Multi-level ciphertext storage system for cloud-edge collaboration

Abstract

The application discloses a kind of multi-level ciphertext storage systems for cloud edge cooperation, including client, secret data search service subsystem, key management subsystem, edge storage subsystem and cloud storage subsystem, wherein secret data search service subsystem is used to maintain ciphertext index and provide retrieval service;Client integrates secret search, file encryption module, and directly uploads, downloads ciphertext data to edge storage subsystem;Key management subsystem is used to manage search key, file encryption key and the like of secret data search service subsystem and client;Edge storage subsystem and cloud storage subsystem perform deletion operation on repeated ciphertext data according to pre-set encryption strategy, to realize the optimization of storage resources.The application can reduce storage delay, improve throughput, improve the efficiency of edge storage service while improving data storage security.

Description

Technical Field

[0001] The present invention relates to the field of data storage technology, and in particular to a multi-level ciphertext storage system for cloud-edge collaboration. Background Art

[0002] Edge storage distributes data across nearby edge storage devices or data centers, significantly shortening the physical distance between data generation, computing, and storage. This provides high-speed, low-latency data access for edge computing, meeting key industry digital needs for agile connectivity, real-time services, data optimization, and application intelligence. However, the rapid growth of edge data poses severe challenges to the capacity, performance, and power consumption of edge storage systems, and the disordered flow of data exacerbates the risk of data leakage.

[0003] Unlike centralized cloud storage services, edge storage migrates data storage from distant cloud servers to edge storage devices or edge data centers closer to the data. This reduces network communication overhead, interaction latency, and bandwidth costs, and provides greater adaptability and scalability. Compared to cloud storage, edge storage has the following characteristics:

[0004] 1) Edge storage devices are geographically distributed

[0005] Edge storage devices and edge data centers are geographically distributed. Using wireless access technologies such as Wi-Fi, Bluetooth, and Zigbee, a large number of geographically dispersed edge storage devices can form a distributed storage network with adjacent storage devices or edge data centers. This geographically distributed structure enables timely data storage close to the data center, ensuring real-time data storage and access for critical edge computing tasks. Cloud data centers, on the other hand, are geographically centralized. Long-distance transmission latency hinders timely processing of data and processing needs of numerous edge devices. Congested networks and high latency services can lead to a sharp decline in quality of service (QoS).

[0006] 2) Edge storage media and systems are heterogeneous

[0007] Edge storage features heterogeneous storage, primarily manifested in horizontal edge heterogeneity and vertical multi-level heterogeneity. Horizontal edge heterogeneity refers to the fact that different types of edge terminal devices typically use different storage media, or employ different storage system software for data storage based on the same storage media. This feature enables edge storage to leverage a large number of heterogeneous storage media and storage systems to quickly and locally store various types of edge data. Vertical multi-level heterogeneity refers to the division of edge storage into three tiers based on proximity to large centralized cloud data centers: edge devices, edge data centers, and distributed data centers, with different storage systems corresponding to each tier. This feature enables storage systems at different tiers to collaborate, optimizing edge data storage and access through multi-tiered, multi-level data caching and prefetching strategies.

[0008] 3) Edge storage architecture has features that support on-premises deployment

[0009] Edge storage architecture supports the deployment of storage systems within edge devices, isolating them from external networks. Storing data independently in an internally deployed edge storage system offers the following advantages: It provides high-speed access to local data resources for edge computing tasks, meeting the real-time demands of edge applications; it allows for maximum local control over access to internal storage devices, monitoring and controlling data storage locations, and adjusting redundancy policies for confidential data in real time; and it can encrypt or otherwise preprocess data at the source to enhance data security.

[0010] 4) Edge storage data has location-aware characteristics

[0011] Edge storage stores data locally, and data distribution is closely tied to geographic location, demonstrating strong location-awareness. This allows edge computing tasks to process data without having to query the entire storage network for location data, significantly reducing backbone network traffic load. Furthermore, edge computing tasks can be geographically closely associated with the required data, reducing network transmission latency, accelerating data processing, and providing better underlying support for big data analytics platforms. Furthermore, by analyzing the geographic distribution of edge storage data, application service providers can connect mobile users with businesses and events of interest, improving user service quality.

[0012] Overall, edge computing storage nodes have the characteristics of wide distribution, large number, complex environment, and heterogeneous storage media, which will bring security, privacy and efficiency issues to stored data in actual environments. Summary of the Invention

[0013] To solve the above problems, the application provides a multi-level ciphertext storage system for cloud edge collaboration, which is aimed at the security, privacy, efficient query and storage efficiency requirements of edge storage data. In terms of distributed storage organization, based on the multi-level collaborative storage model of edge storage and cloud storage, an efficient data distribution management method is designed to make data close to the "edge" location of data source or user and optimize data redundancy, thereby improving the performance and reliability of storage services. In terms of storage security, a distributed secure storage model is constructed with homomorphic computation as the core to provide support mechanisms for homomorphic search and homomorphic deduplication of sensitive data in a distributed environment, which can reduce storage delay, improve throughput and space utilization.

[0014] The technical solutions adopted by the application are as follows:

[0015] A multi-level ciphertext storage system for cloud edge collaboration includes a client, a homomorphic data search service subsystem, a key management subsystem, an edge storage subsystem and a cloud storage subsystem, wherein:

[0016] The client is configured to encrypt target file keywords to build a ciphertext index and encrypt target file content to generate an encrypted file including ciphertext data when a user uploads or downloads a file to the edge storage subsystem, and upload the encrypted file to the edge storage subsystem while establishing a homomorphic keyword index list for searching the encrypted file in the homomorphic data search service subsystem.

[0017] The homomorphic data search service subsystem is configured to obtain a search key from the key management subsystem, establish a homomorphic keyword index list for a user of the client when the client initiates upload, download and sharing operations, and provide storage, update and query of the homomorphic keyword index list.

[0018] The key management subsystem is configured to provide a file encryption key when the client performs upload and download operations, provide a file encryption key for a client of a shared user when the client performs a sharing operation, and provide a search key for the client and the homomorphic data search service subsystem.

[0019] The edge storage subsystem is configured to receive the encrypted file uploaded by the client, detect and delete duplicates of the encrypted file, and then perform corresponding processing and block storage; in response to a download request of the client, transmit the encrypted file to the client, and statistically analyze the download request frequency and related ciphertext metadata of the client; upload the encrypted data block meeting the predetermined strategy to the cloud storage subsystem, and delete the encrypted data block locally.

[0020] The cloud storage subsystem is configured to receive encrypted data blocks uploaded by each edge storage subsystem, detect and delete duplicates of the encrypted data blocks, and then write the encrypted data blocks into the storage space; respond to file download requests from each edge storage subsystem, transmit the corresponding encrypted data blocks, and manage the ciphertext metadata of each encrypted data block.

[0021] Furthermore, when the client initiates a sharing operation, it distributes the file key to the client of the shared user through the key management subsystem and notifies the client of the shared user. After the client of the shared user receives the sharing, it updates the shared user's confidential keyword index list to the confidential data search service subsystem to complete the sharing.

[0022] Furthermore, the client uses a stub-based encryption technology for encryption. During the key update process, only the stub is re-encrypted without the need to re-encrypt all files, which supports both confidential data update and deduplication optimization.

[0023] Furthermore, the method for encrypting the target file by the client includes the following steps:

[0024] S101. The client splits the plaintext file into data blocks of variable sizes, generates and requests corresponding encryption keys based on different data blocks;

[0025] S102. The client generates a hash value based on the data block and sends it to the key management subsystem. The key management subsystem generates and issues a data block key based on the hash value.

[0026] S103. Encrypt each data block using the corresponding data block key to generate several encrypted packages, the number of which is the same as the number of data blocks split by the client; split a stub at the end of each encrypted package, and the rest is a pruned package. The stubs of all encrypted packages are collected in a stub file and encrypted using the user root key; when the key needs to be updated, only the stub file is updated; at the same time, the client generates metadata information for the target file to complete the encryption processing of the target file.

[0027] Furthermore, in step S103, the metadata information includes the file name, path hash value, file size, number of file blocks, user ID and key status.

[0028] Furthermore, the block storage of the edge storage subsystem includes file-level ciphertext storage and optimization, and the file-level ciphertext storage and optimization includes the following steps:

[0029] S201. After the client completes encryption of the target file, it establishes a connection with the edge storage subsystem and uploads the encrypted data blocks and metadata information in sequence;

[0030] S202. The edge storage subsystem continuously stores the encrypted data blocks of the same target file. For several encrypted packages uploaded to the edge storage buffer, the hash fingerprint of each encrypted package corresponding to the pruned package is first calculated and stored in the metadata information file; the hash fingerprints of all encrypted data blocks belonging to the same file are XOR-added to obtain a hash fingerprint file for file-level deduplication verification;

[0031] S203. The edge storage subsystem establishes a deduplication index file for the encrypted file, and the deduplication index file includes a mapping of the hash fingerprint file and the metadata information storage location; after each upload of the target file, the hash fingerprint file is calculated and it is determined whether the hash fingerprint file is in the deduplication index file; if it does not exist, the hash fingerprint file is stored in the deduplication index file, and all the pruned packages under the target file are stored; if it already exists, only the metadata information of the target file is stored, and there is no need to store the encrypted data block.

[0032] Furthermore, when the edge storage subsystem and the cloud storage subsystem collaboratively optimize the ciphertext, the edge storage subsystem stores the encrypted data blocks into the cloud storage subsystem on demand according to relevant factors, and deletes the corresponding encrypted files based on the least recently used principle. The relevant factors include its own storage space threshold and access frequency; the cloud storage subsystem deletes duplicate encrypted data blocks based on the hash value.

[0033] Furthermore, the collaborative optimization of ciphertext includes the following steps:

[0034] S301. The edge storage subsystem initiates an upload request, puts all trimmed packets into a buffer queue, and uploads them sequentially;

[0035] S302. The cloud storage subsystem receives the pruned data block uploaded by the edge storage subsystem and places it in the deduplication buffer queue. It calculates the hash fingerprint of each encrypted data block and compares it with the cloud data block index. If the hash fingerprint already exists, the encrypted data block is deleted. If not, the hash fingerprint is first stored in the cloud data block index, and then the corresponding encrypted data block is placed in the storage buffer for storage.

[0036] S303. The cloud storage subsystem stores the deduplicated encrypted data blocks one by one, and interrupts the link after receiving the end flag sent by the edge storage subsystem, completing this ciphertext storage optimization and releasing all buffers;

[0037] S304. After the edge storage subsystem completes the transmission, it deletes the encrypted data blocks that have been backed up locally in the cloud.

[0038] Furthermore, the method for the client to download the encrypted file includes the following steps:

[0039] S401. The client locates the encrypted file location based on a searchable encryption algorithm and initiates a download request for the located encrypted file;

[0040] S402. The edge storage subsystem receives the download request and searches the deduplication index file to determine whether metadata information exists. If so, it updates the metadata information timestamp and obtains the encrypted data block information contained in the file.

[0041] S403. Further determine whether the encrypted data block exists in the edge storage subsystem or the cloud storage subsystem. If it exists in the edge storage subsystem, directly return relevant information to the client, and the relevant information includes the encrypted data block, stub file and key status; if it exists in the cloud storage subsystem, initiate a request to the cloud storage subsystem, update the metadata information of the cloud storage subsystem, and return relevant information to the client.

[0042] Furthermore, the method for the client to decrypt the encrypted file includes the following steps:

[0043] S501. According to the downloaded encrypted data block and related information, extract the key file based on the key status and decrypt the stub file;

[0044] S502. All the pruned packets and stubs are combined and decrypted to obtain a combination of plaintext data blocks, which are then spliced ​​into the original file and presented on the client.

[0045] The beneficial effects of the present invention are:

[0046] (1) In terms of distributed storage organization, the present invention designs an efficient data distribution management method based on a multi-level collaborative storage model of edge storage and cloud storage, so that data is stored at the "edge" location close to the data source or user, and data redundancy is optimized, thereby improving the performance and reliability of the storage service.

[0047] (2) In terms of storage security, the present invention constructs a distributed secure storage model with secret computing as the core, providing a support mechanism for secret search and secret deduplication of sensitive data in a distributed environment. While improving data storage security, it reduces storage latency, increases throughput, and improves the efficiency of edge storage services.

[0048] (3) In terms of ciphertext storage and use, the present invention proposes a stub-based efficient key update technology, which can improve the security of stored ciphertext and support two-level repeated encryption data optimization, so that both edge and cloud ciphertext storage can improve storage space utilization and significantly reduce storage costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 Schematic diagram of a multi-level ciphertext storage system for cloud-edge collaboration according to the present invention.

[0050] Figure 2 An architecture diagram of a multi-level encrypted storage system for cloud-edge collaboration according to the present invention.

[0051] Figure 3 Flowchart of a method for encrypting a target file by a client in an embodiment of the present invention.

[0052] Figure 4 Flowchart of file-level ciphertext storage and optimization in an embodiment of the present invention.

[0053] Figure 5 Flowchart of the collaborative optimization ciphertext of the edge storage subsystem in an embodiment of the present invention.

[0054] Figure 6 Flowchart of collaborative optimization ciphertext of cloud storage subsystem in an embodiment of the present invention.

[0055] Figure 7 Flowchart of a method for a client to download an encrypted file in an embodiment of the present invention.

[0056] Figure 8 Flowchart of a method for a client to decrypt an encrypted file in an embodiment of the present invention. DETAILED DESCRIPTION

[0057] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, the specific embodiments of the present invention are now described. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention. That is, the embodiments described are only part of the embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0058] like Figure 1 As shown, this embodiment provides a multi-level ciphertext storage system for cloud-edge collaboration, and builds a ciphertext search service subsystem on a separate trusted server to maintain ciphertext indexes and provide retrieval services to help clients locate ciphertext data blocks. The client integrates ciphertext search and file encryption modules, and the client is connected to the distributed storage system network to directly upload and download ciphertext data to the edge storage subsystem. A key management subsystem is deployed on a separate trusted server to manage the search keys, file encryption keys, etc. of the ciphertext search service subsystem and the client. The edge storage subsystem performs deletion operations on duplicate ciphertext data according to the pre-set encryption policy to optimize storage resources. Since the multi-level storage model includes multiple edge storage subsystems and a cloud storage subsystem, and different edge storage subsystems manage different user groups, the ciphertext search service subsystem and the key management subsystem in the actual environment can be composed of multiple service nodes.

[0059] Since edge storage, like traditional cloud center storage, may analyze the data stored by users in the cloud, edge storage is assumed to be "honest and curious". Users only store ciphertext data in edge storage nodes, and the storage end cannot see any plaintext data with semantics. At the same time, a key management subsystem is built to implement user management, and keys are transmitted between entities based on a "secure channel". All plaintext data with semantics only appears on the user client and does not leave the client. The multi-level ciphertext storage system of this embodiment automatically deletes duplicate ciphertext data of storage nodes based on an encrypted deduplication mechanism, and provides search and positioning services based on searchable encryption technology. Each edge storage subsystem is linked to the client data encryption mechanism and search requests.

[0060] like Figure 2 As shown, a multi-level ciphertext storage system for cloud-edge collaboration in this embodiment includes a client, a ciphertext data search service subsystem, a key management subsystem, an edge storage subsystem, and a cloud storage subsystem, wherein:

[0061] The client is configured to encrypt the target file keywords to build a ciphertext index when the user uploads or downloads files to the edge storage subsystem, encrypt the target file content to generate an encrypted file including ciphertext data (supports ciphertext deduplication), and upload the encrypted file to the edge storage subsystem. At the same time, a ciphertext keyword index list for searching encrypted files is established in the ciphertext data search service subsystem.

[0062] The confidential data search service subsystem is configured to obtain the search key from the key management subsystem (supporting confidential deduplication). When the client initiates upload, download and sharing operations, it creates a confidential keyword index list for the client user and provides storage, update and query of the confidential keyword index list.

[0063] The key management subsystem is configured to provide file encryption keys when the client performs upload and download operations, provide file encryption keys to the client of the shared user when the client performs sharing operations, and provide search keys to the client and the confidential data search service subsystem.

[0064] Preferably, when the client initiates a sharing operation, it distributes the file key to the client of the shared user through the key management subsystem and notifies the client of the shared user. After the client of the shared user receives the sharing, it updates the shared user's confidential keyword index list to the confidential data search service subsystem to complete the sharing.

[0065] The edge storage subsystem is configured to receive encrypted files uploaded by the client, first detect and delete duplicates of the encrypted files, and then perform corresponding processing and block storage; respond to the client's download request, transmit the encrypted file to the client, and count the client's download request frequency and related ciphertext metadata; upload the encrypted data blocks that meet the predetermined policy to the cloud storage subsystem, and delete the encrypted data blocks locally.

[0066] The cloud storage subsystem is configured to receive encrypted data blocks uploaded by each edge storage subsystem, detect and delete duplicates of the encrypted data blocks, and then write the encrypted data blocks into the storage space; respond to file download requests from each edge storage subsystem, transmit the corresponding encrypted data blocks, and manage the ciphertext metadata of each encrypted data block.

[0067] Preferably, in terms of secret search technology, this embodiment supports users in building file indexes on the client side based on a searchable encryption algorithm. Regarding the collaborative cloud-edge storage of secret files on the server side, the edge storage subsystem provides users with a storage access interface. The edge storage subsystem integrates a corresponding secret search module to achieve search and location of secret files. The secret search technology uses the key management subsystem as a trusted center, providing derivation and management of keys such as client keyword encryption and content encryption, as well as derivation and management of server-side search keys.

[0068] The client preferably uses stub-based encryption technology for encryption, which supports efficient key updates. During the key update process, only the stub is re-encrypted without re-encrypting the entire file. This supports both confidential data updates and deduplication optimization. The core concept of client-side encryption is to replace traditional random key-based encryption with content-based encryption, which means that the same data block has the same encryption key, thus providing support for deduplication of ciphertext.

[0069] like Figure 3 As shown, the method for encrypting the target file by the client includes the following steps:

[0070] S101. The client splits the plaintext file into data chunks of variable size, generates and requests corresponding encryption keys based on different data chunks;

[0071] S102. The client generates a hash value based on the data block and sends it to the key management subsystem. The key management subsystem generates and issues a data block key (CK) based on the hash value.

[0072] S103. Each data block is encrypted using the corresponding data block key to generate several encrypted packages. The number of encrypted packages is the same as the number of data blocks split by the client. A stub (e.g., 32 or 64 bytes) is split out at the end of each encrypted package, and the rest is a trimmed package. The stubs of all encrypted packages are collected in a stub file and encrypted with the user root key (RK) to achieve control over the ciphertext. When the key needs to be updated, only the encrypted stub file needs to be updated. In the absence of the user root key, even if an attacker guesses the data block key, he still cannot decrypt the stub file, which is equivalent to having double insurance.

[0073] At the same time, the client generates metadata information (metafile) of the target file to complete the encryption process of the target file. Preferably, the metadata information includes the file name, path hash value, file size, number of file blocks, user ID and key status.

[0074] Preferably, the block storage of the edge storage subsystem includes file-level ciphertext storage and optimization, such as Figure 4 As shown in the figure, file-level ciphertext storage and optimization includes the following steps:

[0075] S201. After the client completes encryption of the target file, it establishes a connection with the edge storage subsystem and uploads the encrypted data blocks and metadata information in sequence;

[0076] S202. The edge storage subsystem continuously stores the encrypted data blocks of the same target file, and first calculates the hash fingerprint of each encrypted package corresponding to the pruned package for several encrypted packages uploaded to the edge storage buffer. pac ), and store the hash fingerprint in the metadata information file; perform XOR addition on the hash fingerprints of all encrypted data blocks belonging to the same file to obtain a hash fingerprint file (fingerprint file ), used for file-level deduplication verification;

[0077] S203. The edge storage subsystem establishes a deduplication index file (Indexfile) for the encrypted file. The deduplication index file includes a mapping of the hash fingerprint file and the metadata information storage location. After each upload of the target file, the hash fingerprint file is calculated and it is determined whether the hash fingerprint file is in the deduplication index file. If it does not exist, the hash fingerprint file is stored in the deduplication index file, and all the pruned packages under the target file are stored. If it already exists, only the metadata information of the target file is stored, and there is no need to store the encrypted data block.

[0078] Preferably, when the edge storage subsystem and the cloud storage subsystem collaboratively optimize the ciphertext, the edge storage subsystem stores the encrypted data blocks into the cloud storage subsystem on demand according to relevant factors, and deletes the corresponding encrypted files based on the least recently used principle. The relevant factors include its own storage space threshold and access frequency; the cloud storage subsystem deletes duplicate encrypted data blocks based on the hash value to further save data storage space.

[0079] Preferably, if Figure 5 and Figure 6 As shown in Figure 2, collaborative optimization of ciphertext includes the following steps:

[0080] S301. The edge storage subsystem initiates an upload request, puts all trimmed packets into a buffer queue, and uploads them sequentially;

[0081] S302. The cloud storage subsystem receives the pruned data block uploaded by the edge storage subsystem and places it into the deduplication buffer queue. It then calculates the hash fingerprint of each encrypted data block and compares it with the cloud data block index. If the hash fingerprint already exists, the encrypted data block is deleted. If not, the hash fingerprint is first stored in the cloud data block index, and then the corresponding encrypted data block is placed into the storage buffer for storage.

[0082] S303. The cloud storage subsystem stores the deduplicated encrypted data blocks one by one, and interrupts the link after receiving the end flag sent by the edge storage subsystem, completing this ciphertext storage optimization and releasing all buffers;

[0083] S304. After the edge storage subsystem completes the transmission, it deletes the encrypted data blocks that have been backed up locally in the cloud.

[0084] Preferably, if Figure 7 As shown, the method for the client to download the encrypted file includes the following steps:

[0085] S401. The client locates the encrypted file location based on a searchable encryption algorithm and initiates a download request for the located encrypted file (the request content includes the file name and file path);

[0086] S402. The edge storage subsystem receives the download request and searches the deduplication index file to determine whether metadata information exists. If so, it updates the metadata information timestamp and obtains the encrypted data block information contained in the file.

[0087] S403. Further determine whether the encrypted data block exists in the edge storage subsystem or the cloud storage subsystem. If it exists in the edge storage subsystem, directly return relevant information to the client, including the encrypted data block, stub file, and key status; if it exists in the cloud storage subsystem, initiate a request to the cloud storage subsystem, update the metadata information of the cloud storage subsystem, and return relevant information to the client.

[0088] Preferably, if Figure 8 As shown, the method for the client to decrypt the encrypted file includes: extracting the key file based on the key state according to the downloaded encrypted data block and related information, and decrypting the stub file; combining all the pruned packages and stubs and decrypting them to obtain a plaintext data block combination, and then splicing them into the original file and presenting it on the client.

[0089] The foregoing description is merely a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein and should not be construed as excluding other embodiments. Rather, the present invention can be used in various other combinations, modifications, and environments and can be modified within the scope of the concept described herein through the above teachings or techniques or knowledge in the relevant field. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention are intended to be protected by the appended claims.

Claims

1. A multi-level ciphertext storage system for cloud-edge collaboration, characterized by: It includes client, secret data search service subsystem, key management subsystem, edge storage subsystem and cloud storage subsystem, among which: The client is configured to, when a user uploads or downloads a file to the edge storage subsystem, encrypt the target file keyword to build a ciphertext index, encrypt the target file content to generate an encrypted file including ciphertext data, and upload the encrypted file to the edge storage subsystem, while simultaneously establishing a ciphertext keyword index list for searching the encrypted file in the ciphertext data search service subsystem; The secret data search service subsystem is configured to obtain the search key from the key management subsystem, establish a secret keyword index list for the client user when the client initiates upload, download and sharing operations, and provide storage, update and query of the secret keyword index list; The key management subsystem is configured to provide file encryption keys when the client performs upload and download operations, provide file encryption keys to the client of the shared user when the client performs sharing operations, and provide search keys to the client and the secret data search service subsystem; The edge storage subsystem is configured to receive encrypted files uploaded by clients, perform detection and deduplication on the encrypted files, and then process and store them in blocks. It responds to download requests from clients, transmits encrypted files to clients, and collects statistics on the frequency of client download requests and related ciphertext metadata. It uploads encrypted data blocks that meet predetermined policies to the cloud storage subsystem and deletes the encrypted data blocks locally. The cloud storage subsystem is configured to receive encrypted data blocks uploaded by each edge storage subsystem, detect and deduplicate the encrypted data blocks, and then write the encrypted data blocks into the storage space; respond to file download requests from each edge storage subsystem, transmit the corresponding encrypted data blocks, and manage the ciphertext metadata of each encrypted data block; The client uses stub-based encryption technology for encryption. During the key update process, only the stub is re-encrypted without re-encrypting all files. It supports both confidential data update and deduplication optimization, including the following steps: S101. The client splits the plaintext file into data blocks of variable sizes, generates and requests corresponding encryption keys based on different data blocks; S102 client generates a hash value based on the data block and sends it to the key management subsystem, the key management subsystem generates and issues a data block key based on the hash value; S103. Each data block is encrypted using the corresponding data block key to generate several encrypted packages, the number of which is equal to the number of data blocks split by the client. A stub is split at the end of each encrypted package, and the rest is a pruned package. The stubs of all encrypted packages are collected in a stub file and encrypted using the user's root key. When the key needs to be updated, only the stub file is updated. Simultaneously, the client generates metadata information for the target file, completing the encryption process for the target file.

2. The multi-level encrypted storage system for cloud-edge collaboration according to claim 1 is characterized in that: When the client initiates a sharing operation, it distributes the file key to the client of the shared user through the key management subsystem and notifies the client of the shared user. After the client of the shared user receives the sharing, it updates the shared user's confidential keyword index list to the confidential data search service subsystem to complete the sharing.

3. The multi-level encrypted storage system for cloud-edge collaboration according to claim 1 is characterized in that: In step S103, the metadata information includes the file name, path hash value, file size, number of file blocks, user ID and key status.

4. The multi-level encrypted storage system for cloud-edge collaboration according to claim 1 is characterized in that: The block storage of the edge storage subsystem includes file-level ciphertext storage and optimization, and the file-level ciphertext storage and optimization includes the following steps: S201. After the client completes encryption of the target file, it establishes a connection with the edge storage subsystem and sequentially uploads encrypted data blocks and metadata information; S202. The edge storage subsystem continuously stores encrypted data blocks of the same target file. For several encrypted packages uploaded to the edge storage buffer, the hash fingerprint of each encrypted package corresponding to the pruned package is calculated and stored in the metadata information file. The hash fingerprint of all encrypted data blocks belonging to the same file is XOR-added to obtain a hash fingerprint file for file-level deduplication verification. S203. The edge storage subsystem establishes a deduplication index file for the encrypted file, which includes a mapping between the hash fingerprint file and the metadata information storage location. After each upload of the target file, the edge storage subsystem calculates the hash fingerprint file and determines whether the hash fingerprint file exists in the deduplication index file. If not, the hash fingerprint file is stored in the deduplication index file and all pruned packages under the target file are stored. If it exists, only the metadata information of the target file is stored, without storing the encrypted data block.

5. The multi-level encrypted storage system for cloud-edge collaboration according to claim 1 is characterized in that: When the edge storage subsystem and the cloud storage subsystem collaboratively optimize ciphertext, the edge storage subsystem stores encrypted data blocks into the cloud storage subsystem on demand based on relevant factors, and deletes corresponding encrypted files based on the least recently used principle. The relevant factors include its own storage space threshold and access frequency; the cloud storage subsystem deletes duplicate encrypted data blocks based on hash values.

6. The multi-level encrypted data storage system for cloud-edge collaboration according to claim 5 is characterized in that: The collaborative optimization of ciphertext includes the following steps: S301 edge storage subsystem initiates an upload request, all trimmed packets into the buffer queue, uploaded in order; S302. The cloud storage subsystem receives the pruned packet uploaded by the edge storage subsystem and places it in the deduplication buffer queue. It calculates the hash fingerprint of each encrypted data block and compares it with the cloud data block index. If the hash fingerprint already exists, the encrypted data block is deleted; if not, the hash fingerprint is first stored in the cloud data block index, and then the corresponding encrypted data block is placed in the storage buffer for storage. S303. The cloud storage subsystem stores deduplicated encrypted data blocks one by one, interrupts the link after receiving the end flag sent by the edge storage subsystem, completes this ciphertext storage optimization, and releases all buffers; S304. After the edge storage subsystem completes the transmission, it deletes the encrypted data blocks that have been backed up locally in the cloud.

7. The multi-level encrypted data storage system for cloud-edge collaboration according to claim 1 is characterized in that: The method for a client to download an encrypted file includes the following steps: S401 client based on the searchable encryption algorithm to locate the encrypted file location, the encrypted file has been located to initiate a download request; S402 edge storage subsystem receives the download request, the deduplication index file to determine whether there is metadata information, if present, then update the metadata information timestamp, and obtain the file contains encrypted data block information, S403. Further determine whether the encrypted data block exists in the edge storage subsystem or the cloud storage subsystem. If it exists in the edge storage subsystem, directly return relevant information to the client, including the encrypted data block, stub file, and key status. If it exists in the cloud storage subsystem, initiate a request to the cloud storage subsystem, update the cloud storage subsystem's metadata information, and return relevant information to the client.

8. The multi-level encrypted data storage system for cloud-edge collaboration according to claim 7 is characterized in that: The method for the client to decrypt the encrypted file includes the following steps: S501 based on the downloaded encrypted data block and related information, based on the key state to extract the key file, decrypt the stub file; S502. All the pruned packets and stubs are combined and decrypted to obtain a combination of plaintext data blocks, which are then spliced ​​into the original file and presented on the client.

Images