Data storage encryption system, method, device and medium

Abstract

The present invention discloses a data storage encryption system, method, device and medium. The system comprises: storing a master key in a hardware password card, an encryption and decryption module encrypting a random value of each data file by using the master key to obtain a corresponding file key, and storing the file key in a temporary key position in the hardware password card, and storing each temporary key position in a system cache; upon receiving a data transmission instruction, obtaining a data file corresponding to the data to be transmitted, and obtaining the corresponding file key from the hardware password card through the temporary key position in the system cache, and encrypting the data file using the file key, and storing the obtained encrypted data in a database on the server side. The present invention avoids the risk of loss and theft caused by storing the file key in the local environment of the system, thereby ensuring the security of the key, and ensuring the encryption security of the data and logs during data storage and data transmission.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data storage encryption system, method, device and medium. Background Art

[0002] The data storage base used by the current relational database is based on the MySQL database. The database communication uses SSL, and the data / log uses the default and only encryption algorithm AES algorithm.

[0003] However, the key of the AES algorithm is stored in the local environment of the operating system, which is prone to the risk of key loss and theft, and thus the encryption security of data and logs cannot be guaranteed. Summary of the invention

[0004] The present invention provides a data storage encryption system, method, device and medium to solve the technical problem of low encryption security of encryption algorithms in the prior art.

[0005] According to one aspect of the present invention, there is provided a data storage encryption system, comprising: an encryption and decryption module and a hardware password card;

[0006] The pre-generated master key is stored in the hardware password card, and the encryption and decryption module encrypts the random value of each data file by using the master key to obtain the file key of the corresponding data file, and stores the file key in a temporary key position in the hardware password card, and stores each of the temporary key positions in the system cache;

[0007] In response to the received data transmission instruction, the data file corresponding to the data to be transmitted is obtained, and the corresponding file key is obtained from the hardware password card through the temporary key position in the system cache, and the data file is encrypted using the file key, and the obtained encrypted data is stored in the database of the server, so that other clients can access and decrypt the encrypted data from the server.

[0008] According to another aspect of the present invention, there is provided a data storage encryption method, comprising:

[0009] In response to the received data transmission instruction, obtaining a temporary key position of a data file corresponding to the data to be transmitted from a system cache;

[0010] Obtaining the file key of the data file from the hardware password card based on the temporary key position;

[0011] Encrypting the data to be transmitted using the file key to obtain corresponding encrypted data;

[0012] The encrypted data is stored in the server so that other clients can access and decrypt the encrypted data from the server.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data storage encryption method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data storage encryption method described in any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention stores a master key in an independent hardware password card, and the encryption and decryption module encrypts the random value of each data file by the master key to obtain the file key of the corresponding data file, and stores the file key in a temporary key position in the hardware password card, and stores each temporary key position in the system cache, thereby avoiding the risk of loss and theft caused by storing the file key in the local environment of the system, thereby ensuring the security of the key; and when a data transmission instruction is received, the file key of the data file corresponding to the data to be transmitted is obtained from the temporary key position in the system cache, and the data file is encrypted by using the file key, and the obtained encrypted data is stored in the database of the server, so that other clients can access and decrypt the encrypted data from the server, thereby ensuring the encryption security of data and logs during data storage and data transmission.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 It is a structural block diagram of a data storage encryption system provided by an embodiment of the present invention;

[0022] Figure 2 is a structural block diagram of another data storage encryption system provided by an embodiment of the present invention;

[0023] Figure 3 It is a structural block diagram of another data storage encryption system provided by an embodiment of the present invention;

[0024] Figure 4 It is a flow chart of generating an HMAC value of a record in an audit log provided by an embodiment of the present invention;

[0025] Figure 5 It is a schematic diagram of an implementation of a TLS handshake process included in the communication between a client and a database in a server provided by an embodiment of the present invention;

[0026] Figure 6 is an overall block diagram of a data storage encryption system provided by an embodiment of the present invention;

[0027] Figure 7 is a flow chart of a data storage encryption method provided by an embodiment of the present invention;

[0028] Figure 8 It is a structural schematic diagram of a data storage encryption device provided by an embodiment of the present invention;

[0029] Fig. 9 It is a structural block diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] In one embodiment, Figure 1 This is a structural block diagram of a data storage encryption system provided by an embodiment of the present invention. This embodiment is applicable to the case where data is encrypted during data storage and transmission. The data storage encryption can be implemented in the form of hardware and / or software. The data storage encryption system can be configured in an electronic device. Figure 1 As shown, the data storage encryption system includes: an encryption and decryption module 10 and a hardware password card 20;

[0033] The pre-generated master key is stored in the hardware password card 20, and the encryption and decryption module 10 encrypts the random value of each data file by the master key to obtain the file key of the corresponding data file, and stores the file key in a temporary key position in the hardware password card 20, and stores each temporary key position in the system cache;

[0034] In response to the received data transmission instruction, the data file corresponding to the data to be transmitted is obtained, and the corresponding file key is obtained from the hardware password card 20 through the temporary key position in the system cache, and the data file is encrypted using the file key, and the obtained encrypted data is stored in the database of the server, so that other clients can access and decrypt the encrypted data from the server.

[0035] Among them, the master key can be a symmetric key. When the system associated with the hardware password card 20 is initialized, a master key can be generated by the hardware password card 20, and the master key can be stored in the hardware password card 20, and each data file corresponds to a random value, and the master key in the hardware password card 20 is used to encrypt the random value of each data file to obtain the corresponding file key, and the file key is stored in a temporary key position in the hardware password card 20, and the temporary key position of each file key is stored in the system cache, thereby avoiding the key loss problem, ensuring that the master key is stored locally, not globally, and ensuring the security of the master key. The random value of each data file is randomly generated, which can be understood as the file key of each data file is also randomly generated.

[0036] When the database in the system is restarted, the key metadata database for storing file keys can be loaded, and the file keys can be decrypted by the master key. When it is necessary to encrypt and decrypt the data to be transmitted, the corresponding file key can be obtained from the temporary key position stored in the system cache, and the file key can be used for encryption and decryption operations. After the use is completed, the temporary key position in the system cache is immediately destroyed.

[0037] The technical solution of this embodiment is to store the master key in an independent hardware password card, and the encryption and decryption module encrypts the random value of each data file by the master key to obtain the file key of the corresponding data file, and stores the file key in a temporary key position in the hardware password card, and stores each temporary key position in the system cache, thereby avoiding the risk of loss and theft caused by storing the file key in the local environment of the system, thereby ensuring the security of the key; and when receiving a data transmission instruction, the file key of the data file corresponding to the data to be transmitted is obtained from the temporary key position in the system cache, and the data file is encrypted by using the file key, and the obtained encrypted data is stored in the database of the server, so that other clients can access and decrypt the encrypted data from the server, thereby ensuring the encryption security of data and logs during data storage and data transmission.

[0038] In one embodiment, Figure 2 1 is a structural block diagram of another data storage encryption system provided by an embodiment of the present invention. This embodiment is based on the above embodiment, and adds a role identification module to the data storage encryption system. Figure 2 As shown, the data storage encryption system in this embodiment further includes: a role identification module 30; the role identification module 30 is used to initialize and manage the rights of each role in the system. In the embodiment, the role identification module 30 not only initializes and manages the rights of each role in the system, but also authenticates the identity information of each operator.

[0039] In one embodiment, the role identification module includes: a role management module, a role initialization module and a permission management module;

[0040] The role management module is used to configure the following three roles: system administrator, business administrator and system auditor. The system administrator is used to initialize and manage passwords; the business administrator is used to perform system business operations; the system auditor is used to manage operation behavior logs, as well as to back up, archive, query and audit audit logs.

[0041] The role initialization module is used to initialize the system administrator and set the default PIN code when the system is initialized. The default PIN code is registered in the hardware password card. After the system administrator successfully logs in to the system with the default PIN code, the business administrator and system auditor are created;

[0042] The authority management module is used to allocate and manage authorized operations and illegal operations of system administrators, business administrators and system auditors.

[0043] In an embodiment, the role management module is used to provide system administrators, business administrators and system auditors, wherein the system administrator is used to assume the role of a password supervisor, responsible for performing password initialization and management functions, as well as commonly used security services, such as module initialization, management of key security parameters and public security parameters; the business administrator is used to assume the role of system business operations, responsible for user creation and deletion, authorization and recovery, and management of other database objects; the system auditor is used to assume the role of log auditing, responsible for the management of operation behavior logs and backing up, archiving, querying and auditing audit logs.

[0044] In an embodiment, the process of initializing the role using the role initialization module is as follows: when the system is initialized, the system administrator is initialized, and a default personal identification number (PIN) code is set, and the default PIN code is registered in the hardware password card; after the system is started, the system administrator's USB-key is inserted, and the default PIN code is entered. After a successful login, the system administrator can perform operations and management, and can also dynamically modify the PIN code; after a successful login, a business administrator and a system administrator can be created. Of course, when creating the two roles of business administrator and system administrator respectively, the corresponding USB-keys of the two roles need to be inserted.

[0045] In an embodiment, the authority management module can be used to manage the authority of the system administrator, business administrator, and system auditor. For example, the authorized operations of the system administrator may include: role initialization and modification of the PIN code of the system administrator, and illegal operations include: operation of the business table and the audit table; the authorized operations of the business administrator may include: creation of a business operation role (i.e., a new business administrator) and authority management of the business database and business table, and illegal operations include: operation of the audit table; the authorized operations of the system auditor include: read-only access to the audit table and initiation of log integrity detection, and illegal operations include: operation of the business table and modification of the audit table.

[0046] In one embodiment, Figure 3 1 is a structural block diagram of another data storage encryption system provided by an embodiment of the present invention. This embodiment is based on the above embodiment, and adds a security audit module to the data storage encryption system. Figure 3 As shown, the data storage encryption system in this embodiment also includes a security audit module 40.

[0047] The hardware password card 20 is also used to generate a corresponding log integrity protection key when the system is initialized, and store the log integrity protection key in the hardware password card 20 .

[0048] The security audit module 40 is used to verify the integrity of the audit log generated based on the operation records of the system administrator and the business administrator;

[0049] The security audit module 40 determines the current HMAC value of the current record based on the key-related Hash-based Message Authentication Code (HMAC) value of the previous record in the audit log and the log integrity protection key, and determines the integrity of the current record based on the consistency result between the current HMAC value of the current record and the original HMAC value.

[0050] Among them, HMAC uses a hash function and a log integrity protection key to generate a fixed-length verification code, called an HMAC value. In an embodiment, some operations involving security for system administrators and business administrators are recorded and written into an audit log file. Among them, the operation record includes but is not limited to: node identification (ID), user name, user IP (i.e., IP address), user port (Port), library name of the operation, table name of the operation, type of operation command, statement of operation, operation time and HMAC value (the password-related operations in the log will be desensitized).

[0051] Figure 4 1 is a flow chart of generating the HMAC value of a record in an audit log provided by an embodiment of the present invention. Figure 4As shown, the process of generating the HMAC value includes the following steps:

[0052] Step 1: Perform an XOR operation on the log integrity protection key and the ipad sequence to generate ipadkey.

[0053] Step 2, combining the ipadkey and a record of the audit log to obtain a corresponding first combination sequence;

[0054] Step 3: Use the SM3 hash algorithm to operate on the first combination sequence to obtain a hash value.

[0055] Step 4: Perform an XOR operation on the log integrity protection key and the opad sequence to obtain opadkey.

[0056] Step 5: Combine the hash value and opadkey to obtain a corresponding second combination sequence.

[0057] Step 6: Use the SM3 hash algorithm to calculate the second combination sequence to obtain the HMAC value of this record.

[0058] Among them, the SM hash algorithm is the relevant algorithm interface provided by the hardware password card; ipad=a byte of 0x36 repeated 32 times; opad=a byte of 0x5C repeated 32 times.

[0059] After calculating the HMAC value of each record in the audit log, the current HMAC value of each record is compared with the previous HMAC value. If the two HMAC values ​​are not equal, the current record is returned as a tampered record; if all records are completely equal, an empty set is returned, that is, all records have not been tampered with.

[0060] In one embodiment, the data encryption and decryption module is further used to divide the data in the database according to the data type to obtain data files of different data types; and generate different file keys for different types of data files.

[0061] In one embodiment, the data storage encryption system further includes: a database communication module; sending the signature certificate and encryption certificate of the server to the client through the database communication module, and storing the signature certificate and encryption certificate in the hardware password card.

[0062] In the embodiment, the client can be a business application program, and can establish secure communication with the database in the server to ensure the security and integrity of business data in network transmission. At the same time, the operation log transmission between the master and slave nodes in the database also adopts secure communication to ensure data transmission security.

[0063] Figure 51 is a schematic diagram of the implementation of the TLS handshake process included in the communication between the client and the database in the server provided by an embodiment of the present invention. Figure 5 As shown, the TLS handshake process included in the communication between the client and the database in the server in this embodiment includes the following steps:

[0064] Step 1: The client sends a client hello message to the server, and the server responds to the server hello message, otherwise a fatal error is generated and the connection is disconnected. The client hello and server hello are used to negotiate the cryptographic algorithms based on SM2 and RSA on the client and server, and to determine the security transmission capabilities, including attributes such as protocol version, session identifier and cipher suite, and to generate and exchange random numbers.

[0065] Step 2: After the client hello and server hello messages, there is the identity authentication and key exchange process, which includes server certificate, server key exchange, client certificate, and client key exchange.

[0066] Step 3: After the server sends the hello message, it sends its own certificate message and the server key exchange message. If the server needs to verify the identity of the client, it sends a certificate request message to the client.

[0067] Step 4, then send the server hello completion message, indicating that the hello message phase has ended, and the server is waiting for the client's return message.

[0068] Step 5: If the server sends a certificate request message, the client should return a certificate message. The client then sends a key exchange message, the content of which depends on the key exchange algorithm negotiated between the client hello message and the server hello message.

[0069] Step 6: If the client sends a certificate message, it should also send a certificate verification message to be digitally signed to verify the identity of the client.

[0070] Step 7: The client then sends a cipher specification change message, and then immediately uses the newly negotiated algorithm and key to encrypt and send a handshake end message.

[0071] In step 8, the server responds to the cipher specification change message, uses the newly negotiated algorithm and key, encrypts and sends a handshake end message.

[0072] Step 9: The handshake process ends here, and the server and client can start secure data transmission.

[0073] In one embodiment, Figure 6is an overall block diagram of a data storage encryption system provided by an embodiment of the present invention, such as Figure 6 As shown, the data storage encryption system includes: cryptographic module software, operating system environment and cryptographic module hardware.

[0074] Among them, the cryptographic module software includes application layer, business logic layer and protocol layer; the application layer provides users with identity authentication and data encryption storage functions; the business logic layer includes operation management module, business logic module, role identification module, key management module and encryption and decryption module; the protocol layer includes key management interface and database communication interface.

[0075] Among them, the operation management module is responsible for managing the operation of the password module.

[0076] The business logic module contains the core business logic implementation of encrypted storage and query of user data.

[0077] The role identification module is responsible for user authentication, role initialization and permission management.

[0078] The key management module is responsible for the full life cycle management of keys, including key generation, storage, use, update and destruction.

[0079] The encryption and decryption module is used to provide a unified user data encryption and decryption interface to encrypt and decrypt data.

[0080] The operating system environment includes a driver layer and an operating system layer; wherein the driver layer includes: a password card driver, an intelligent password key driver and a password algorithm library; the operating system layer includes: a database device operating system and related class libraries.

[0081] The password module hardware includes a physical layer, and the physical layer includes: a password card and an intelligent password key.

[0082] In one embodiment, Figure 7 FIG. 1 is a flow chart of a data storage encryption method provided by an embodiment of the present invention. The data storage encryption method in this embodiment is executed by the data storage encryption system in the above embodiment. Figure 7 As shown, the method includes:

[0083] S110. In response to the received data transmission instruction, obtain a temporary key position of a data file corresponding to the data to be transmitted from a system cache.

[0084] S120: Obtain the file key of the data file from the hardware password card based on the temporary key position.

[0085] S130: Encrypt the data to be transmitted using the file key to obtain corresponding encrypted data.

[0086] S140: Store the encrypted data in the server, so that other clients can access and decrypt the encrypted data from the server.

[0087] The technical solution of this embodiment avoids the risk of loss and theft caused by storing the master key in the local system environment by storing the master key in an independent hardware password card, thereby ensuring the security of the key; and when receiving a data transmission instruction, the file key of the data file corresponding to the data to be transmitted is obtained from the temporary key position in the system cache, and the data file is encrypted using the file key, and the obtained encrypted data is stored in the database of the server, so that other clients can access and decrypt the encrypted data from the server, thereby ensuring the encryption security of data and logs during data storage and data transmission.

[0088] In one embodiment, Figure 8 Schematic diagram of a data storage encryption device provided by an embodiment of the present invention. Figure 8 As shown, the device includes: a first acquisition module 210, a second acquisition module 220, an encryption module 230 and a storage module 240.

[0089] The first acquisition module 210 is used to obtain the temporary key position of the data file corresponding to the data to be transmitted from the system cache in response to the received data transmission instruction;

[0090] A second acquisition module 220, configured to acquire a file key of the data file from a hardware password card based on the temporary key position;

[0091] The encryption module 230 is used to encrypt the data to be transmitted using the file key to obtain corresponding encrypted data;

[0092] The storage module 240 is used to store the encrypted data to the server, so that other clients can access and decrypt the encrypted data from the server.

[0093] The data storage encryption device provided in the embodiment of the present invention can execute the data storage encryption method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0094] It should be noted that the first acquisition module, the second acquisition module, the encryption module and the storage module in this embodiment are all logic units.

[0095] In one embodiment, Fig. 9 is a structural block diagram of an electronic device provided by an embodiment of the present invention, such as Fig. 9As shown, a schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0096] like Fig. 9 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0097] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0098] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as a data storage encryption method.

[0099] In some embodiments, the data storage encryption method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the data storage encryption method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the data storage encryption method in any other appropriate manner (e.g., by means of firmware).

[0100] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0101] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0102] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0103] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0104] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0105] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0106] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0107] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data storage encryption system, characterized in that: include: Encryption and decryption modules and hardware password cards; The pre-generated master key is stored in the hardware password card, and the encryption and decryption module encrypts the random value of each data file by using the master key to obtain the file key of the corresponding data file, and stores the file key in a temporary key position in the hardware password card, and stores each of the temporary key positions in the system cache; In response to the received data transmission instruction, a data file corresponding to the data to be transmitted is obtained, and a corresponding file key is obtained from the hardware password card through the temporary key position in the system cache, and the data file is encrypted using the file key, and the obtained encrypted data is stored in a database of the server, so that other clients can access and decrypt the encrypted data from the server; Wherein, the data storage encryption system further includes: a security audit module; the security audit module is used to verify the integrity of the audit log generated according to the operation records of the system administrator and the business administrator; Determine the current HMAC value of the current record according to the HMAC value of the previous record in the audit log and the log integrity protection key through the security audit module, and determine the integrity of the current record according to the consistency result between the current HMAC value of the current record and the original HMAC value; The process of generating the current HMAC value of the current record includes: Performing an XOR operation on the log integrity protection key and the ipad sequence to generate an ipadkey; Combine the ipadkey and the previous record of the audit log to obtain a corresponding first combination sequence; Using SM3 hash algorithm to operate the first combination sequence to obtain a hash value; Performing an XOR operation on the log integrity protection key and the opad sequence to obtain opadkey; Combining the hash value and the opadkey to obtain a corresponding second combination sequence; The second combination sequence is operated by using the SM3 hash algorithm to obtain the current HMAC value of the current record; wherein the ipad is a byte of 0x36 repeated 32 times; and the opad is a byte of 0x5C repeated 32 times.

2. The data storage encryption system according to claim 1, characterized in that: Also includes: The data storage encryption system further includes: a role identification module; The role identification module is used to initialize and manage the rights of each role in the system.

3. The data storage encryption system according to claim 2, characterized in that: The role identification module includes: a role management module, a role initialization module and a rights management module; The role management module is used to configure the following three roles: system administrator, business administrator and system auditor; the system administrator is used to initialize and manage passwords; the business administrator is used to operate system business; the system auditor is used to manage operation behavior logs, and to back up, archive, query and audit audit logs; The role initialization module is used to initialize the system administrator and set a default PIN code when the system is initialized, register the default PIN code in the hardware password card, and create a business administrator and a system auditor after the system administrator successfully logs in to the system with the default PIN code; The authority management module is used to allocate and manage the authorized operations and illegal operations of the system administrator, the business administrator and the system auditor.

4. The data storage encryption system according to claim 1, characterized in that: The hardware password card is also used to generate a corresponding log integrity protection key when the system is initialized, and store the log integrity protection key in the hardware password card.

5. The data storage encryption system according to claim 1, characterized in that: The data encryption and decryption module is also used to divide the data in the database according to the data type to obtain data files of different data types; and generate different file keys for different types of data files.

6. The data storage encryption system according to claim 1, characterized in that: The data storage encryption system further includes: a database communication module; The signature certificate and encryption certificate of the server are sent to the client through the database communication module, and the signature certificate and encryption certificate are stored in the hardware password card.

7. A data storage encryption method, characterized in that: include: In response to the received data transmission instruction, obtaining a temporary key position of a data file corresponding to the data to be transmitted from a system cache; Obtaining the file key of the data file from the hardware password card based on the temporary key position; Encrypting the data to be transmitted using the file key to obtain corresponding encrypted data; storing the encrypted data in a server so that other clients can access and decrypt the encrypted data from the server; Wherein, the method further comprises: Verify the integrity of the audit logs generated based on the operation records of the system administrator and business administrator; Determine the current HMAC value of the current record according to the HMAC value of the previous record in the audit log and the log integrity protection key, and determine the integrity of the current record according to the consistency result between the current HMAC value of the current record and the original HMAC value; The process of generating the current HMAC value of the current record includes: Performing an XOR operation on the log integrity protection key and the ipad sequence to generate an ipadkey; Combine the ipadkey and the previous record of the audit log to obtain a corresponding first combination sequence; Using SM3 hash algorithm to operate the first combination sequence to obtain a hash value; Performing an XOR operation on the log integrity protection key and the opad sequence to obtain opadkey; Combining the hash value and the opadkey to obtain a corresponding second combination sequence; The second combination sequence is operated by using the SM3 hash algorithm to obtain the current HMAC value of the current record; wherein the ipad is a byte of 0x36 repeated 32 times; and the opad is a byte of 0x5C repeated 32 times.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the data storage encryption method according to any one of claim 7.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data storage encryption method according to any one of claim 7 when executed.

Images