Encryption method and device, storage medium

Abstract

The application provides an encryption method and device, and a storage medium. The method comprises the following steps: in the case that a to-be-encrypted file sent by a uploading client is received, processing the to-be-encrypted file to obtain encrypted data and a time-space proof file corresponding to the encrypted data; the to-be-encrypted file comprises original data and private key data; every preset period of time, verifying the data validity of the encrypted data by using the time-space proof file; and in the case that the data validity verification is passed, continuing to store the encrypted data; in the case that a data downloading instruction sent by a downloading client is received, sending the encrypted data to the downloading client, so that the downloading client downloads and decrypts the encrypted data by using the private key data to obtain the original data. Through the above technical solution, the security of encryption is improved.

Description

Technical Field

[0001] This application relates to the field of cryptography, and more particularly to an encryption method, device, and storage medium. Background Technology

[0002] Currently, cloud storage encryption technology based on XTS-AES-256 provides cloud servers with highly reliable, high-performance, feature-rich, and elastically scalable block storage services. It can meet the business needs of scenarios such as distributed file systems, development and testing, and data warehouses. The keys used by XTS-AES-256-based cloud storage encryption technology are provided by the Key Management Service (KMS) layer in the Data Encryption Workshop (DEW), which is a centralized module service. KMS uses a Hardware Security Module (HSM) that conforms to FIPS 140-2 Level 3 certification, ensuring the security of the keys.

[0003] However, since users' keys are centrally managed by the cloud space through hardware storage, if there are security risks in the cloud space, the keys stored in the cloud space may be leaked, thereby reducing the security of encryption. Summary of the Invention

[0004] This application provides an encryption method, device, and storage medium that can improve encryption security.

[0005] The technical solution of this application is implemented as follows:

[0006] In a first aspect, embodiments of this application provide an encryption method, the method comprising:

[0007] Upon receiving a file to be encrypted from an uploading client, the file is processed to obtain encrypted data and a corresponding spatiotemporal proof file; the file to be encrypted includes original data and private key data;

[0008] Every preset time interval, the encrypted data is validated using the spatiotemporal proof file; and if the data validity verification passes, the encrypted data continues to be stored.

[0009] Upon receiving a data download instruction from the download client, the encrypted data is sent to the download client for download. The download client then uses the private key data to decrypt the encrypted data to obtain the original data.

[0010] Secondly, according to an embodiment of this application, an encryption device is provided, the device comprising:

[0011] An encryption processing unit is used to process a file to be encrypted upon receiving a file to be encrypted from an uploading client, thereby obtaining encrypted data and a corresponding spatiotemporal proof file; the file to be encrypted includes original data and private key data;

[0012] The validity verification unit is used to verify the validity of the encrypted data using the spatiotemporal proof file at preset time intervals; and to continue storing the encrypted data if the data validity verification passes.

[0013] The sending unit is configured to send the encrypted data to the download client upon receiving a data download instruction from the download client, so that the download client can download the encrypted data and decrypt it using the private key data to obtain the original data.

[0014] Thirdly, embodiments of this application provide an encryption device, which includes a processor and a memory; the processor implements the above-described encryption method when executing a running program stored in the memory.

[0015] Fourthly, embodiments of this application provide a storage medium on which a computer program is stored, which, when executed by a processor, implements the above-described encryption method.

[0016] This application provides an encryption method, device, and storage medium. The method includes: upon receiving a file to be encrypted from an uploading client, processing the file to obtain encrypted data and a corresponding spatiotemporal proof file; the file to be encrypted includes original data and private key data; at preset time intervals, verifying the validity of the encrypted data using the spatiotemporal proof file; and continuing to store the encrypted data if the data validity verification passes; upon receiving a data download instruction from a downloading client, sending the encrypted data to the downloading client for download and decryption using the private key data to obtain the original data. By employing the above method, the file to be encrypted, containing encrypted data and a corresponding spatiotemporal proof file, is processed to generate encrypted data and the corresponding spatiotemporal proof file. The encryption device stores only the encrypted data and the spatiotemporal proof file. The spatiotemporal proof file periodically verifies the validity of the encrypted data, ensuring the preservation and traceability of the encrypted data. The user saves the private key data for data decryption, thereby improving encryption security. Attached Figure Description

[0017] Figure 1 A flowchart illustrating an encryption method provided in an embodiment of this application;

[0018] Figure 2 A schematic diagram of an exemplary data slice provided for an embodiment of this application;

[0019] Figure 3 A schematic diagram illustrating an exemplary iterative encryption method provided in this application embodiment;

[0020] Figure 4 This is a schematic diagram illustrating an exemplary process for generating comm_r_star, provided as an embodiment of this application.

[0021] Figure 5 A schematic diagram of an exemplary encrypted cloud space system based on blockchain spatiotemporal proof technology provided for embodiments of this application;

[0022] Figure 6 A schematic diagram of the structure of an encryption device provided in this application embodiment. Figure 1 ;

[0023] Figure 7 A schematic diagram of the structure of an encryption device provided in this application embodiment. Figure 2 . Detailed Implementation

[0024] In order to gain a more detailed understanding of the features and technical content of the embodiments of this application, the implementation of the embodiments of this application will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for reference and illustration only and are not intended to limit the embodiments of this application.

[0025] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0026] In the following description, references to "some embodiments" refer to a subset of all possible embodiments. It is understood that "some embodiments" may be the same or different subsets of all possible embodiments and may be combined with each other without conflict. It should also be noted that the terms "first, second, third" used in the embodiments of this application are merely for distinguishing similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0027] This application provides an encryption method, such as... Figure 1 As shown, the method may include:

[0028] S101. Upon receiving the file to be encrypted from the uploading client, process the file to be encrypted to obtain encrypted data and the corresponding spatiotemporal proof file; the file to be encrypted includes the original data and the private key data.

[0029] The encryption method proposed in this application is applicable to cloud space encryption scenarios based on spatiotemporal proof technology.

[0030] In this embodiment, the upload client stores the user-uploaded private key data in a designated storage space and mixes it with the original data to generate a file to be encrypted that conforms to the input of the encryption device. The file to be encrypted is a mixed file with the .pdata extension. The upload client then sends the file to be encrypted to the encryption device.

[0031] In this embodiment, the encryption device processes the file to be encrypted to obtain encrypted data and a corresponding spatiotemporal proof file. The processing flow for the encrypted file may include the following steps: slicing, encryption, tagging, and encapsulation.

[0032] Specifically, the file to be encrypted is sliced ​​to obtain slice data; the slice data is iteratively encrypted to obtain encrypted data and root data generated during the iterative encryption process; and the encrypted data and root data are used to obtain the spatiotemporal proof file corresponding to the encrypted data.

[0033] In this embodiment of the application, the process of slicing the file to be encrypted to obtain slice data can be as follows: the file to be encrypted is divided into slice data of a preset size and packaged into data boxes.

[0034] For example, the preset size can be 32k, so a 32G of data to be encrypted can be divided into 1G of 32k data boxes.

[0035] It should be noted that after the file to be encrypted is divided into slice data, the label of the slice data is also calculated, that is, SDR calculation, to generate the data Merkle tree tree_d0 corresponding to the slice data, and the root data of the data Merkle tree tree_d0 is comm_d0.

[0036] For example, such as Figure 2As shown, 1G of 32k data bins are connected according to a Depth Robust Graph (DRG). Based on the dependencies of each data bin, a Verifiable Delay Encode (VDE) function is used to output 1G of 32k encrypted data bins. The Merkle Co-Regularized Hashing (CRH) function is used to calculate the Merkle tree tree_d0 corresponding to the data bins and the root data comm_d0 of the Merkle tree tree_d0. It can also generate the encrypted Merkle tree tree_r0 corresponding to the encrypted data bins and the root data comm_r0 of the encrypted Merkle tree tree_r0.

[0037] In this embodiment of the application, the process of iteratively encrypting the slice data to obtain encrypted data and root data generated during the iterative encryption process is as follows: the slice data is iteratively encrypted multiple times to obtain encrypted data; an input data Merkle tree and an output data Merkle tree are constructed for the input data and output data of each round of iterative encryption process, and the root data of each input data Merkle tree and the root data of each output data Merkle tree are determined; the root data of the input Merkle tree corresponding to the slice data, the root data of the output data Merkle tree of each round of iterative encryption process, and the identifier of the encrypted data are determined as the root data.

[0038] In this embodiment of the application, the root data is uploaded to the blockchain for processing.

[0039] For example, such as Figure 3 As shown, encryption calculations are performed iteratively 10 times on 1G encrypted data boxes. Each iteration's input is 1G data boxes, and the output is 1G encrypted data boxes. The output of each layer is used as the input for the next layer's iterative encryption calculation. The encrypted data box output from the last iteration is used as the encrypted data. For each layer's input and output encrypted data boxes, a corresponding Merkle tree can be constructed using the MerkleCRH function. Therefore, after 10 iterations of encryption on 1G encrypted data boxes, the root data of the resulting Merkle trees are comm_d1, comm_r1, ..., comm_d10, comm_r10. Here, comm_d1 is the root data of the input data Merkle tree for the first iteration, comm_r1 is the root data of the output data Merkle tree for the first iteration, and so on, with comm_d10 being the root data of the input data Merkle tree for the tenth iteration and comm_r10 being the root data of the output data Merkle tree for the tenth iteration.

[0040] refer to Figure 3 ,like Figure 4 As shown, the encrypted data identifiers Replica_ID, comm_r0, ..., comm_r10 are hashed to obtain comm_r_star. Then, comm_d0, comm_r10, and comm_r_star are stored as root data on the blockchain.

[0041] Furthermore, after iteratively encrypting the sliced ​​data to obtain encrypted data and root data generated during the iterative encryption process, and before obtaining the corresponding spatiotemporal proof file using the encrypted data and root data, a tagging operation is performed on the encrypted data to record the filename and related information, generating a dynamic hash list. The purpose of the dynamic hash list is to locate the required file information in the encrypted sealed sector and synthesize the encrypted data into an encrypted sealed sector file with the .Sector extension. The encrypted sealed sector file and the dynamic hash list are then stored in the encrypted sealed sector of the encryption device.

[0042] For example, each .Sector file is 32GB in size, and .Sector files that are less than 32GB are padded with random numbers.

[0043] In this embodiment of the application, the process of obtaining the spatiotemporal proof file corresponding to the encrypted data by encrypting the encrypted data and the root data is as follows: obtaining the proof key pair and encryption private key corresponding to the node server that performs the iterative encryption process; generating the proof string corresponding to the encrypted data using the proof key pair, encryption private key and encrypted data; extracting a portion of the encrypted data from the encrypted data; and selecting the spatiotemporal proof file from the proof string using the portion of the encrypted data and the root data.

[0044] The first step is to input the encrypted data into formula (1) to obtain the CRH hash value hD of the encrypted data D.

[0045] hD=CRH(D) (1)

[0046] The second step is to input D and the proof private key skp into formula (2) to obtain the encrypted data box R. Here, Seal() is the sealing algorithm.

[0047] R = Seal(D, skp) (2)

[0048] The third step is to input R into formula (3) to obtain the Merkle hash function generated by the encrypted data copy Merkle hash function.

[0049] rt=MerkleCRH(R) (3)

[0050] The fourth step is to input the public keys pkp, hD, and rt into formula (4) to obtain the first combination value x, and input skp and D into formula (5) to obtain the second combination value w.

[0051] x=(pkp,hD,rt) (4)

[0052] w = (skp, D) (5)

[0053] Fifth step, input the encrypted private key pkSEAL, x, w into formula (6) to obtain the proof string πSEAL. The proof string is used to represent that the original data was encrypted and sealed by a specific node server.

[0054] πSEAL=SCIP.Prove(pkSEAL,x,w) (6)

[0055] The πSEAL string can verify whether the data has been correctly encrypted and stored effectively. However, since the πSEAL string occupies tens of megabytes of memory, it is not suitable for uploading to the blockchain. Therefore, it is necessary to use some encrypted data and root data to select a spacetime proof file from the proof string.

[0056] For example, first obtain a random number from the blockchain, then, based on the number of data, select 50 encrypted data boxes from 1G of encrypted data boxes and perform VDE function calculations to check if they conform to comm_d0, Comm_r10, and comm_r_star. If they do, continue to obtain a random number from the blockchain. After repeating the above operation 10 times to obtain 500 encrypted data boxes, perform MerkleCRH calculations on these 500 encrypted data boxes to obtain a Merkle root data comm_c and a spacetime proof string Proof(πPOS).

[0057] It should be noted that the spacetime proof file is stored in the blockchain for accounting operations.

[0058] S102. Every preset time period, use the spatiotemporal proof file to verify the validity of the encrypted data; and if the data validity verification passes, continue to store the encrypted data.

[0059] After obtaining the encrypted data and the corresponding spatiotemporal proof file, the validity of the encrypted data must be verified using the spatiotemporal proof file at preset time intervals.

[0060] In this embodiment, at preset time intervals, the encryption public key and proof public key of the node server are obtained; a first verification result is generated using the proof string, encrypted data, proof public key, and encryption public key; a first number is generated based on the blockchain; and a second verification result is generated based on the first number and the spatiotemporal proof file; if the first verification result is consistent with the second verification result, it indicates that the data validity verification of the encrypted data has passed; if the first verification result is inconsistent with the second verification result, it indicates that the data validity verification of the encrypted data has failed.

[0061] The specific calculation process is as follows:

[0062] The first step is to input hD, rt, and the proof public key pkp into formula (7) to obtain the first value x0;

[0063] x0=(pkp,hD,rt) (7)

[0064] The second step is to input the encrypted public keys vkSEAL, x0 and πSEAL into formula (8) to obtain the first verification result b1;

[0065] b1=SCIP.Verify(vkSEAL,x0,πSEAL) (8)

[0066] The third step is to input the first number c and rt into formula (9) to obtain the second value x1;

[0067] x1 = (c, rt) (9)

[0068] Fourth step, input vkPOS, x1, and πPOS into formula (10) to obtain the second verification result b2;

[0069] b2=SCIP.Verify(vkPOS,x0,πPOS) (10)

[0070] The fifth step is to compare b1 and b2. If b1 and b2 are equal, the data validity verification of the encrypted data is successful; if b1 and b2 are not equal, the data validity verification of the encrypted data is unsuccessful.

[0071] Furthermore, if the data validity verification of encrypted data fails, it indicates that there is a risk of leakage of the encrypted and sealed data. At this time, it is necessary to activate the pre-set risk response mechanism.

[0072] S103. Upon receiving a data download instruction from the download client, the encrypted data is sent to the client for download and the client can use the private key data to decrypt the encrypted data to obtain the original data.

[0073] In this embodiment of the application, when a user needs to use encrypted data, the user sends a data download instruction for the encrypted data through a download client. When the encryption device receives the data download instruction, it sends the encrypted data to the download client. The download client includes private key data. After receiving the encrypted data, the download client uses the private key data to decrypt the encrypted data and restore the original data.

[0074] Understandably, this application uses the user's private key data to encrypt the original data, generating encrypted data, and calculates the corresponding spatiotemporal proof file for the encrypted data. This spatiotemporal proof file is then compressed, extracted, and stored on the blockchain. The encryption device retrieves the spatiotemporal proof file from the blockchain at preset time intervals to verify the encrypted data. By using the blockchain spatiotemporal proof file, the insecurity of existing centralized encryption is eliminated. The user's private key data is stored on the client side, and the encryption device does not store the user's private key data, thus improving encryption security. By using the blockchain to record the spatiotemporal proof file, the validity of the encrypted data is periodically verified, ensuring its storage and traceability, thereby enhancing encryption security.

[0075] Based on the above embodiments, and by way of example, this application proposes an encrypted cloud space system based on blockchain spatiotemporal proof technology, such as... Figure 5 As shown, the encrypted cloud space system includes an upload client, an encryption device, and a download client. The upload client mixes the original data with the user's uploaded private key and uploads the mixed file to the encryption device. Upon receiving the mixed file, the encryption device sequentially processes it through slicing, encryption, tagging, and encapsulation to obtain sealed encrypted data and a time-space proof string. The sealed encrypted data is a 32GB file; the time-space proof string occupies several hundred bytes. After compression and extraction, the time-space proof string is written into a blockchain block to verify the integrity of the sealed encrypted data. The sealed encrypted data is then stored in the cloud space. Every second, the encryption device randomly selects a block from the blockchain to verify whether the proof string and the sealed encrypted data are consistent. If they are consistent, the sealed encrypted data has been effectively stored. When a user needs to access the sealed encrypted data from the encryption device, the download client retrieves the sealed encrypted data from the encryption device. The user then decrypts the sealed encrypted data using their private key to restore the original data.

[0076] Based on the above embodiments, this application proposes an encryption device 1, such as... Figure 6 As shown, the encryption device 1 includes:

[0077] The encryption processing unit 10 is used to process the file to be encrypted upon receiving a file to be encrypted from an uploading client, thereby obtaining encrypted data and a spatiotemporal proof file corresponding to the encrypted data; the file to be encrypted includes original data and private key data;

[0078] The validity verification unit 11 is used to verify the validity of the encrypted data using the spatiotemporal proof file at preset time intervals; and to continue storing the encrypted data if the data validity verification is successful.

[0079] The sending unit 12 is used to send the encrypted data to the download client upon receiving a data download instruction from the download client, so that the download client can download the encrypted data and decrypt it using the private key data to obtain the original data.

[0080] Optionally, the device further includes: a slicing unit, an iterative encryption unit, and a proof unit;

[0081] The slicing unit is used to slice the file to be encrypted to obtain slice data;

[0082] The iterative encryption unit is used to perform iterative encryption processing on the slice data to obtain the encrypted data and the root data generated during the iterative encryption process.

[0083] The proof unit is used to obtain the spatiotemporal proof file corresponding to the encrypted data using the encrypted data and the root data.

[0084] Optionally, the device further includes: a construction unit and a determination unit;

[0085] The iterative encryption unit is also used to perform multiple rounds of iterative encryption on the slice data to obtain the encrypted data;

[0086] The construction unit is also used to construct an input data Merkle tree and an output data Merkle tree for the input data and output data of each round of iterative encryption process, and to determine the root data of each input data Merkle tree and the root data of each output data Merkle tree.

[0087] The determining unit is further configured to determine the root data of the input Merkle tree corresponding to the slice data, the root data of the output data Merkle tree of each round of iterative encryption process, and the identifier of the encrypted data as the root data.

[0088] Optionally, the device further includes: an acquisition unit, a generation unit, an extraction unit, and a selection unit;

[0089] The acquisition unit is used to acquire the proof key pair and encryption private key corresponding to the node server that performs the iterative encryption process.

[0090] The generation unit is used to generate a proof string corresponding to the encrypted data using the proof key pair, the encryption private key, and the encrypted data;

[0091] The extraction unit is used to extract a portion of the encrypted data from the encrypted data;

[0092] The selection unit is used to select the spacetime proof file from the proof string using the partially encrypted data and the root data.

[0093] Optionally, the spatiotemporal proof file and the root data are stored in a blockchain.

[0094] The acquisition unit is also used to acquire the encryption public key and the proof public key of the node server;

[0095] The generation unit is further configured to generate a first verification result using the proof string, the encrypted data, the proof public key, and the encryption public key; generate a first number based on the blockchain; and generate a second verification result based on the first number and the spatiotemporal proof file.

[0096] The validity verification unit 11 is further configured to indicate that the data validity verification of the encrypted data has passed if the first verification result is consistent with the second verification result; and to indicate that the data validity verification of the encrypted data has failed if the first verification result is inconsistent with the second verification result.

[0097] This application provides an encryption device that, upon receiving a file to be encrypted from an uploading client, processes the file to obtain encrypted data and a corresponding spatiotemporal proof file. The file to be encrypted includes original data and private key data. At preset time intervals, the spatiotemporal proof file is used to verify the validity of the encrypted data. If the data validity verification passes, the encrypted data continues to be stored. Upon receiving a data download instruction from a download client, the encrypted data is sent to the download client for download and decryption using the private key data to obtain the original data. Therefore, the encryption device proposed in this embodiment processes a file to be encrypted containing encrypted data and a corresponding spatiotemporal proof file, generating both encrypted data and the corresponding spatiotemporal proof file. The encryption device only stores the encrypted data and the spatiotemporal proof file, and the spatiotemporal proof file periodically verifies the validity of the encrypted data. This ensures the preservation and traceability of the encrypted data. Users can save their own private key data for data decryption, thereby improving encryption security.

[0098] Figure 7 A schematic diagram of the composition structure of an encryption device 1 provided in this application embodiment. Figure 2 In practical applications, based on the same disclosed concept of the above embodiments, such as Figure 7 As shown, the encryption device 1 in this embodiment includes: a processor 13, a memory 14, a transmitter 15, and a communication bus 16.

[0099] In the specific embodiments, the encryption processing unit 10, validity verification unit 11, slicing unit, iterative encryption unit, proof unit, construction unit, determination unit, acquisition unit, generation unit, extraction unit, and selection unit can be implemented by the processor 13 located on the encryption device 1, and the sending unit 12 can be implemented by the transmitter 15 located on the encryption device 1. The processor 13 can be at least one of the following: Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), CPU, controller, microcontroller, and microprocessor. It is understood that for different devices, the electronic device used to implement the above processor functions can also be other, and this embodiment does not specifically limit it.

[0100] In this embodiment, the communication bus 16 is used to establish communication between the processor 13, the memory 14, and the transmitter 15; when the processor 13 executes the running program stored in the memory 14, it implements the following encryption method:

[0101] Upon receiving a file to be encrypted from an uploading client, the file is processed to obtain encrypted data and a corresponding spatiotemporal proof file. The file to be encrypted includes original data and private key data. Every preset time period, the encrypted data is validated using the spatiotemporal proof file. If the data validity validation passes, the encrypted data is stored.

[0102] The aforementioned transmitter 15 is used to send the encrypted data to the download client upon receiving a data download instruction from the download client, so that the download client can download the encrypted data and decrypt it using the private key data to obtain the original data.

[0103] Furthermore, the processor 13 is also used to slice the file to be encrypted to obtain slice data; to perform iterative encryption on the slice data to obtain encrypted data and root data generated during the iterative encryption process; and to obtain the spatiotemporal proof file corresponding to the encrypted data using the encrypted data and the root data.

[0104] Furthermore, the processor 13 is also configured to perform multi-round iterative encryption on the slice data to obtain the encrypted data; construct an input data Merkle tree and an output data Merkle tree for the input data and output data of each round of iterative encryption process, and determine the root data of each input data Merkle tree and the root data of each output data Merkle tree; and determine the root data as the root data of the input Merkle tree corresponding to the slice data, the root data of the output data Merkle tree of each round of iterative encryption process, and the identifier of the encrypted data.

[0105] Furthermore, the processor 13 is also used to obtain the proof key pair and encryption private key corresponding to the node server that performs the iterative encryption process; generate a proof string corresponding to the encryption data using the proof key pair, the encryption private key and the encryption data; extract a portion of the encryption data from the encryption data; and select the spatiotemporal proof file from the proof string using the portion of the encryption data and the root data.

[0106] Furthermore, the spatiotemporal proof file and the root data are stored in the blockchain.

[0107] The processor 13 described above is further configured to obtain the encryption public key and proof public key of the node server; generate a first verification result using the proof string, the encrypted data, the proof public key, and the encryption public key; generate a first number based on the blockchain; and generate a second verification result based on the first number and the spatiotemporal proof file; if the first verification result is consistent with the second verification result, it indicates that the data validity verification of the encrypted data has passed; if the first verification result is inconsistent with the second verification result, it indicates that the data validity verification of the encrypted data has failed.

[0108] This application provides a storage medium storing a computer program thereon. The computer-readable storage medium stores one or more programs, which can be executed by one or more processors and applied in an encryption device. The computer program implements the encryption method described above.

[0109] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0110] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause an image display device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this disclosure.

[0111] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. An encryption method, characterized in that, Applied to cloud space; the method includes: Upon receiving a file to be encrypted from the upload client, the original data in the file to be encrypted is encrypted using the private key data in the file to be encrypted, resulting in encrypted data and a corresponding spatiotemporal proof file; the file to be encrypted includes original data and private key data; the upload client mixes the user-uploaded private key data with the original data to generate the file to be encrypted; the cloud space does not store the user's private key data; Every preset time interval, the encrypted data is validated using the spatiotemporal proof file; and if the data validity verification passes, the encrypted data continues to be stored. Upon receiving a data download instruction from the download client, the encrypted data is sent to the download client for download. The download client then uses the private key data included in the download client to decrypt the encrypted data and obtain the original data. Before encrypting the original data in the file to be encrypted using the private key data in the file to be encrypted to obtain the encrypted data and the corresponding spacetime proof file, the method further includes: The encrypted data is tagged, and the file name and related information are recorded to generate a dynamic hash list.

2. The method according to claim 1, characterized in that, The process of encrypting the original data in the file to be encrypted using the private key data in the file to be encrypted to obtain encrypted data and a corresponding spatiotemporal proof file includes: The original data is sliced ​​to obtain sliced ​​data; The slice data is iteratively encrypted to obtain the encrypted data and the root data generated during the iterative encryption process. Using the encrypted data and the root data, the spatiotemporal proof file corresponding to the encrypted data is obtained.

3. The method according to claim 2, characterized in that, The iterative encryption process of the slice data to obtain the encrypted data and the root data generated during the iterative encryption process includes: The sliced ​​data is iteratively encrypted multiple times to obtain the encrypted data; For each round of iterative encryption process, construct an input data Merkle tree and an output data Merkle tree, and determine the root data of each input data Merkle tree and the root data of each output data Merkle tree. The root data is determined by the root data of the input Merkle tree corresponding to the slice data, the root data of the output Merkle tree of each round of iterative encryption, and the identifier of the encrypted data.

4. The method according to claim 2, characterized in that, The step of obtaining the spacetime proof file corresponding to the encrypted data using the encrypted data and the root data includes: Obtain the proof key pair and encryption private key corresponding to the node server that performs the iterative encryption process; Using the proof key pair, the encryption private key, and the encryption data, a proof string corresponding to the encryption data is generated; Extract a portion of the encrypted data from the encrypted data; Using the partially encrypted data and the root data, the spacetime proof file is selected from the proof string.

5. The method according to claim 4, characterized in that, The spacetime proof file and the root data are stored in the blockchain. The step of using the spacetime proof file to verify the validity of the encrypted data includes: Obtain the encryption public key and proof public key of the node server; A first verification result is generated using the proof string, the encrypted data, the proof public key, and the encryption public key; A first number is generated based on the blockchain; and a second verification result is generated based on the first number and the spatiotemporal proof file. If the first verification result is consistent with the second verification result, then the data validity verification of the encrypted data is successful; If the first verification result is inconsistent with the second verification result, then the data validity verification of the encrypted data fails.

6. An encryption device, characterized in that, Applied to cloud space; the device includes: An encryption processing unit is used to, upon receiving a file to be encrypted from an upload client, encrypt the original data in the file using the private key data in the file to obtain encrypted data and a corresponding spatiotemporal proof file; the file to be encrypted includes original data and private key data; the upload client mixes the user-uploaded private key data with the original data to generate the file to be encrypted; the cloud space does not store the user's private key data; The validity verification unit is used to verify the validity of the encrypted data using the spatiotemporal proof file at preset time intervals; and to continue storing the encrypted data if the data validity verification passes. The sending unit is configured to send the encrypted data to the download client upon receiving a data download instruction from the download client, so that the download client can download the encrypted data and decrypt it using the private key data included in the download client to obtain the original data; The encryption processing unit is also used to tag the encrypted data, record the file name and related information, and generate a dynamic hash list.

7. The device according to claim 6, characterized in that, The device also includes: a slicing unit, an iterative encryption unit, and a proof unit; The slicing unit is used to slice the original data to obtain sliced ​​data; The iterative encryption unit is used to perform iterative encryption processing on the slice data to obtain the encrypted data and the root data generated during the iterative encryption process. The proof unit is used to obtain the spatiotemporal proof file corresponding to the encrypted data using the encrypted data and the root data.

8. The device according to claim 7, characterized in that, The device further includes: a construction unit and a determination unit; The iterative encryption unit is also used to perform multiple rounds of iterative encryption on the slice data to obtain the encrypted data; The construction unit is also used to construct an input data Merkle tree and an output data Merkle tree for the input data and output data of each round of iterative encryption process, and to determine the root data of each input data Merkle tree and the root data of each output data Merkle tree. The determining unit is further configured to determine the root data of the input Merkle tree corresponding to the slice data, the root data of the output data Merkle tree of each round of iterative encryption process, and the identifier of the encrypted data as the root data.

9. An encryption device, characterized in that, The encryption device includes a processor and a memory; the processor executes the running program stored in the memory to implement the method as described in any one of claims 1-5.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-5.

Images