciphertext data group to obtain a data tuple; and replace the data values ​​at random positions in each ciphertext data group with the corresponding random parameter values ​​to obtain multiple processed ciphertext data groups.

[0026] Combine multiple processed ciphertext data groups to obtain the obfuscated ciphertext data of the target file; combine position tuples and data tuples to obtain the sampled ciphertext data of the target file.

[0027] In one embodiment, determining the random location for each of a plurality of ciphertext data groups includes:

[0028] The random position of the current ciphertext data block among multiple ciphertext data blocks is determined in the following way:

[0029] Determine the range of random numbers for the current ciphertext data group based on the character length of the current ciphertext data group;

[0030] A random number is generated based on the range of random numbers; and the character position indicated by the random number in the current ciphertext data group is determined as the random position of the current ciphertext data group.

[0031] In one embodiment, replacing the data values ​​at random positions in each ciphertext data group with corresponding random parameter values ​​includes:

[0032] Replace the data value at a random position in the current ciphertext data block with the corresponding random parameter value in the following manner:

[0033] A preset data value is randomly selected from multiple preset data values ​​and used as a random parameter value corresponding to a random position in the current ciphertext data group; the data value at the random position in the current ciphertext data group is then replaced with this random parameter value.

[0034] In one embodiment, after storing the sampled ciphertext data of the target file in a blockchain-based private database, the method further includes:

[0035] In response to the first user's trigger action, generate a target migration request for the target file;

[0036] The target migration request is sent to the smart contract; wherein the target migration request carries obfuscated ciphertext data of the target file based on the first target storage address of the first cloud server and the server identifier of the second cloud server to which it is to be migrated; the smart contract responds to the target migration request and, according to preset migration rules, cooperates with the first cloud server and the second cloud server to migrate the obfuscated ciphertext data of the target file from the first cloud server to the second cloud server for storage.

[0037] The second target storage address is received from the second cloud server as feedback regarding the obfuscated ciphertext data of the target file.

[0038] This manual also provides a method for processing cloud storage data, applied to a second user terminal, including:

[0039] Query the blockchain to obtain the first target storage address and the target header ciphertext of the target file;

[0040] Based on the first target storage address, the obfuscated ciphertext data of the target file is downloaded from the first cloud server;

[0041] Send a target download request for the target file to the smart contract; wherein, if the smart contract determines that the attribute set of the second user matches the preset access policy, it sends an authentication token back to the second user terminal;

[0042] Use authentication tokens to access a blockchain-based private database to obtain sampled ciphertext data of the target file;

[0043] The obfuscated ciphertext data of the target file and the sampled ciphertext data are combined to obtain the ciphertext data of the target file;

[0044] The encrypted data of the target file is decrypted to obtain the target file.

[0045] In one embodiment, the obfuscated ciphertext data and sampled ciphertext data of the target file are combined to obtain the ciphertext data of the target file, including:

[0046] Obtain the preset sampling and obfuscation rules for the target file;

[0047] According to the preset sampling and obfuscation rules, the obfuscated ciphertext data of the target file and the sampled ciphertext data are combined to obtain the ciphertext data of the target file.

[0048] In one embodiment, the encrypted data of the target file is decrypted to obtain the target file, including:

[0049] A second decryption private key is generated based on a preset attribute encryption algorithm and the attribute set of the second user.

[0050] The target header ciphertext is decrypted using the second decryption private key to obtain the target hash value and the target signature data;

[0051] The target file is obtained by decrypting its ciphertext data using the target hash value.

[0052] In one embodiment, after obtaining the target hash value and the target signature data, the method further includes:

[0053] Query the blockchain to obtain the first user's first attribute public key;

[0054] Based on the first attribute public key, the target signature data, and the target hash value, verify whether the data source of the target file belongs to the first user.

[0055] In one embodiment, after obtaining the target file, the method further includes:

[0056] Perform a hash calculation on the target file to obtain the verification hash value;

[0057] The integrity of the target file is verified based on the verification hash value and the target hash value.

[0058] This specification also provides a cloud storage data processing device, applied to a first user terminal, comprising:

[0059] The encryption module is used to encrypt the target file according to the preset encryption rules, obtain the ciphertext data of the target file, and generate the relevant target header ciphertext.

[0060] The sampling and obfuscation module is used to process the ciphertext data of the target file according to the preset sampling and obfuscation rules, and obtain the obfuscated ciphertext data and sampled ciphertext data of the target file.

[0061] The upload module is used to upload the obfuscated ciphertext data of the target file to the first cloud server; wherein, the first cloud server stores the obfuscated ciphertext data of the target file and provides feedback on the first target storage address of the obfuscated ciphertext data of the target file.

[0062] A storage module is used to store the sampled encrypted data of the target file into a blockchain-based private database; wherein, the private database is configured to support access by a first user terminal or a user terminal holding an authentication token;

[0063] The publishing module is used to publish the association information of the target file on the blockchain; wherein, the association information of the target file includes at least: the identification information of the target file, the target header ciphertext, and the first target storage address.

[0064] This specification also provides a cloud storage data processing device for use in a second user terminal, comprising:

[0065] The query module is used to query the blockchain to obtain the first target storage address and the target header ciphertext of the target file;

[0066] The download module is used to download the obfuscated ciphertext data of the target file from the first cloud server according to the first target storage address;

[0067] The sending module is used to send a target download request for a target file to the smart contract; wherein, the smart contract, upon determining that the attribute set of the second user matches the preset access policy, sends an authentication token back to the second user's terminal;

[0068] The acquisition module is used to access a blockchain-based private database using an authentication token to obtain sampled ciphertext data of the target file;

[0069] The combination module is used to combine the obfuscated ciphertext data and sampled ciphertext data of the target file to obtain the ciphertext data of the target file;

[0070] The decryption module is used to decrypt the ciphertext data of the target file to obtain the target file.

[0071] This specification also provides a server, including a processor and a memory for storing processor-executable instructions, wherein the processor executes the instructions to implement the steps of the cloud storage data processing method.

[0072] This specification also provides a computer storage medium storing computer instructions that, when executed by a processor, implement the steps of the cloud storage data processing method.

[0073] This specification also provides a computer program product comprising a computer program that, when executed by a processor, implements the steps of the cloud storage data processing method.

[0074] Based on the cloud storage data processing method, apparatus, and server provided in this specification, when a first user uploads a target file to a first server for cloud storage using a first user terminal, the user can first encrypt the target file according to a preset encryption rule to obtain the ciphertext data of the target file and generate a related target header ciphertext; then, according to a preset sampling obfuscation rule, the ciphertext data of the target file is sampled and obfuscated to obtain the obfuscated ciphertext data and sampled ciphertext data of the target file; then, the obfuscated ciphertext data of the target file is uploaded separately to the first cloud server for cloud storage; wherein, the first cloud server stores the obfuscated ciphertext data of the target file and provides feedback on the first target storage address for the obfuscated ciphertext data of the target file; the first user terminal also stores the sampled ciphertext data of the target file in a blockchain-based private database; wherein, the private database is configured to support access by the first user terminal or a user terminal holding an authentication token; finally, the first user terminal publishes the associated information of the target file on the blockchain; wherein, the associated information of the target file includes at least: the identification information of the target file, the target header ciphertext, and the first target storage address. By first sampling and obfuscating the ciphertext data of the target file according to a preset sampling and obfuscation rule, two parts of data are obtained: obfuscated ciphertext data and sampled ciphertext data. Then, the obfuscated ciphertext data is uploaded to the first cloud server for cloud storage, while the remaining sampled ciphertext data is stored in a blockchain-based private database accessible only to the first user terminal or a user terminal with authentication credentials. This effectively protects the data security of the target file held by the first user, preventing leakage of the target file held by the first user to the first cloud server or other third parties. This allows the first user to effectively exercise their right to forget the target file. Even if the first cloud server cracks the obfuscated ciphertext data of the target file it is responsible for storing, it will not be able to obtain the real and complete target file. Attached Figure Description

[0075] To more clearly illustrate the embodiments of this specification, the accompanying drawings used in the embodiments will be briefly introduced below. The drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0076] Figure 1 This is a flowchart illustrating a cloud storage data processing method provided in one embodiment of this specification;

[0077] Figure 2 This is a schematic diagram illustrating one embodiment of the cloud storage data processing method provided in the embodiments of this specification, applied in a scenario example.

[0078] Figure 3 This is a schematic diagram illustrating one embodiment of the cloud storage data processing method provided in the embodiments of this specification, applied in a scenario example.

[0079] Figure 4 This is a schematic diagram illustrating one embodiment of the cloud storage data processing method provided in the embodiments of this specification, applied in a scenario example.

[0080] Figure 5 This is a schematic diagram illustrating one embodiment of the cloud storage data processing method provided in the embodiments of this specification, applied in a scenario example.

[0081] Figure 6 This is a flowchart illustrating a cloud storage data processing method provided in another embodiment of this specification;

[0082] Figure 7 This is a schematic diagram of the structural composition of a server provided in one embodiment of this specification;

[0083] Figure 8 This is a schematic diagram of the structural composition of a cloud storage data processing device provided in one embodiment of this specification;

[0084] Figure 9 This is a schematic diagram of the structural composition of a cloud storage data processing device provided in another embodiment of this specification. Detailed Implementation

[0085] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0086] See Figure 1 As shown in the embodiments of this specification, a method for processing cloud storage data is provided, wherein the method is specifically applied to the first user terminal side. In specific implementation, the method may include the following:

[0087] S101: Encrypt the target file according to the preset encryption rules to obtain the ciphertext data of the target file, and generate the relevant target header ciphertext;

[0088] S102: Process the ciphertext data of the target file according to the preset sampling and obfuscation rules to obtain the obfuscated ciphertext data and sampled ciphertext data of the target file;

[0089] S103: Upload the obfuscated ciphertext data of the target file to the first cloud server; wherein, the first cloud server stores the obfuscated ciphertext data of the target file and provides feedback on the first target storage address for the obfuscated ciphertext data of the target file;

[0090] S104: Store the sampled ciphertext data of the target file in a blockchain-based private database; wherein, the private database is configured to support access by a first user terminal or a user terminal holding an authentication token;

[0091] S105: Publish the association information of the target file on the blockchain; wherein the association information of the target file includes at least: the identification information of the target file, the target header ciphertext, and the first target storage address.

[0092] In some embodiments, the above-described cloud storage data processing method can be specifically applied to the first user terminal side, wherein the first user (e.g., DO) holds the first user terminal. The first user can be specifically understood as a user who needs cloud storage data files. The target file can be specifically understood as a data file held by the first user that is to be cloud stored.

[0093] Specifically, the aforementioned first user terminal may include a front-end applied to the user side, capable of data collection, data transmission, and other functions. Specifically, the first user terminal may be an electronic device such as a desktop computer, tablet computer, laptop computer, or smartphone. Alternatively, the first user terminal may also be a software application that can run on the aforementioned electronic device. For example, it may be a cloud service app running on a smartphone.

[0094] In specific implementation, the aforementioned target file may include at least one of the following: the first user's resource data (e.g., asset data), the first user's image data (e.g., selfie videos), the first user's text data (e.g., academic papers), the first user's identity information data, etc.

[0095] For details, please refer to Figure 2 As shown, the first user wants to upload a target file to the first cloud service for cloud storage via the first user terminal and blockchain technology. Based on the method provided in this specification, the first user can use the first user terminal to sample and obfuscate the ciphertext data of the target file according to preset sampling and obfuscation rules, obtaining the obfuscated ciphertext data of the target file and the sampled ciphertext data of the target file; then, the obfuscated ciphertext data of the target file is stored in the cloud database through the first cloud server, and the sampled ciphertext data of the target file is stored in the blockchain-based private database through the first user terminal, thus completing the cloud storage of the target file.

[0096] Specifically, the aforementioned first cloud server may include a backend server applied to a cloud storage service platform (e.g., XY Cloud) or a cloud storage service provider (CSP) capable of data transmission, data processing, and other functions. Specifically, the first cloud server may be, for example, an electronic device with data processing, storage, and network interaction capabilities. Alternatively, the first cloud server may be a software program running on the electronic device, providing support for data processing, storage, and network interaction. In this embodiment, the number of servers included in the first cloud server is not specifically limited. The first cloud server may be a single server, several servers, or a server cluster formed by several servers.

[0097] In some embodiments, in a specific implementation, the first user terminal first receives and responds to the upload operation initiated by the first user to obtain the target file; then, it encrypts the target file according to a preset encryption rule (for example, it can be denoted as M) to obtain the ciphertext data of the target file (for example, it can be denoted as E). h (M)) and generate the target header ciphertext (e.g., it can be denoted as Head) associated with the ciphertext data of the target file.

[0098] In some embodiments, the target file is encrypted according to a preset encryption rule to obtain the ciphertext data of the target file, and a related target header ciphertext is generated. In specific implementations, this may include the following:

[0099] S1: Perform a hash calculation on the target file to obtain the target hash value; and use the target hash value to encrypt the target file to obtain the ciphertext data of the target file;

[0100] S2: Sign the target hash value using the first encryption private key to obtain the target signature data; and encrypt the target signature data and the target hash value using the first attribute public key to obtain the target header ciphertext.

[0101] Specifically, a hash function can be used to perform a hash calculation on the target file, and a hash value of a specified length (e.g., denoted as h) can be obtained as the target hash value. Then, this target hash value can be used as an encryption key to encrypt the target file, obtaining its ciphertext data.

[0102] Specifically, a first private encryption key held by the first user and not publicly disclosed can be used (for example, it can be denoted as SK). A Sign the target hash value to obtain the corresponding target signature data (e.g., it can be denoted as sign). h ); then combine the target signature data and the target hash value to obtain the combined data; and use the publicly disclosed first attribute public key (e.g., denoted as PK)A The combined data is then encrypted to obtain the corresponding target header ciphertext.

[0103] In some embodiments, before implementation, the first user terminal may first perform initialization processing to generate the required first attribute public key and first attribute master private key (e.g., denoted as MK). A Key data such as the first encrypted private key.

[0104] Specifically, the method may further include the following in its implementation:

[0105] S1: Generate the first attribute public key and the first attribute master private key for the first user according to the preset attribute encryption algorithm and the preset access policy;

[0106] S2: Generate the first encrypted private key using the first attribute master private key and the attribute set of the first user;

[0107] S3: Publish the first user's first attribute public key on the blockchain.

[0108] The aforementioned attribute-based encryption (ABE) algorithm, also known as attribute-based encryption or attribute-based encryption, can encrypt data based on the attributes of the user. Furthermore, during decryption, there is no need to consider the identity of the user attempting to decrypt; only users whose attributes meet the relevant attribute requirements can successfully decrypt, thus ensuring the confidentiality of the encrypted data.

[0109] Furthermore, user keys in ABE are associated with random polynomials or random numbers, and keys from different users cannot be combined, effectively preventing collusion attacks. Therefore, employing attribute encryption algorithms can further enhance the security of encrypted data and better protect the security of user data files.

[0110] The aforementioned blockchain refers to a novel decentralized distributed computing paradigm that uses an encrypted chain-like block structure to verify and store data, generates and updates data based on consensus algorithms of distributed nodes, and uses smart contracts (a type of automated script) to program and manipulate data. First, blockchain uses cryptographic methods, rather than a central institution, to establish trust relationships between nodes, thus forming a decentralized distributed architecture. Second, blockchain leverages the powerful computing power generated by consensus algorithms such as proof-of-work among distributed system nodes to resist external attacks. Typically, it takes breaking more than 51% of the nodes to tamper with information. Therefore, in a sufficiently large blockchain system, the cost of tampering with information becomes extremely high, ensuring the immutability and forgery resistance of blockchain data. The decentralized mechanism, extremely high reliability, and immutability of block data in blockchain technology make it highly suitable for using cloud storage environments for high-security data protection.

[0111] The blockchain used in this specification may specifically be a Fabric consortium blockchain.

[0112] In some embodiments, the aforementioned preset attribute encryption algorithm may specifically include a Ciphertext Policy Attribute Based Encryption (CP-ABE) algorithm. Based on CP-ABE, using a ciphertext access control mechanism, ciphertext can be combined with an access policy, and the key can be combined with user attributes. Specifically, based on CP-ABE, the data file holder can formulate specific access control policies during the encryption phase (e.g., a preset access policy, denoted as T). Other users must satisfy the relevant access control policies based on their own attributes before they can access the data file.

[0113] In addition, the aforementioned preset attribute encryption algorithm may also include a key policy attribute based encryption algorithm (KP-ABE). Based on KP-ABE, using a key access control mechanism, ciphertext can be combined with attributes, and keys can be combined with access policies.

[0114] In cloud storage scenarios, considering the characteristics of the scenario and processing requirements, and taking into account that CP-ABE can more effectively and conveniently implement access control, this specification mainly selects CP-ABE as the preset attribute encryption algorithm for specific data processing.

[0115] In practice, a first attribute public key and a first attribute master private key for the first user can be generated based on a preset attribute encryption algorithm and a preset access policy. The preset access policy can be customized by the first user through their terminal. Next, a corresponding transaction encryption private key can be generated using the first attribute master private key and the first user's attribute set (e.g., denoted as S). The first encryption private key is secret data held by the first user and not publicly disclosed; the first attribute public key can be published on the blockchain by the first user terminal for other users to query and use, depending on the circumstances.

[0116] In some embodiments, before generating the first attribute public key and the first attribute master private key of the first user according to a preset attribute encryption algorithm and a preset access policy, the method may further include the following:

[0117] S1: Send a registration request to the system attribute authorization module; wherein the registration request carries at least the user information of the first user, and the system attribute authorization module configures the attribute set of the first user according to the user information of the first user and generates an authentication code corresponding to the first user;

[0118] S2: Receive the attribute set and authentication code of the first user from the system attribute authorization module.

[0119] The aforementioned system attribute authorization module, also known as a system attribute authorization authority (CA), is specifically used to generate public parameters, such as the system public key (PK). c The system's complete attribute set U is also recorded, and this data is published on the blockchain to facilitate subsequent verification of whether users have the right to access the data.

[0120] In practice, whenever a user wishes to use cloud storage services, they can submit registration information containing their user information by sending a registration request to the CA via their user terminal. The CA can then use this registration information to authorize the user's attributes, generate an attribute set for that user, and a corresponding authentication code (e.g., ID), which is then sent back to the user terminal. This authentication code can be used to identify the corresponding user.

[0121] In some embodiments, see Figure 3 As shown, the above process of processing the ciphertext data of the target file according to the preset sampling obfuscation rules yields the obfuscated ciphertext data and sampled ciphertext data of the target file. In specific implementations, this may include the following:

[0122] S1: According to the preset sampling and obfuscation rules, the ciphertext data of the target file is divided into multiple ciphertext data groups;

[0123] S2: Determine the random position of each ciphertext data group in multiple ciphertext data groups; and record the random position of each ciphertext data group to obtain the position tuple;

[0124] S3: Extract the data values ​​at random positions in each ciphertext data group to obtain a data tuple; and replace the data values ​​at random positions in each ciphertext data group with the corresponding random parameter values ​​to obtain multiple processed ciphertext data groups.

[0125] S4: Combine multiple processed ciphertext data groups to obtain the obfuscated ciphertext data of the target file; combine position tuples and data tuples to obtain the sampled ciphertext data of the target file.

[0126] In some embodiments, determining the random position for each of the multiple encrypted data groups can, in specific implementation, include: determining the random position of the current encrypted data group in the multiple encrypted data groups in the following manner: determining a random number range for the current encrypted data group based on the character length of the current encrypted data group; generating a random number based on the random number range; and determining the character position indicated by the random number in the current encrypted data group as the random position of the current encrypted data group.

[0127] In some embodiments, replacing the data values ​​at random positions in each encrypted data group with corresponding random parameter values ​​can be implemented in the following way: replacing the data values ​​at random positions in the current encrypted data group with corresponding random parameter values ​​by randomly selecting a preset data value from a plurality of preset data values ​​as the random parameter value corresponding to the random position in the current encrypted data group; and replacing the data values ​​at random positions in the current encrypted data group with the random parameter value.

[0128] Specifically, for example, random numbers can be introduced and used to sample and obfuscate the ciphertext data of the target file according to a preset sampling and obfuscation rule in the following way:

[0129] S1: First, extract the ciphertext data E from the target file. h (M) is divided into k groups, resulting in k ciphertext data groups. Specifically, during the division, one ciphertext data group can be obtained by dividing every m bits from the ciphertext data of the target file.

[0130] S2: For each ciphertext data block, one or more random positions can be determined based on the sampling frequency. Specifically, for a ciphertext data block, n bits can be sampled.

[0131] For example, for a ciphertext data set, n integers pi can be randomly generated, satisfying the following random number range: 0 ≤ pi ≤ L(m), where L(m) is the character length of the ciphertext data set, and i = 1, 2, 3, ..., n. In practice, a random number generator can be used to generate pi. The position indicated by pi in the ciphertext data set can be determined as the random position of the ciphertext data set.

[0132] S3: For each ciphertext data group, the data value (e.g., bit data) at the pi-th position in the ciphertext data can be collected and stored in the data tuple EB; at the same time, the random number pi is also stored in the position tuple EP.

[0133] For example, after sampling any ciphertext data group j as described above, the following data element combination position tuples can be obtained: EBj=(b1,…,bi,…,bn), EPj=(p1,…,pi,…,pn). Where j=1,2,3,…,k.

[0134] S4: While sampling at random position Pi in each ciphertext data group, the ciphertext data group can also be obfuscated by replacing the data value at position Pi.

[0135] When replacing the pi position, a data value can be randomly selected from the preset data values ​​0 and 1 as a random parameter value, and the data value at the pi position can be replaced with the random parameter value.

[0136] Following the above method, after sampling and obfuscation processing are performed on each ciphertext data group, multiple processed ciphertext data groups can be obtained. By combining these multiple processed ciphertext data groups, the obfuscated ciphertext data of the target file can be obtained, which can be denoted as E2(M).

[0137] It should be noted that the ciphertext data obtained at this point is no longer the actual ciphertext data of the target file. Even if the obfuscated ciphertext data is decrypted through cracking methods, the real target file cannot be obtained.

[0138] S5: Combining the data tuples EB and position tuples EP of multiple ciphertext data groups in the corresponding order yields the sampled ciphertext data of the target file, which can be denoted as E1(M) = (EB, EP).

[0139] In some embodiments, the first user terminal may upload the obfuscated ciphertext data of the target file to the first cloud server.

[0140] In practice, the first user terminal can generate and send a storage request to the first cloud server, wherein the storage request carries at least the obfuscated ciphertext data of the target file. Correspondingly, the first cloud server can receive and respond to the storage request, store the obfuscated ciphertext data of the target file in the cloud, and provide the first user terminal with the first target storage address for the obfuscated ciphertext data of the target file. Furthermore, the first cloud server can also write the records of receiving and storing the obfuscated ciphertext data of the target file into the blockchain for easy retrospective querying.

[0141] Simultaneously, the first user terminal can also store the sampled encrypted data of the aforementioned target file into a blockchain-based private database. This private database can be understood as a blockchain-based database associated with the user. This private database can be configured so that only the user's terminal or a user terminal holding an authentication token has access to it.

[0142] Next, the first user terminal can publish the association information with the target file on the blockchain, so that other users can obtain and utilize the association information on the blockchain to download the target file in a compliant manner.

[0143] The associated information of the aforementioned target file may include at least: the target file's identification information, the target header ciphertext, and the first target storage address. Furthermore, the associated information may also include the user identifier of the first user holding the target file, the target file's digest content, etc.

[0144] Through the above method, the first user terminal can obtain two parts of data: obfuscated ciphertext data and sampled ciphertext data, from the original, complete ciphertext data of the target file. The original target file cannot be obtained based on either part of the data alone. Furthermore, the first user terminal stores these two parts separately: the larger obfuscated ciphertext data is stored in the cloud via a first cloud server; the smaller sampled ciphertext data is stored separately in a private blockchain-based database. This effectively prevents the first cloud server or other third parties from simultaneously accessing both parts of the data without permission, thus effectively protecting the data security of the target file.

[0145] In some embodiments, see Figure 4 and Figure 5 As shown, after storing the sampled ciphertext data of the target file in a blockchain-based private database, the method may further include the following in its specific implementation:

[0146] S1: Respond to the first user's trigger operation and generate a target migration request for the target file;

[0147] S2: Send the target migration request to the smart contract; wherein, the target migration request carries obfuscated ciphertext data of the target file based on the first target storage address of the first cloud server and the server identifier of the second cloud server to which it is to be migrated; the smart contract responds to the target migration request and, according to preset migration rules, cooperates with the first cloud server and the second cloud server to migrate the obfuscated ciphertext data of the target file from the first cloud server to the second cloud server for storage.

[0148] S3: Receive the second target storage address of the obfuscated ciphertext data of the target file from the second cloud server.

[0149] In this embodiment, the first user wants to migrate the obfuscated ciphertext data of a target file originally stored on the first cloud server to a second cloud server for storage. Specifically, the second cloud server can be understood as a cloud server on a different cloud storage service platform than the one corresponding to the first cloud server.

[0150] For specific implementation, please refer to Figure 5 As shown, the first user terminal can respond to a trigger operation initiated by the first user and generate a target migration request for the target file. Specifically, this target migration request may also carry data such as the first target storage address where the obfuscated ciphertext data of the target file is currently stored on the first cloud server, and the server identifier (e.g., CSP2) of the second cloud server to which the obfuscated ciphertext data of the target file is to be migrated. Furthermore, the target migration request may also carry the first user's authentication code to prove that they have the authority to migrate the obfuscated ciphertext data of the target file. In addition, the target migration request may also carry the server identifier (e.g., CSP1) of the first cloud server.

[0151] The smart contract responds to the target migration request and, according to preset migration rules, collaborates with the first and second cloud servers to migrate the obfuscated ciphertext data of the target file from the first cloud server to the second cloud server for storage. Specifically, this may include the following: The smart contract receives and responds to the target migration request, generates a temporary symmetric encryption key (or session key) based on a symmetric encryption algorithm, and sends this temporary symmetric encryption key to the first and second cloud servers respectively via a secure channel; Upon receiving the temporary symmetric encryption key, the first and second cloud servers can establish a secure connection according to relevant protocols (e.g., SSL (Secure Socket Layer) protocol); Then, the first cloud server can use the temporary symmetric encryption key to encrypt the obfuscated ciphertext data of the target file, obtaining the encrypted obfuscated ciphertext data of the target file, and then send the encrypted obfuscated ciphertext data of the target file to the second cloud server via the secure connection to complete the data migration.

[0152] After receiving the obfuscated ciphertext data of the encrypted target file, the second cloud server can first attempt to decrypt it using the received temporary symmetric encryption key. If decryption is successful, the obfuscated ciphertext data of the target file can be obtained. Then, the second cloud server can store the obfuscated ciphertext data of the target file and simultaneously send the second target storage address of the obfuscated ciphertext data of the target file back to the first user terminal. In addition, the first cloud server deletes the stored obfuscated ciphertext data of the target file according to the corresponding protocol rules and sends the deletion information to the first user terminal.

[0153] Furthermore, the first cloud server and / or the second cloud server can write the migration records of the obfuscated ciphertext data of the target file and the data access records of the first user terminal into the blockchain for subsequent backtracking and querying.

[0154] After receiving the second target storage address, the first user terminal can also publish the second target storage address to the blockchain to update the storage address of the obfuscated ciphertext data of the target file on the blockchain.

[0155] After receiving the obfuscated ciphertext data of the encrypted target file, the second cloud server attempts to decrypt it using the received temporary symmetric encryption key. If decryption fails, the second cloud server obtains the obfuscated ciphertext data of the target file. Then, the second cloud server can generate a retransmission command and send it to the first cloud server. The first cloud server can respond to the retransmission command, and after confirming that the temporary symmetric encryption key it holds is consistent with that of the second cloud server, it re-encrypts the obfuscated ciphertext data of the target file using the temporary symmetric encryption key, and resends the encrypted obfuscated ciphertext data of the target file to the second cloud server.

[0156] Based on the above method, the obfuscated ciphertext data of the target file to be transmitted is encrypted using a session key temporarily and randomly generated by a smart contract before transmission. This ensures that the obfuscated ciphertext data of the target file is not easily leaked due to attacks during the migration process. Furthermore, based on this method, even if the obfuscated ciphertext data of the encrypted target file is intercepted and cracked by a third party during the migration process, since the transmitted data is not the true and complete ciphertext data of the target file, the third party cannot obtain the real and complete target file, thus effectively protecting the data security of the target file during the migration process.

[0157] See Figure 6 and Figure 5 As shown in the embodiments of this specification, another method for processing cloud storage data is also provided, applied to a second user terminal. Specifically, this method may include the following:

[0158] S601: Query the blockchain to obtain the first target storage address and target header ciphertext of the target file;

[0159] S602: Based on the first target storage address, download the obfuscated ciphertext data of the target file through the first cloud server;

[0160] S603: Send a target download request for the target file to the smart contract; wherein, the smart contract, upon determining that the attribute set of the second user matches the preset access policy, sends an authentication token back to the second user terminal;

[0161] S604: Use an authentication token to access a blockchain-based private database to obtain sampled ciphertext data of the target file;

[0162] S605: Combine the obfuscated ciphertext data and the sampled ciphertext data of the target file to obtain the ciphertext data of the target file;

[0163] S606: Decrypt the ciphertext data of the target file to obtain the target file.

[0164] In some embodiments, see Figure 5 As shown, a second user (e.g., AU) holds a second user terminal. The second user wishes to download and obtain the target file held by the first user through the second user terminal.

[0165] A second user can obtain the target file's association information by querying the blockchain using the target file's identifier information. Based on this association information, the first target storage address and the target file's encrypted header can be obtained. Furthermore, the user identifier of the first user holding the target file can also be obtained based on the association information.

[0166] Next, the second user can use their second user terminal to generate a corresponding download request based on the first target storage address; and send this download request to the first cloud server to download the obfuscated ciphertext data of the target file. Correspondingly, the first cloud server can write data access records about the second user terminal and download records of the obfuscated ciphertext data of the target file into the blockchain.

[0167] Simultaneously, the second user terminal can also generate a separate target download request for the target file, used to download and obtain the sampled encrypted data of the target file. Specifically, the second user terminal can send this target download request to the smart contract.

[0168] The smart contract receives and responds to the target download request, interacts with the second user terminal, obtains the second user's attribute set (e.g., S'), and checks whether the second user's attribute set matches the preset access policy. If it is determined that the second user's attribute set matches the preset access policy, it can be determined that the second user has permission to access the first user's private database. At this point, a corresponding authentication token (e.g., token) can be generated based on the token parameters and fed back to the second user terminal. Specifically, the second user's attribute set can be generated by the system attribute authorization module after the second user has pre-authorized attributes with the system attribute authorization module using the second user terminal.

[0169] Specifically, the token parameters of the aforementioned authentication token may include one or more of the following: the scope of permissions of the authentication token, the validity period of the authentication token, and the conditions for using the authentication token. These token parameters may be pre-set by the first user through chaincode configuration during the smart contract editing process using their terminal.

[0170] In the specific matching process, the corresponding preset access structure (which can be denoted as T') can be determined according to the preset access strategy. Then, by detecting whether the attribute set of the second user conforms to the preset access structure, it can be determined whether the attribute set of the second user matches the preset access strategy.

[0171] Specifically, the ABE-based encryption mechanism can achieve fine-grained access control for users by defining various access policies, thereby enabling secure sharing of data files among multiple users.

[0172] The access structure based on access policies can be defined as follows: Let set P = {P1, P2, ..., P...} n A set P consists of n participants and has a total of 2... P Let be a subset of , and denote the set of all subsets as 2. P Let A be the non-empty set of several subsets of P, where A∈2. P For any B and C, when B∈A, If C ∈ A, then set A is monotonic, and A is an access structure on the set P consisting of n participants. If a set D belongs to set A, then set D is said to be an authorized set. Conversely, set D is an unauthorized set.

[0173] The aforementioned access mechanisms can specifically include: tree access structures, AND gate access structures, LSSS access structures, etc. The following mainly uses the tree access structure as an example for specific explanation.

[0174] Specifically, let T be the access control tree. Any non-leaf node in T is called a threshold gate, which is described by all its child nodes and the threshold value. The number of child nodes of any node x is denoted by num. x This means that node x should have a threshold value k. x The threshold value k x It needs to satisfy: 0≤k x ≤num x Among them, when k x When k = 1, node x is represented as an OR gate; when k = 1, node x is represented as an OR gate. x =num x At this point, node x is represented as an AND gate. If x is a leaf node, its threshold value k x =1, and x is described by some attribute. For each node, all its child nodes range from 1 to num. x The nodes are numbered sequentially, with index(x) representing the specific index of child node x among its surrounding sibling nodes. Meanwhile, parent(x) represents the parent node of node x, and attr(x) represents the attribute associated with node x.

[0175] Each non-leaf node in the access tree structure represents a threshold value. The logical relationship is represented by `nof m`, meaning that if n out of m attributes are satisfied, the gate is valid. An AND gate is `n of n`, and an OR gate is `1 of n`. Each node represents a secret, with nodes closer to the root having higher weights. x To access the subtree of the control tree T.

[0176] When specifically determining whether an attribute set conforms to the access structure, if the attribute set γ conforms to the access control structure tree T... x At that time, T can be obtained. x (γ) = 1. By passing T x (γ) Perform the following recursive operation to determine whether the attribute set γ satisfies the access control tree T:

[0177] If x is a leaf node, T is true if and only if the attribute attr(x) associated with that node x belongs to γ. x (γ) = 1; If x is not a leaf node, then the value of Tx(γ) corresponding to all child nodes of x needs to be calculated first. If the non-leaf node x has at least k x T child nodes x When (γ) is 1, it can be proven that T x (γ) = 1. Using the above recursive algorithm, it can be finally determined whether the user's attribute set γ satisfies the access control structure tree T of the encryption mechanism.

[0178] In this embodiment, before implementation, the first user can set a suitable access control structure as a preset access structure through the first user terminal and publish the corresponding preset access policy to the smart contract. When the smart contract receives the attribute set provided by the second user, it can determine whether the attribute set of the second user conforms to the preset access structure in the manner described above.

[0179] After obtaining the authentication token, the second user terminal can use the authentication token to access the first user's blockchain-based private database within the corresponding permission scope according to the relevant protocol (e.g., JWT protocol or CAS protocol) in order to successfully download and obtain the sampled ciphertext data of the target file.

[0180] In addition, the second user terminal can also obtain preset sampling obfuscation rules by accessing the first user's blockchain-based private database based on the authentication token.

[0181] In some embodiments, the obfuscated ciphertext data and sampled ciphertext data of the combined target file are combined to obtain the ciphertext data of the target file. In specific implementations, this may include the following:

[0182] S1: Obtain the preset sampling and obfuscation rules for the target file;

[0183] S2: According to the preset sampling and obfuscation rules, combine the obfuscated ciphertext data of the target file and the sampled ciphertext data to obtain the ciphertext data of the target file.

[0184] Based on the above embodiments, the second user terminal can obtain the real and complete ciphertext data of the target file by combining the obfuscated ciphertext data and the sampled ciphertext data of the target file.

[0185] In some embodiments, the above-described decryption process of the encrypted data of the target file to obtain the target file may include the following:

[0186] S1: Generate a second decryption private key based on the preset attribute encryption algorithm and the attribute set of the second user;

[0187] S2: Use the second decryption private key to decrypt the target header ciphertext and obtain the target hash value and target signature data;

[0188] S3: Decrypt the ciphertext data of the target file using the target hash value to obtain the target file.

[0189] In practice, the second user terminal can use CP-ABE and the attribute set of the second user to generate the second user's private key (for example, it can be denoted as SK). B ), as the second decryption private key.

[0190] It should be noted that, based on the CP-ABE algorithm mechanism, if a decryption private key generated using an attribute set that matches the preset access policy is used, it can normally decrypt ciphertext data encrypted using the attribute public key generated based on CP-ABE and the preset access policy.

[0191] Specifically, in the CP-ABE-based encryption process, the first user can use the plaintext target file and the access control structure tree T to generate ciphertext ET embedded with a preset access structure, as shown in Equation 1-1. Here, G1 and G2 are defined as p-order multiplicative cyclic groups, and g is a generator of G1. A bilinear pair e based on a bilinear mapping is defined: G1 × G1 → G2. p Given a finite additive group with p elements, random numbers α and β both belong to Z. p Y represents the set of attributes of all leaf nodes in the tree structure, and attr(x) represents the attribute associated with the leaf node x.

[0192] ET = (T, C' = M·e(g,g)) αs C = h s , C y=g qy(0) C' y =H(arrt(y)) qy (0) (1-1)

[0193] During the CP-ABE-based decryption process, the ciphertext ET and the second user's private key SK can be used. B Given a node x on the access control structure T, the defined recursive algorithm Decrypt Node outputs a value or "≠" from the G2 group. Here, ≠ indicates that the user's attributes do not conform to the access structure, and the data cannot be decrypted. The algorithm distinguishes between leaf nodes and non-leaf nodes, using the corresponding formulas for recursive computation.

[0194] Specifically, if x is a leaf node, then recursive calculations are performed using formula 1-2:

[0195]

[0196] If x is a non-leaf node, then recursive calculation is performed using formula 1-3:

[0197]

[0198] Where z is any child node in the set Sx of child nodes of node x, i = index(x), S x' ={index(z):z∈S x}

[0199] Through the recursive operation of node x described above, the result calculated by the algorithm for root node R is obtained from bottom to top, as shown in Formula 1-4:

[0200] DecryptNode(ET,SK,R) = e(g,g) r·qR (0) = e(g,g) r.s =A. (1-4)

[0201] If the second user's attribute set satisfies the preset access structure T', then for the private key SK B The value A in the G2 group can be calculated, and the original data can be decrypted using the calculated value A. The calculation formula is shown in Formula 1-5:

[0202]

[0203] Specifically, the bilinear mapping described above can be defined as follows: G1 and G2 are two multiplicative cyclic groups of order p, and g is a generator of G1. A bilinear mapping is defined as e: G1 × G1 → G2. G1 is called a bilinear group if e satisfies the following condition:

[0204] Bilinear: for any a, b∈Z p For any u, v ∈ G1, the equation e(u a ,v b )=e(u,v) ab It will always be true;

[0205] Non-degenerate: e(g,g)≠1;

[0206] Computability: For any u, v∈G1, the computation of the bilinear mapping is always valid.

[0207] Based on the above three conditions, we can deduce that bilinear mappings also have the following properties: 1) For any three elements g1, g2, and g3 in G, e(g1·g3,g2)=e(g1,g2)·e(g3,g2); 2) For any three elements g1, g2, and g3 in G, e(g1,g2·g3)=e(g1,g2)·e(g1,g3).

[0208] When the second user's attribute set matches the preset access policy, the second user terminal can successfully decrypt the target header ciphertext using a second decryption private key generated based on the preset attribute encryption algorithm and the second user's attribute set, obtaining the target hash value and target signature data. Furthermore, the second user terminal can use the target hash value as the decryption key to decrypt the ciphertext data of the target file, obtaining the target file in its complete plaintext form.

[0209] In some embodiments, after obtaining the target hash value and target signature data, the method may further include the following:

[0210] S1: Query the blockchain to obtain the first user's first attribute public key;

[0211] S2: Based on the first attribute public key, target signature data, and target hash value, verify whether the data source of the target file is the first user.

[0212] In practice, the second user terminal can use the first user's first attribute public key and the target hash value to perform a signature operation to obtain the corresponding verification signature; then compare the verification signature with the target signature data to determine whether the data source of the target file is the first user.

[0213] If the verification signature and the target signature data are confirmed to match, then the data source of the target file can be determined to be the primary user, and therefore the data source of the target file can be judged to be trustworthy. Conversely, if the verification signature and the target signature data are confirmed to be inconsistent, then the data source of the target file can be determined to be the secondary user, and therefore the data source of the target file can be judged to be potentially untrustworthy.

[0214] In some embodiments, after obtaining the target hash value and target signature data, the method may further include the following:

[0215] S1: Perform hash calculation on the target file to obtain the verification hash value;

[0216] S2: Verify the integrity of the target file based on the check hash value and the target hash value.

[0217] In practice, the second user terminal can use a hash function to perform a hash operation on the target file to obtain the corresponding hash value as the verification hash value (for example, it can be denoted as h*); then compare the verification hash value with the target hash value to determine whether the obtained target file is complete.

[0218] If the difference between the verification hash value and the target hash value is less than a preset difference threshold and close to 0, then the obtained target file can be determined to be complete. Conversely, if the difference between the verification hash value and the target hash value is greater than or equal to the preset difference threshold, then the obtained target file can be determined to be incomplete.

[0219] Based on the above embodiments, the second user terminal can also use the target hash value and target signature data to verify the data source and / or integrity of the obtained target file, thereby accurately determining whether the obtained target file is a data file that meets the requirements.

[0220] As can be seen from the above, based on the cloud storage data processing method provided in the embodiments of this specification, when a first user uploads a target file to a first server for cloud storage using a first user terminal, the first user can first encrypt the target file according to a preset encryption rule to obtain the ciphertext data of the target file and generate a related target header ciphertext; then, the ciphertext data of the target file is processed according to a preset sampling obfuscation rule to obtain the obfuscated ciphertext data and sampled ciphertext data of the target file; then, the obfuscated ciphertext data of the target file is uploaded to the first cloud server; wherein, the first cloud server stores the obfuscated ciphertext data of the target file and provides feedback on the first target storage address for the obfuscated ciphertext data of the target file; the sampled ciphertext data of the target file is stored in a blockchain-based private database; wherein, the private database is configured to support access by the first user terminal or a user terminal holding an authentication token; the associated information of the target file is published on the blockchain; wherein, the associated information of the target file includes at least: the identification information of the target file, the target header ciphertext, and the first target storage address. By first sampling and obfuscating the ciphertext data of the target file according to preset sampling and obfuscation rules, two parts of data are obtained: obfuscated ciphertext data and sampled ciphertext data. The obfuscated ciphertext data is then uploaded to a first cloud server for cloud storage, while the remaining sampled ciphertext data is stored in a blockchain-based private database accessible only to the first user terminal or a user terminal with authentication credentials. This effectively protects the data security of the target file held by the first user, preventing leakage to the first cloud server or other third parties. It allows the first user to effectively exercise their right to forget the target file. Even if the first cloud server decrypts the obfuscated ciphertext data it is responsible for storing, it cannot obtain the actual target file. Furthermore, processing and storing the ciphertext data of the target file in this way can also meet the needs of the first user, securely and effectively completing the data migration of the target file and preventing the leakage of related data during the migration process.

[0221] This specification also provides a server, including a processor and a memory for storing processor-executable instructions. Specifically, the processor can perform the following steps according to the instructions: encrypting a target file according to a preset encryption rule to obtain ciphertext data of the target file and generating a related target header ciphertext; processing the ciphertext data of the target file according to a preset sampling obfuscation rule to obtain obfuscated ciphertext data and sampled ciphertext data of the target file; uploading the obfuscated ciphertext data of the target file to a first cloud server; wherein the first cloud server stores the obfuscated ciphertext data of the target file and provides feedback on a first target storage address for the obfuscated ciphertext data of the target file; storing the sampled ciphertext data of the target file in a blockchain-based private database; wherein the private database is configured to support access by a first user terminal or a user terminal holding an authentication token; publishing the associated information of the target file on the blockchain; wherein the associated information of the target file includes at least: the target file's identification information, the target header ciphertext, and the first target storage address. Specifically, the above server can be deployed on the user side as a user terminal for user use.

[0222] To execute the above instructions more accurately, please refer to... Figure 7 This specification also provides another specific server in the embodiments, wherein the server includes a network communication port 701, a processor 702 and a memory 703, and the above structures are connected by internal cables so that the various structures can perform specific data interaction.

[0223] Specifically, the network communication port 701 can be used to obtain the target file to be stored in the cloud.

[0224] The processor 702 is specifically configured to: encrypt a target file according to a preset encryption rule to obtain ciphertext data of the target file and generate a related target header ciphertext; process the ciphertext data of the target file according to a preset sampling obfuscation rule to obtain obfuscated ciphertext data and sampled ciphertext data of the target file; upload the obfuscated ciphertext data of the target file to a first cloud server; wherein the first cloud server stores the obfuscated ciphertext data of the target file and provides feedback on a first target storage address for the obfuscated ciphertext data of the target file; store the sampled ciphertext data of the target file in a blockchain-based private database; wherein the private database is configured to support access by a first user terminal or a user terminal holding an authentication token; and publish the associated information of the target file on the blockchain; wherein the associated information of the target file includes at least: the identification information of the target file, the target header ciphertext, and the first target storage address.

[0225] The memory 703 can be used to store the corresponding instruction program.

[0226] In this embodiment, the network communication port 701 can be a virtual port bound to different communication protocols, thereby enabling the sending or receiving of different data. For example, the network communication port can be a port responsible for web data communication, a port responsible for FTP data communication, or a port responsible for email data communication. Furthermore, the network communication port can also be a physical communication interface or communication chip. For example, it can be a wireless mobile network communication chip, such as GSM or CDMA; it can also be a Wi-Fi chip; or it can be a Bluetooth chip.

[0227] In this embodiment, the processor 702 can be implemented in any suitable manner. For example, the processor can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers, etc. This specification is not limiting.

[0228] In this embodiment, the memory 703 may include multiple layers. In a digital system, anything that can store binary data can be a memory. In an integrated circuit, a circuit with storage function but no physical form is also called a memory, such as RAM, FIFO, etc. In a system, a storage device with a physical form is also called a memory, such as a memory stick, TF card, etc.

[0229] This specification also provides another server, including a processor and a memory for storing processor-executable instructions. Specifically, the processor can perform the following steps according to the instructions: querying the blockchain to obtain a first target storage address and a target header ciphertext of the target file; downloading obfuscated ciphertext data of the target file from a first cloud server based on the first target storage address; sending a target download request for the target file to a smart contract; wherein, the smart contract, upon determining that the attribute set of the second user matches a preset access policy, sends an authentication token to the second user terminal; using the authentication token to access a blockchain-based private database to obtain sampled ciphertext data of the target file; combining the obfuscated ciphertext data and the sampled ciphertext data of the target file to obtain the ciphertext data of the target file; and decrypting the ciphertext data of the target file to obtain the target file.

[0230] This specification also provides a computer storage medium based on the above-described cloud storage data processing method. The computer storage medium stores computer program instructions, which, when executed, perform the following: encrypting a target file according to a preset encryption rule to obtain ciphertext data of the target file and generating a related target header ciphertext; processing the ciphertext data of the target file according to a preset sampling obfuscation rule to obtain obfuscated ciphertext data and sampled ciphertext data of the target file; uploading the obfuscated ciphertext data of the target file to a first cloud server; wherein the first cloud server stores the obfuscated ciphertext data of the target file and provides feedback on a first target storage address for the obfuscated ciphertext data of the target file; storing the sampled ciphertext data of the target file in a blockchain-based private database; wherein the private database is configured to support access by a first user terminal or a user terminal holding an authentication token; and publishing the associated information of the target file on the blockchain; wherein the associated information of the target file includes at least: the target file's identification information, the target header ciphertext, and the first target storage address.

[0231] In this embodiment, the storage medium includes, but is not limited to, Random Access Memory (RAM), Read-Only Memory (ROM), cache, hard disk drive (HDD), or memory card. The memory can be used to store computer program instructions. The network communication unit can be an interface configured according to standards specified in the communication protocol for network connection communication.

[0232] In this embodiment, the specific functions and effects implemented by the program instructions stored in the computer storage medium can be explained in comparison with other implementation methods, and will not be repeated here.

[0233] This specification also provides another computer storage medium based on the above-described cloud storage data processing method. The computer storage medium stores computer program instructions, which, when executed, perform the following: querying the blockchain to obtain the first target storage address and the target header ciphertext of the target file; downloading the obfuscated ciphertext data of the target file from the first cloud server based on the first target storage address; sending a target download request for the target file to a smart contract; wherein, the smart contract, upon determining that the attribute set of the second user matches a preset access policy, sends an authentication token to the second user terminal; using the authentication token to access a blockchain-based private database to obtain sampled ciphertext data of the target file; combining the obfuscated ciphertext data and the sampled ciphertext data of the target file to obtain the ciphertext data of the target file; and decrypting the ciphertext data of the target file to obtain the target file.

[0234] This specification also provides a computer program product comprising a computer program that, when executed by a processor, implements the steps of the cloud storage data processing method. Specifically, it can implement the following steps: encrypting a target file according to a preset encryption rule to obtain ciphertext data of the target file and generating a related target header ciphertext; processing the ciphertext data of the target file according to a preset sampling obfuscation rule to obtain obfuscated ciphertext data and sampled ciphertext data of the target file; uploading the obfuscated ciphertext data of the target file to a first cloud server; wherein the first cloud server stores the obfuscated ciphertext data of the target file and provides feedback on a first target storage address for the obfuscated ciphertext data of the target file; storing the sampled ciphertext data of the target file in a blockchain-based private database; wherein the private database is configured to support access by a first user terminal or a user terminal holding an authentication token; publishing the associated information of the target file on the blockchain; wherein the associated information of the target file includes at least: the target file's identification information, the target header ciphertext, and the first target storage address.

[0235] See Figure 8 As shown, at the software level, this specification also provides a cloud storage data processing device, which may specifically include the following structural modules:

[0236] The encryption module 801 can be used to encrypt the target file according to the preset encryption rules, obtain the ciphertext data of the target file, and generate the relevant target header ciphertext.

[0237] The sampling obfuscation module 802 can be used to process the ciphertext data of the target file according to the preset sampling obfuscation rules, so as to obtain the obfuscated ciphertext data and the sampled ciphertext data of the target file.

[0238] The upload module 803 can be used to upload the obfuscated ciphertext data of the target file to the first cloud server; wherein, the first cloud server stores the obfuscated ciphertext data of the target file and provides feedback on the first target storage address of the obfuscated ciphertext data of the target file.

[0239] The storage module 804 is specifically used to store the sampled ciphertext data of the target file into a blockchain-based private database; wherein, the private database is configured to support access by a first user terminal or a user terminal holding an authentication token;

[0240] The publishing module 805 can be used to publish the association information of the target file on the blockchain; wherein, the association information of the target file includes at least: the identification information of the target file, the target header ciphertext, and the first target storage address.

[0241] In some embodiments, when the encryption module 801 is specifically implemented, it can encrypt the target file according to the preset encryption rules in the following manner to obtain the ciphertext data of the target file and generate the relevant target header ciphertext: perform a hash calculation on the target file to obtain a target hash value; encrypt the target file using the target hash value to obtain the ciphertext data of the target file; sign the target hash value using the first encryption private key to obtain target signature data; and encrypt the target signature data and the target hash value using the first attribute public key to obtain the target header ciphertext.

[0242] In some embodiments, the device may further include an initialization module, which may be used to generate a first attribute public key and a first attribute master private key for a first user according to a preset attribute encryption algorithm and a preset access policy; generate a first encryption private key using the first attribute master private key and the attribute set of the first user; and publish the first attribute public key of the first user on the blockchain.

[0243] In some embodiments, before generating the first attribute public key and the first attribute master private key of the first user according to the preset attribute encryption algorithm and the preset access policy, the device may also be used to send a registration request to the system attribute authorization module; wherein the registration request carries at least the user information of the first user, the system attribute authorization module configures the attribute set of the first user according to the user information of the first user, and generates an authentication code corresponding to the first user; and receives the attribute set and authentication code of the first user fed back by the system attribute authorization module.

[0244] In some embodiments, when the sampling obfuscation module 802 is specifically implemented, it can process the ciphertext data of the target file according to a preset sampling obfuscation rule in the following manner to obtain the obfuscated ciphertext data and sampled ciphertext data of the target file: According to the preset sampling obfuscation rule, the ciphertext data of the target file is divided into multiple ciphertext data groups; the random position of each ciphertext data group in the multiple ciphertext data groups is determined; the random position of each ciphertext data group is recorded to obtain a position tuple; the data value at the random position of each ciphertext data group is extracted to obtain a data tuple; the data value at the random position of each ciphertext data group is replaced with the corresponding random parameter value to obtain multiple processed ciphertext data groups; the multiple processed ciphertext data groups are combined to obtain the obfuscated ciphertext data of the target file; the position tuple and the data tuple are combined to obtain the sampled ciphertext data of the target file.

[0245] In some embodiments, when the sampling obfuscation module 802 is specifically implemented, the random position of the current ciphertext data group among multiple ciphertext data groups can be determined in the following manner: based on the character length of the current ciphertext data group, a random number range for the current ciphertext data group is determined; a random number is generated based on the random number range; and the character position indicated by the random number in the current ciphertext data group is determined as the random position of the current ciphertext data group.

[0246] In some embodiments, when the sampling obfuscation module 802 is specifically implemented, the data value at a random position of the current ciphertext data group can be replaced with the corresponding random parameter value in the following manner: a preset data value is randomly selected from a plurality of preset data values ​​as the random parameter value corresponding to the random position of the current ciphertext data group; and the data value at the random position of the current ciphertext data group is replaced with the random parameter value.

[0247] In some embodiments, after storing the sampled ciphertext data of the target file in a blockchain-based private database, the device can also be used to respond to a triggering operation by a first user to generate a target migration request for the target file; send the target migration request to a smart contract; wherein the target migration request carries the obfuscated ciphertext data of the target file based on a first target storage address of a first cloud server, and the server identifier of a second cloud server to which it is to be migrated; the smart contract responds to the target migration request, and according to preset migration rules, cooperates with the first and second cloud servers to migrate the obfuscated ciphertext data of the target file from the first cloud server to the second cloud server for storage; and receives the second target storage address of the obfuscated ciphertext data of the target file from the second cloud server.

[0248] See Figure 9 As shown, at the software level, this specification also provides another cloud storage data processing device, which may specifically include the following structural modules:

[0249] The query module 901 can be used to query the blockchain and obtain the first target storage address and the target header ciphertext of the target file.

[0250] Download module 902 can be used to download the obfuscated ciphertext data of the target file from the first cloud server according to the first target storage address.

[0251] The sending module 903 can be specifically used to send a target download request for a target file to a smart contract; wherein, when the smart contract determines that the attribute set of the second user matches the preset access policy, it sends an authentication token back to the second user terminal;

[0252] The acquisition module 904 can be used to access a blockchain-based private database using an authentication token in order to obtain sampled ciphertext data of the target file;

[0253] The combination module 905 can be used to combine the obfuscated ciphertext data and sampled ciphertext data of the target file to obtain the ciphertext data of the target file;

[0254] The decryption module 906 is specifically used to decrypt the ciphertext data of the target file to obtain the target file.

[0255] In some embodiments, when the above-described combination module 905 is specifically implemented, it can combine the obfuscated ciphertext data and sampled ciphertext data of the target file in the following manner to obtain the ciphertext data of the target file: obtain a preset sampling obfuscation rule for the target file; and combine the obfuscated ciphertext data and sampled ciphertext data of the target file according to the preset sampling obfuscation rule to obtain the ciphertext data of the target file.

[0256] In some embodiments, when the decryption module 906 is specifically implemented, the ciphertext data of the target file can be decrypted in the following manner to obtain the target file: a second decryption private key is generated according to a preset attribute encryption algorithm and the attribute set of the second user; the target header ciphertext is decrypted using the second decryption private key to obtain the target hash value and the target signature data; the ciphertext data of the target file is decrypted using the target hash value to obtain the target file.

[0257] In some embodiments, after obtaining the target hash value and target signature data, the device can also be used to query the blockchain to obtain the first attribute public key of the first user; and to verify whether the data source of the target file is the first user based on the first attribute public key, the target signature data and the target hash value.

[0258] In some embodiments, after obtaining the target hash value and target signature data, the device can also be used to perform hash calculation on the target file to obtain a verification hash value; and to verify whether the target file is complete based on the verification hash value and the target hash value.

[0259] It should be noted that the units, devices, or modules described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. For ease of description, the above devices are described by dividing them into various modules according to their functions. Of course, in implementing this specification, the functions of each module can be implemented in one or more software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection between the devices or units shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0260] As can be seen from the above, the cloud storage data processing device provided in the embodiments of this specification first samples and obfuscates the ciphertext data of the target file according to a preset sampling and obfuscation rule, obtaining two parts of data: obfuscated ciphertext data and sampled ciphertext data. Then, the obfuscated ciphertext data is uploaded to the first cloud server for cloud storage, and the remaining sampled ciphertext data is stored in a blockchain-based private database that only the first user terminal or a user terminal with authentication credentials has the right to access. This effectively protects the data security of the target file held by the first user, prevents the leakage of the target file held by the first user to the first cloud server or other third parties, and allows the first user to effectively exercise their right to forget the target file. Even if the first cloud server decrypts the obfuscated ciphertext data of the target file it is responsible for storing, it cannot obtain the real target file.

[0261] While this specification provides the steps of operation for the methods described in the embodiments or flowcharts, more or fewer steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or client product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in a process, method, product, or apparatus that includes said elements is not excluded. The terms "first," "second," etc., are used to denote names and do not indicate any particular order.

[0262] Those skilled in the art will also know that, besides implementing the controller using purely computer-readable program code, the same functions can be achieved by logically programming the method steps, making the controller function as logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers (PLCs), and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the devices within it used to implement various functions can also be considered structures within that hardware component. Alternatively, the devices used to implement various functions can be considered as both software modules implementing the method and structures within a hardware component.

[0263] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, classes, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0264] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this specification can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions of this specification can essentially be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, mobile terminal, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments of this specification.

[0265] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. This specification can be used in numerous general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices, etc.

[0266] Although this specification has been described by way of examples, those skilled in the art will recognize that many variations and modifications are possible without departing from the spirit of this specification, and it is intended that the appended claims cover such variations and modifications without departing from the spirit of this specification.

Claims

1. A method for processing cloud storage data, characterized in that, Applied to the first user terminal, including: The target file is encrypted according to the preset encryption rules to obtain the ciphertext data of the target file, and the relevant target header ciphertext is generated. The process involves processing the ciphertext data of a target file according to a preset sampling obfuscation rule to obtain obfuscated ciphertext data and sampled ciphertext data. This includes: dividing the ciphertext data of the target file into multiple ciphertext data groups according to the preset sampling obfuscation rule; determining the random positions of each ciphertext data group within the multiple ciphertext data groups; recording the random positions of each ciphertext data group to obtain position tuples; extracting the data values ​​at the random positions of each ciphertext data group to obtain data tuples; replacing the data values ​​at the random positions of each ciphertext data group with corresponding random parameter values ​​to obtain multiple processed ciphertext data groups; combining the multiple processed ciphertext data groups to obtain the obfuscated ciphertext data of the target file; and combining the position tuples and data tuples to obtain the sampled ciphertext data of the target file. The obfuscated ciphertext data of the target file is uploaded to the first cloud server; the first cloud server stores the obfuscated ciphertext data of the target file and provides feedback on the first target storage address of the obfuscated ciphertext data of the target file. The sampled encrypted data of the target file is stored in a blockchain-based private database; wherein, the private database is configured to support access by a first user terminal or a user terminal holding an authentication token; The association information of the target file is published on the blockchain; wherein the association information of the target file includes at least: the identification information of the target file, the target header ciphertext, and the first target storage address.

2. The method according to claim 1, characterized in that, The target file is encrypted according to a preset encryption rule to obtain the ciphertext data of the target file, and a related target header ciphertext is generated, including: Perform a hash calculation on the target file to obtain a target hash value; then use the target hash value to encrypt the target file to obtain the ciphertext data of the target file; The target hash value is signed using the first encryption private key to obtain the target signature data; and the target signature data and the target hash value are encrypted using the first attribute public key to obtain the target header ciphertext.

3. The method according to claim 2, characterized in that, The method further includes: Based on the preset attribute encryption algorithm and preset access policy, generate the first user's first attribute public key and first attribute master private key; Generate a first encrypted private key using the first attribute master private key and the attribute set of the first user; The first user's first attribute public key is published on the blockchain.

4. The method according to claim 3, characterized in that, Before generating the first user's first attribute public key and first attribute master private key according to the preset attribute encryption algorithm and preset access policy, the method further includes: A registration request is sent to the system attribute authorization module; wherein the registration request carries at least the user information of the first user, and the system attribute authorization module configures the attribute set of the first user according to the user information of the first user and generates an authentication code corresponding to the first user; Receive the attribute set and authentication code of the first user from the system attribute authorization module.

5. The method according to claim 1, characterized in that, Determine the random location for each ciphertext data block within a plurality of ciphertext data blocks, including: The random position of the current ciphertext data block among multiple ciphertext data blocks is determined in the following way: Determine the range of random numbers for the current ciphertext data group based on the character length of the current ciphertext data group; A random number is generated based on the range of random numbers; and the character position indicated by the random number in the current ciphertext data group is determined as the random position of the current ciphertext data group.

6. The method according to claim 1, characterized in that, Replace the data values ​​at random positions in each ciphertext data group with the corresponding random parameter values, including: Replace the data value at a random position in the current ciphertext data block with the corresponding random parameter value in the following manner: A preset data value is randomly selected from multiple preset data values ​​and used as a random parameter value corresponding to a random position in the current ciphertext data group; the data value at the random position in the current ciphertext data group is then replaced with this random parameter value.

7. The method according to claim 1, characterized in that, After storing the sampled ciphertext data of the target file in a blockchain-based private database, the method further includes: In response to the first user's trigger action, generate a target migration request for the target file; The target migration request is sent to the smart contract; wherein the target migration request carries obfuscated ciphertext data of the target file based on the first target storage address of the first cloud server and the server identifier of the second cloud server to which it is to be migrated; the smart contract responds to the target migration request and, according to preset migration rules, cooperates with the first cloud server and the second cloud server to migrate the obfuscated ciphertext data of the target file from the first cloud server to the second cloud server for storage. The second target storage address is received from the second cloud server as feedback regarding the obfuscated ciphertext data of the target file.

8. A method for processing cloud storage data, characterized in that, Applied to second user terminals, including: Query the blockchain to obtain the first target storage address and the target header ciphertext of the target file; Based on the first target storage address, the obfuscated ciphertext data of the target file is downloaded from the first cloud server; Send a target download request for the target file to the smart contract; wherein, if the smart contract determines that the attribute set of the second user matches the preset access policy, it sends an authentication token back to the second user terminal; Use authentication tokens to access a blockchain-based private database to obtain sampled ciphertext data of the target file; The obfuscated ciphertext data of the target file and the sampled ciphertext data are combined to obtain the ciphertext data of the target file; The encrypted data of the target file is decrypted to obtain the target file; The obfuscated ciphertext data and sampled ciphertext data of the target file are obtained as follows: According to a preset sampling obfuscation rule, the ciphertext data of the target file is divided into multiple ciphertext data groups; the random positions of each ciphertext data group are determined; the random positions of each ciphertext data group are recorded to obtain position tuples; the data values ​​at the random positions of each ciphertext data group are extracted to obtain data tuples; the data values ​​at the random positions of each ciphertext data group are replaced with corresponding random parameter values ​​to obtain multiple processed ciphertext data groups; the multiple processed ciphertext data groups are combined to obtain the obfuscated ciphertext data of the target file; the position tuples and data tuples are combined to obtain the sampled ciphertext data of the target file.

9. The method according to claim 8, characterized in that, The obfuscated ciphertext data and the sampled ciphertext data of the target file are combined to obtain the ciphertext data of the target file, including: Obtain the preset sampling and obfuscation rules for the target file; According to the preset sampling and obfuscation rules, the obfuscated ciphertext data of the target file and the sampled ciphertext data are combined to obtain the ciphertext data of the target file.

10. The method according to claim 8, characterized in that, The encrypted data of the target file is decrypted to obtain the target file, which includes: A second decryption private key is generated based on a preset attribute encryption algorithm and the attribute set of the second user. The target header ciphertext is decrypted using the second decryption private key to obtain the target hash value and the target signature data; The target file is obtained by decrypting its ciphertext data using the target hash value.

11. The method according to claim 10, characterized in that, After obtaining the target hash value and target signature data, the method further includes: Query the blockchain to obtain the first user's first attribute public key; Based on the first attribute public key, the target signature data, and the target hash value, verify whether the data source of the target file belongs to the first user.

12. The method according to claim 10, characterized in that, After obtaining the target file, the method further includes: Perform a hash calculation on the target file to obtain the verification hash value; The integrity of the target file is verified based on the verification hash value and the target hash value.

13. A cloud storage data processing device, characterized in that, Applied to the first user terminal, including: The encryption module is used to encrypt the target file according to the preset encryption rules, obtain the ciphertext data of the target file, and generate the relevant target header ciphertext. The sampling and obfuscation module is used to process the ciphertext data of the target file according to the preset sampling and obfuscation rules, and obtain the obfuscated ciphertext data and sampled ciphertext data of the target file. The upload module is used to upload the obfuscated ciphertext data of the target file to the first cloud server; wherein, the first cloud server stores the obfuscated ciphertext data of the target file and provides feedback on the first target storage address of the obfuscated ciphertext data of the target file. A storage module is used to store the sampled encrypted data of the target file into a blockchain-based private database; wherein, the private database is configured to support access by a first user terminal or a user terminal holding an authentication token; The publishing module is used to publish the association information of the target file on the blockchain; wherein, the association information of the target file includes at least: the identification information of the target file, the target header ciphertext, and the first target storage address; Specifically, the sampling obfuscation module is used to: divide the ciphertext data of the target file into multiple ciphertext data groups according to preset sampling obfuscation rules; determine the random position of each ciphertext data group in the multiple ciphertext data groups; record the random position of each ciphertext data group to obtain a position tuple; extract the data value at the random position of each ciphertext data group to obtain a data tuple; replace the data value at the random position of each ciphertext data group with the corresponding random parameter value to obtain multiple processed ciphertext data groups; combine the multiple processed ciphertext data groups to obtain the obfuscated ciphertext data of the target file; and combine the position tuple and the data tuple to obtain the sampled ciphertext data of the target file.

14. A cloud storage data processing device, characterized in that, Applied to second user terminals, including: The query module is used to query the blockchain to obtain the first target storage address and the target header ciphertext of the target file; The download module is used to download the obfuscated ciphertext data of the target file from the first cloud server according to the first target storage address; The sending module is used to send a target download request for a target file to the smart contract; wherein, the smart contract, upon determining that the attribute set of the second user matches the preset access policy, sends an authentication token back to the second user terminal; The acquisition module is used to access a blockchain-based private database using an authentication token to obtain sampled ciphertext data of the target file; The combination module is used to combine the obfuscated ciphertext data and sampled ciphertext data of the target file to obtain the ciphertext data of the target file; The decryption module is used to decrypt the ciphertext data of the target file to obtain the target file; The obfuscated ciphertext data and sampled ciphertext data of the target file are obtained as follows: According to a preset sampling obfuscation rule, the ciphertext data of the target file is divided into multiple ciphertext data groups; the random positions of each ciphertext data group are determined; the random positions of each ciphertext data group are recorded to obtain position tuples; the data values ​​at the random positions of each ciphertext data group are extracted to obtain data tuples; the data values ​​at the random positions of each ciphertext data group are replaced with corresponding random parameter values ​​to obtain multiple processed ciphertext data groups; the multiple processed ciphertext data groups are combined to obtain the obfuscated ciphertext data of the target file; the position tuples and data tuples are combined to obtain the sampled ciphertext data of the target file.

15. A server, characterized in that, It includes a processor and a memory for storing processor-executable instructions, wherein the processor, when executing the instructions, implements the steps of the method according to any one of claims 1 to 7, or 8 to 12.

16. A computer storage medium, characterized in that, It stores computer instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1 to 7, or 8 to 12.

17. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1 to 7, or 8 to 12.

Images