Terminal interactive data storage security management method and system for instant messaging

Abstract

The present invention discloses a terminal interactive data storage security management method and system for instant messaging, including: slicing the original data to be stored on the terminal client, dividing it into original data fragments; encrypting the original data fragments using homomorphic encryption technology to generate ciphertext data fragments; distributing the homomorphically encrypted ciphertext data fragments to different storage nodes; when retrieving the original data, collecting the corresponding ciphertext data fragments from each storage node, using zero-knowledge proof technology; placing the homomorphic calculation and decryption links in a secure trusted execution environment. The present invention realizes the secure calculation and processing of data in an encrypted state by selecting the BFV homomorphic encryption algorithm; ensures the security of data encryption and decryption; improves the efficiency of data transmission and storage by packaging multiple homomorphic ciphertext fragments into one ciphertext; and improves the security and reliability of data storage by setting security levels and formulating slicing strategies.

Description

Technical Field

[0001] The present invention relates to the technical field of data storage security, and in particular to a terminal interactive data storage security management method and system for instant messaging. Background Art

[0002] In the field of instant messaging, with the rapid development of the Internet, users have put forward higher and higher requirements for the real-time and security of data transmission. Traditional data storage methods mostly rely on centralized storage architectures. Although they have certain reliability and security, their performance and security are insufficient when facing massive data transmission and storage. In recent years, the progress of distributed storage and encryption technology has provided new ideas for solving these problems. The emergence of homomorphic encryption technology makes it possible to perform calculations in the encrypted state of data, which is of great significance for protecting user privacy and sensitive information. At the same time, the application of trusted execution environment (TEE) technology provides an efficient solution for performing sensitive operations in untrusted environments.

[0003] However, existing technologies still have many shortcomings in data security management. First, traditional data encryption methods are mostly symmetric encryption and asymmetric encryption. Although they can ensure the confidentiality of data, they must be decrypted before data retrieval and calculation, which increases the risk of data leakage. Secondly, existing distributed storage systems have bottlenecks in data consistency and redundancy strategies, making it difficult to achieve efficient resource utilization while ensuring high data availability. In addition, traditional retrieval methods mostly rely on indexing and querying of plaintext data, making it difficult to perform efficient retrieval while ensuring data encryption. Faced with these challenges, how to perform efficient distributed storage and retrieval while ensuring data encryption has become an urgent problem to be solved.

[0004] Existing instant messaging technologies have the following problems in data storage and transmission security: on the one hand, traditional data encryption methods need to be decrypted before data retrieval and calculation, which increases the risk of data leakage; on the other hand, distributed storage systems have bottlenecks in ensuring data consistency and high availability, making it difficult to achieve efficient resource utilization. The terminal interactive data storage security management system and method for instant messaging of the present invention, through the combination of data sharding, homomorphic encryption, distributed storage, zero-knowledge proof and trusted execution environment, provides a solution for efficient storage and retrieval while ensuring data encryption, and belongs to the field of data security and distributed storage technology. Summary of the invention

[0005] The purpose of the present invention is to provide a terminal interactive data storage security management method and system for instant messaging to solve the problems raised in the above background technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a terminal interactive data storage security management method for instant messaging, comprising: slicing the data to be stored on the terminal client, dividing the data into multiple data fragments, each data fragment containing only a part of the original data; encrypting the data fragments using homomorphic encryption technology to generate ciphertext data fragments; dispersing and storing the homomorphically encrypted ciphertext data fragments on different storage nodes, with each node storing only a part of the fragments; when retrieving data, collecting corresponding ciphertext data fragments from each storage node, and using zero-knowledge proof technology on the client to prove the right to obtain the data fragments; to enhance security, performing homomorphic computing and decryption steps in a secure trusted execution environment to prevent potential software attacks.

[0007] As a preferred solution of the terminal interactive data storage security management method for instant messaging of the present invention, wherein: the data to be stored is segmented at the terminal client to divide the data into multiple data segments, including:

[0008] Based on the hash function and the shard key, a shard function f(key)=hash(key)mod m is constructed to split the original data into original data fragments, where f(key) represents the shard number, mod represents the remainder sign; m is the number of original data fragments, key is the value of the shard key, hash(key) represents the hash value corresponding to the shard key value key in the hash table, and any i-th original data fragment is recorded as D i ; The shard key is a key field used to shard the original data, including ID and timestamp.

[0009] Extract the shard key value of each piece of original data, and input the shard key value into the hash function MD5 to obtain a hash value; take the hash value modulo the number of original data fragments m, apply the shard function to the data, and calculate the shard number to which it belongs; the shard number is the shard number to which the original data belongs, and is added to the original data fragment D with the corresponding number. i middle.

[0010] As a preferred solution of the terminal interactive data storage security management method for instant messaging described in the present invention, wherein: the encryption using homomorphic encryption technology to generate ciphertext data fragments includes:

[0011] Select the BFV homomorphic encryption algorithm; use the BFV key generation algorithm to generate a public key pk and a private key sk; the public key pk is used for encryption, and the private key sk is used for decryption.

[0012] The data segment D is converted into i Convert to a polynomial form that can be processed by the BFV encryption algorithm:

[0013] E(D i )=encode(D i )

[0014] Furthermore, for each encoded data segment D i , encrypt using the BFV homomorphic encryption algorithm and public key pk, and generate the corresponding homomorphic ciphertext fragment C i ,include:

[0015] c i =Encrypt(pk, E(D i ))=([a·s+e+E(D i )]q,[-a]q)

[0016] Among them, a is a random polynomial, s is the key, e is the error term; q is the ciphertext modulus.

[0017] The encrypted ciphertext c i Associated with the shard number in step S100 to form the final homomorphic ciphertext fragment C i .

[0018] Using the data packing function of BFV, multiple homomorphic ciphertext fragments are packed into one ciphertext.

[0019] As a preferred solution of the terminal interactive data storage security management method for instant messaging of the present invention, wherein: the data packaging function of BFV is used to package multiple homomorphic ciphertext fragments, including:

[0020] Determine the number x of independent messages to pack in one ciphertext, and choose the polynomial modulus φ T (x), where T is the degree of the ring polynomial, which is a power of 2.

[0021] Make sure that the BFV parameter settings support the packaging of x independent messages;

[0022] For each homomorphic ciphertext fragment C i , extract the actual ciphertext data c i ;

[0023] Each c i Expressed in the form of two polynomials (c0, i, c1, i);

[0024] For each ciphertext c i Assign a packing position j (0≤j <x);

[0025] Construct the packing polynomial P(X)=c0,1+c0,2·X (T / x) +c0,3·X (2T / x)+...+c0,z·X ((x-1)T / x) ;

[0026] Similarly, construct the packing polynomial Q(X) = c1,1+c1,2·X (T / x) +c1,3·X (2T / x) +...+c1,z·X ((x -1)T / x) ;

[0027] Packed ciphertext C = (P(X), Q(X));

[0028] Stores packing information, including the position of each original ciphertext fragment in the packed ciphertext.

[0029] As a preferred solution of the terminal interactive data storage security management method for instant messaging of the present invention, the step S200 further includes:

[0030] Design noise function Noise(C i ), the formula is Noise(C i )=w·n+g·q+h·p+l·t;Design the re-encoded noise function Noise′(C i ), the formula is:

[0031]

[0032] Where K is the noise reduction factor; r is the number of recoding times; w is the noise growth factor associated with the ring mode n; g is the noise growth coefficient related to the modulus q; h is the noise growth coefficient related to the flat modulus p; 1 is the noise growth coefficient related to the time t; C i is the i-th homomorphic ciphertext fragment;

[0033] By calculating the re-encoded noise value, we can evaluate the degree of noise growth during the BFV homomorphic encryption process:

[0034] Measure the noise level after each operation and record the noise growth trend;

[0035] Draw the noise growth curve, analyze the influence of each parameter on the noise growth, and determine the critical point of noise growth;

[0036] Based on the analysis results, try different K and r values ​​to observe the effect of noise reduction; select K and r values ​​that can significantly reduce noise without excessively affecting performance.

[0037] As a preferred solution of the terminal interactive data storage security management method for instant messaging of the present invention, the step S300 includes:

[0038] Set the security level and determine the number of storage nodes to be used based on the security level. The security levels include:

[0039] Low security level: basic data backup and recovery capabilities. Generally, data is stored on a small number of nodes.

[0040] Medium security level: data requires certain privacy protection and redundancy, usually requiring multiple nodes to store data;

[0041] High security level: highly confidential data requires strong redundancy and privacy protection, data is stored on more nodes, and more complex encryption and sharding strategies are adopted;

[0042] The storage nodes include cloud storage and distributed storage clusters; a sharding strategy is formulated to distribute the ciphertext data fragments to the storage nodes; the sharding strategy includes:

[0043] Use multi-node storage to avoid single point of failure and store sensitive data on different nodes to improve security;

[0044] Implement data redundancy and store the same data fragments on multiple nodes;

[0045] Set up active and standby nodes to ensure high data availability;

[0046] According to the sharding strategy, a node mapping table is generated to record the corresponding node where each ciphertext data fragment is stored, as follows:

[0047] Collect information about all available storage nodes, including type, capacity, and performance; classify nodes according to their characteristics, such as high-performance nodes and large-capacity nodes;

[0048] Record encrypted data fragments, including size, importance, and access frequency;

[0049] Based on the sharding strategy, an initial storage node is allocated for each data fragment; redundant storage is set for important data, and copies are stored on multiple nodes;

[0050] Create a table and record each data fragment and its corresponding storage node; securely store the mapping table itself to ensure its integrity and availability;

[0051] Traversing the homomorphically encrypted ciphertext data fragments, and transmitting each fragment to the corresponding storage node using a secure data transmission channel according to the node mapping table;

[0052] After receiving the ciphertext data fragment, the storage node stores it in a designated storage medium; monitors the online status and available storage space of each storage node, and switches to other nodes if a node fails.

[0053] As a preferred solution of the terminal interactive data storage security management method for instant messaging of the present invention, the step S400 includes:

[0054] The client sends a data retrieval request and specifies the identification information to be retrieved; based on the identification information, the node mapping table is queried to locate the storage node, and the storage node is requested to return the stored ciphertext data fragment; the storage node checks the legality of the request, and if it is legal, the stored ciphertext data fragment is returned; if it is not legal, the request is rejected and no data is returned;

[0055] The client constructs zero-knowledge proof technology based on access rights, using non-interactive zero-knowledge proof technology zk-SNARKs; submits the constructed zero-knowledge proof to the system, and uses the verifier to verify the submitted zero-knowledge proof; if the proof is valid, the collected ciphertext data fragments are sent to the client;

[0056] After receiving the ciphertext data fragment, the client uses the private key to decrypt the ciphertext data fragment, reassembles it into the complete original data, performs retrieval, and returns it to the user;

[0057] According to the search requirements, a suitable index structure is selected to index the decrypted source data; the source data is preprocessed; the user inputs the search conditions, the system receives and parses the search request, converts it into an executable query statement, and performs a search in the source data according to the index structure and the query statement;

[0058] Sort search results by relevance, using additional filters such as time range and data type; paginate search results; cache commonly used search results to improve response speed for subsequent similar queries; implement cache invalidation mechanisms to ensure timely data updates; perform secondary security checks on search results to ensure that data that the user does not have access to is not returned.

[0059] As a preferred solution of the terminal interactive data storage security management method for instant messaging of the present invention, the performing of the retrieval includes:

[0060] Suppose the formula for performing the search is:

[0061]

[0062] Among them, G is the search result value finally returned to the user; y is the number of decrypted data fragments; R i is the retrieval matching degree of the i-th decrypted data segment; δ(S, Q) is the matching function between the S-th index term and the query Q; W S is the weight of the Sth index word in the entire data; s is the total number of index words; M iis the size of the i-th decrypted data fragment.

[0063] The matching function δ(S, Q) is defined as:

[0064]

[0065] The query Q represents the search keywords and conditions input by the user.

[0066] This value represents the cumulative matching degree of each data fragment under a specific query condition. Through this value, the system can further optimize the return and decryption operation of the query results; the retrieval step is performed to provide an efficient, accurate, and flexible data access mechanism while ensuring data security and privacy, meet the specific needs of users, and optimize the overall system performance and user experience; the larger the G value, the higher the matching degree and the more relevant the query results.

[0067] As a preferred solution of the terminal interactive data storage security management method for instant messaging of the present invention, the step S500 includes:

[0068] Select TEE technology, such as Intel SGX, and configure the hardware and operating system; ensure that TEE is enabled and configured correctly;

[0069] Loading a security module and library in the trusted execution environment; the security module includes an encryption algorithm library for homomorphic computing and decryption; using a signature verification mechanism to ensure that the loaded module has not been tampered with; encrypting sensitive data at the client and data source to generate ciphertext data fragments; encrypting data using a public key encryption algorithm; transmitting the encrypted data fragments to the server via a secure transmission protocol;

[0070] On the server side, enter the trusted execution environment to ensure that sensitive operations are performed in an isolated and secure environment; load the encrypted data fragments transmitted to the server into the TEE to ensure that the data is not visible outside the TEE; in the TEE, use the homomorphic encryption algorithm to perform the required calculations on the ciphertext;

[0071] Load the private key for decryption operation in TEE; ensure that the private key is only available in TEE to prevent external access; use the private key to decrypt the calculation result in TEE to generate the original data or the plain text form of the calculation result; perform necessary processing and formatting on the decrypted data in TEE; transmit the decrypted data back to the client through a secure transmission protocol.

[0072] The present invention also provides a terminal interactive data storage security management system for instant messaging, including a data sharding processing module, which uses a hash sharding algorithm to divide the original data into multiple fragments to ensure uniform data distribution and reliable storage; a homomorphic encryption module, which uses a BFV homomorphic encryption algorithm to encrypt the data fragments to ensure security during data transmission and storage; a ciphertext packaging module, which is used to package multiple homomorphic ciphertext fragments into one ciphertext to improve storage and transmission efficiency; a storage node management module, which is used to select appropriate storage nodes according to the security level, and formulate data sharding and redundancy strategies to ensure high data availability and security; a data retrieval module, which is used to locate and retrieve stored ciphertext data fragments based on client retrieval requests, decrypt and reorganize the original data, and perform retrieval operations; a trusted execution environment (TEE) module, which is used to perform encryption and decryption operations of sensitive data in the TEE to ensure the security of the computing process and data transmission.

[0073] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: by selecting the BFV homomorphic encryption algorithm, secure calculation and processing of data in an encrypted state is achieved; by generating public keys and private keys, the security of data encryption and decryption is ensured; by packaging multiple homomorphic ciphertext fragments into one ciphertext, the efficiency of data transmission and storage is improved; by setting security levels and formulating sharding strategies, the security and reliability of data storage are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0075] in:

[0076] Figure 1 The present invention is a flowchart of a method for securely managing terminal interactive data storage for instant messaging according to an embodiment of the present invention. DETAILED DESCRIPTION

[0077] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0078] See also Figure 1 The present invention provides a terminal interactive data storage security management method for instant messaging, comprising:

[0079] S100: Slice the original data to be stored at the terminal client, and divide the original data into original data segments.

[0080] Specifically, a sharding function f(key)=hash(key)mod m is constructed based on the hash function and the sharding key to divide the original data into original data fragments, where f(key) represents the sharding number, mod represents the remainder sign; m is the number of original data fragments, key is the value of the sharding key, hash(key) represents the hash value corresponding to the value of the sharding key key in the hash table, and any i-th original data fragment is recorded as D i ; The shard key is a key field used to shard the original data, including ID and timestamp.

[0081] Extract the shard key value of each piece of original data, and input the shard key value into the hash function MD5 to obtain a hash value; take the hash value modulo the number of original data fragments m, apply the shard function to the data, and calculate the shard number to which it belongs; the shard number is the shard number to which the original data belongs, and is added to the original data fragment D with the corresponding number. i middle.

[0082] For example, let the shard key be the user ID: "user111", the hash value hash(key) corresponding to the shard key value in the hash table is 20, the original data fragment m is 7, and after substituting it into the shard function, f(key) is 6, then the original data is added to the sixth data fragment D6.

[0083] S200: Encrypt the original data fragment using homomorphic encryption technology to generate a ciphertext data fragment.

[0084] Specifically, the BFV homomorphic encryption algorithm is selected; the public key pk and the private key sk are generated using the BFV key generation algorithm; the public key pk is used for encryption, and the private key sk is used for decryption.

[0085] The data segment D is converted into i Convert to a polynomial form that can be processed by the BFV encryption algorithm:

[0086] E(D i )=encode(D i )

[0087] Furthermore, for each encoded data segment D i , encrypt using the BFV homomorphic encryption algorithm and public key pk, and generate the corresponding homomorphic ciphertext fragment C i ,include:

[0088] c i =Encrypt(pk, E(D i ))=([a·s+e+E(D i )]q,[-a]q)

[0089] Among them, a is a random polynomial, s is the key, e is the error term; q is the ciphertext modulus.

[0090] The encrypted ciphertext c i Associated with the shard number in step S100 to form the final homomorphic ciphertext fragment C i .

[0091] S201: Using the data packing function of BFV, multiple homomorphic ciphertext fragments are packed into one ciphertext.

[0092] Specifically, according to the size of the data (number of bits) and resources (memory, CPU), determine the number of independent messages x packed in a ciphertext and select the polynomial modulus φ T (x), T is the degree of the ring polynomial, which is a power of 2.

[0093] Make sure that the BFV parameter settings support the packaging of x independent messages;

[0094] For each homomorphic ciphertext fragment C i , extract the actual ciphertext data c i ;

[0095] Each c i Expressed in the form of two polynomials (c0, i, c1, i);

[0096] For each ciphertext c i Assign a packing position j (0≤j<x);

[0097] Construct the packing polynomial P(X)=c0,1+c0,2·X (T / x) +c0,3·X (2T / x) +...+c0,z·X ((x-1)T / x) ;

[0098] Similarly, construct the packing polynomial Q(X) = c1,1+c1,2·X (T / x) +c1,3·X (2T / x) +...+c1,z·X ((x -1)T / x) ;

[0099] Packed ciphertext C = (P(X), Q(X));

[0100] Stores packing information, including the position of each original ciphertext fragment in the packed ciphertext.

[0101] S202: Design a noise function.

[0102] Specifically, the noise function Noise(C i ), the formula is Noise(C i )=w·n+g·q+h·p+l·t;Design the re-encoded noise function Noise′(C i ), the formula is:

[0103]

[0104] Where K is the noise reduction factor; r is the number of recoding times; w is the noise growth factor associated with the ring mode n; g is the noise growth coefficient related to the modulus q; h is the noise growth coefficient related to the flat modulus p; l is the noise growth coefficient related to the time t; C i is the i-th homomorphic ciphertext fragment;

[0105] By calculating the re-encoded noise value, we can evaluate the degree of noise growth during the BFV homomorphic encryption process:

[0106] Measure the noise level after each operation and record the noise growth trend;

[0107] Draw the noise growth curve, analyze the influence of each parameter on the noise growth, and determine the critical point of noise growth;

[0108] Furthermore, according to the analysis results, different K values ​​and r values ​​are tried to observe the effect of noise reduction; K values ​​and r values ​​that can significantly reduce noise but do not excessively affect performance are selected.

[0109] For example, assume that the noise reduction coefficient K is 2, the number of re-encoding times r is 3, the noise growth coefficient w is 3, the ring modulus n is 4, the noise growth coefficient g is 2, the modulus q is 7, the noise growth coefficient h is 5, the flat modulus p is 6, the noise growth coefficient l is 1, and the time t is 8.

[0110] Substituting into the formula, we get the noise function Noise(C i )=3×4+2×7+5×6+1×8=64, then the re-encoded noise function Find the combination of K and r that significantly reduces the noise value, and among the combinations that significantly reduce the noise, select the combination with the smallest performance loss.

[0111] S300: The homomorphically encrypted ciphertext data fragments are stored in different storage nodes in a distributed manner.

[0112] Specifically, a security level is set, and the number of storage nodes to be used is determined according to the security level. The security level includes:

[0113] Low security level: basic data backup and recovery capabilities. Generally, data is stored on a small number of nodes.

[0114] Medium security level: data requires certain privacy protection and redundancy, usually requiring multiple nodes to store data;

[0115] High security level: highly confidential data requires strong redundancy and privacy protection, data is stored on more nodes, and more complex encryption and sharding strategies are adopted;

[0116] Furthermore, the storage nodes include cloud storage and distributed storage clusters; a sharding strategy is formulated to distribute the ciphertext data fragments to the storage nodes; the sharding strategy includes:

[0117] Use multi-node storage to avoid single point of failure and store sensitive data on different nodes to improve security;

[0118] Implement data redundancy and store the same data fragments on multiple nodes;

[0119] Set up active and standby nodes to ensure high data availability;

[0120] Furthermore, according to the sharding strategy, a node mapping table is generated to record the corresponding node where each ciphertext data fragment is stored, as follows:

[0121] Collect information about all available storage nodes, including type, capacity, and performance; classify nodes according to their characteristics, such as high-performance nodes and large-capacity nodes;

[0122] Record encrypted data fragments, including size, importance, and access frequency;

[0123] Based on the sharding strategy, an initial storage node is allocated for each data fragment; redundant storage is set for important data, and copies are stored on multiple nodes;

[0124] Create a table and record each data fragment and its corresponding storage node; securely store the mapping table itself to ensure its integrity and availability;

[0125] Traversing the homomorphically encrypted ciphertext data fragments, and transmitting each fragment to the corresponding storage node using a secure data transmission channel according to the node mapping table;

[0126] After receiving the ciphertext data fragment, the storage node stores it in a designated storage medium; monitors the online status and available storage space of each storage node, and switches to other nodes if a node fails.

[0127] S400: When retrieving the original data, the corresponding ciphertext data fragments are collected from each storage node, and the zero-knowledge proof technology is used on the client to prove the right to obtain the ciphertext data fragments.

[0128] Specifically, the client sends a data retrieval request and provides an identity credential (such as a digital signature, token or certificate) to indicate the identification information to be retrieved; based on the identification information, the node mapping table is queried to locate the storage node, and the storage node is required to return the stored ciphertext data fragment; the storage node checks the legitimacy of the request through the identity credential, and if it is legitimate, the stored ciphertext data fragment is returned; if it is not legitimate, the request is rejected and no data is returned;

[0129] The client constructs zero-knowledge proof technology based on access rights, using non-interactive zero-knowledge proof technology zk-SNARKs; submits the constructed zero-knowledge proof to the system, and uses the verifier to verify the submitted zero-knowledge proof; if the proof is valid, the collected ciphertext data fragments are sent to the client;

[0130] After receiving the ciphertext data fragment, the client uses the private key to decrypt the ciphertext data fragment, reassembles it into the complete original data, performs retrieval, and returns it to the user;

[0131] According to the search requirements (query type, query frequency), select a suitable index structure and create an index for the decrypted source data; pre-process the source data; the user inputs the search conditions, the system receives and parses the search request, converts it into an executable query statement, and performs a search in the source data according to the index structure and the query statement;

[0132] Furthermore, B-tree and B+-tree indexes are suitable for retrieval requirements that support range queries and exact matches; hash indexes are suitable for retrieval requirements that support exact match queries and fast query speeds.

[0133] Sort search results by relevance, using additional filters such as time range and data type; paginate search results; cache commonly used search results to improve response speed for subsequent similar queries; implement cache invalidation mechanisms to ensure timely data updates; perform secondary security checks on search results to ensure that data that the user does not have access to is not returned.

[0134] Furthermore, the secondary security check includes the following: checking whether the user has the authority to access specific data items; verifying whether the user role is in the list of roles allowed to access; confirming whether the user is the owner of the data; checking whether the user has special permissions; recording the user's access attempts, including successful and failed attempts; recording the time of access, data items, user information, etc.

[0135] S401: Set a formula for executing retrieval to further optimize the return and decryption operations of the query results.

[0136] Suppose the formula for performing the search is:

[0137]

[0138] Among them, G is the search result value finally returned to the user; y is the number of decrypted data fragments; R i is the retrieval matching degree of the i-th decrypted data segment; δ(S, Q) is the matching function between the S-th index term and the query Q; W S is the weight of the Sth index word in the entire data; s is the total number of index words; M i is the size of the i-th decrypted data fragment.

[0139] The matching function δ(S, Q) is defined as:

[0140]

[0141] The query Q represents the search keywords and conditions input by the user.

[0142] For example, assuming that the size of the fifth decrypted data fragment is 100, the retrieval matching degree is 5, the number of decrypted fragments is 5, and the query Q contains the first index term, substituting into the formula, G is 0.25.

[0143] This value represents the cumulative matching degree of each data fragment under a specific query condition. Through this value, the system can further optimize the return and decryption operation of the query results; the retrieval step is performed to provide an efficient, accurate, and flexible data access mechanism while ensuring data security and privacy, meet the specific needs of users, and optimize the overall system performance and user experience; the larger the G value, the higher the matching degree and the more relevant the query results.

[0144] S500: Perform homomorphic computing and decryption in a secure trusted execution environment

[0145] Select TEE technology, such as Intel SGX, and configure the hardware and operating system; ensure that TEE is enabled and configured correctly;

[0146] Loading a security module and library in the trusted execution environment; the security module includes an encryption algorithm library for homomorphic computing and decryption; using a signature verification mechanism to ensure that the loaded module has not been tampered with; encrypting sensitive data at the client and data source to generate ciphertext data fragments; encrypting data using a public key encryption algorithm; transmitting the encrypted data fragments to the server via a secure transmission protocol;

[0147] On the server side, enter the trusted execution environment to ensure that sensitive operations are performed in an isolated and secure environment; load the encrypted data fragments transmitted to the server into the TEE to ensure that the data is not visible outside the TEE; in the TEE, use the homomorphic encryption algorithm to perform the required calculations on the ciphertext;

[0148] Load the private key for decryption operation in TEE; ensure that the private key is only available in TEE to prevent external access; use the private key to decrypt the calculation result in TEE to generate the original data or the plain text form of the calculation result; perform necessary processing and formatting on the decrypted data in TEE; transmit the decrypted data back to the client through a secure transmission protocol.

[0149] The present embodiment also provides a terminal interactive data storage security management system for instant messaging, including: a data sharding processing module, which uses a hash sharding algorithm to divide the original data into multiple fragments to ensure uniform data distribution and reliable storage; a homomorphic encryption module, which uses a BFV homomorphic encryption algorithm to encrypt data fragments to ensure security during data transmission and storage; a ciphertext packaging module, which is used to package multiple homomorphic ciphertext fragments into one ciphertext to improve storage and transmission efficiency; a storage node management module, which is used to select appropriate storage nodes according to the security level, and formulate data sharding and redundancy strategies to ensure high data availability and security; a data retrieval module, which is used to locate and retrieve stored ciphertext data fragments based on client retrieval requests, decrypt and reorganize the original data, and perform retrieval operations; a trusted execution environment (TEE) module, which is used to perform encryption and decryption operations of sensitive data in TEE to ensure the security of computing processes and data transmission.

[0150] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0151] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A terminal interactive data storage security management method for instant messaging, characterized in that: The method comprises the following steps: Step S100: Slice the original data to be stored at the terminal client, and divide the original data into original data segments; Step S200: Encrypting the original data fragment using homomorphic encryption technology to generate a ciphertext data fragment; Step S300: Distribute and store the homomorphically encrypted ciphertext data fragments on different storage nodes; Step S400: when retrieving the original data, collect the corresponding ciphertext data fragments from each storage node, and use zero-knowledge proof technology on the client to prove the right to obtain the ciphertext data fragments; Step S500: Perform homomorphic computing and decryption in a secure trusted execution environment; The step S200 includes: Select the BFV homomorphic encryption algorithm; use the BFV key generation algorithm to generate a public key pk and a private key sk; the public key pk is used for encryption, and the private key sk is used for decryption; The data segment D is converted into i Convert to a polynomial form that can be processed by the BFV encryption algorithm: E(D i )=encode(D i ) Among them, E(D i ) is the encoded data segment; For each encoded data segment E(D i ), encrypt using the BFV homomorphic encryption algorithm and public key pk, and generate the corresponding homomorphic ciphertext fragment C i ,include: c i =Encrypt(pk,E(D i ))=([a·s+e+E(D i )]q,[-a]q) Where a is a random polynomial, s is the key, e is the error term, q is the ciphertext modulus; The encrypted ciphertext c i Associated with the shard number in step S100 to form the final homomorphic ciphertext fragment C i ; Using the data packing function of BFV, multiple homomorphic ciphertext fragments are packed into one ciphertext; The method of utilizing the data packing function of BFV to pack multiple homomorphic ciphertext segments into one ciphertext includes: Determine the number x of independent messages to pack in one ciphertext, and choose the polynomial modulus φ T (x), where T is the degree of the ring polynomial; Make sure that the BFV parameter settings support the packaging of x independent messages; For each homomorphic ciphertext fragment C i , extract the actual ciphertext data c i ; Each c i Expressed in the form of two polynomials (c0,i,c1,i); For each ciphertext c i Assign a packing position j; Construct the packing polynomial P(X)=c0,1+c0,2·X (T / x) +c0,3·X (2T / x) +...+c0,z·X ((x-1)T / x) ; Similarly, construct the packing polynomial Q(X) = c1,1 + c1,2·X (T / x) +c1,3·X (2T / x) +...+c1,z·X ((x-1)T / x) ; Packed ciphertext C = (P(X), Q(X)); Store packing information, including the position of each original ciphertext fragment in the packed ciphertext; The S200 further includes: Design noise function Noise(C i ), the formula is Noise(C i )=w·n+g·q+h·p+l·t;Design the re-encoded noise function Noise′(C i ), the formula is: Where K is the noise reduction coefficient; r is the number of recodings; w is the noise growth coefficient associated with the ring modulus n; g is the noise growth coefficient associated with the modulus q; h is the noise growth coefficient associated with the flat modulus p; l is the noise growth coefficient associated with time t; C i is the i-th homomorphic ciphertext fragment; By calculating the re-encoded noise value, we can evaluate the degree of noise growth during the BFV homomorphic encryption process: Measure the noise level after each operation and record the noise growth trend; Draw the noise growth curve, analyze the influence of each parameter on the noise growth, and determine the critical point of noise growth; According to the analysis results, try different K and r values ​​to observe the effect of noise reduction; The step S300 includes: Set a security level and determine the number of storage nodes to be used according to the security level, wherein the security level includes: low security level; medium security level; high security level; The storage nodes include cloud storage and distributed storage clusters; a sharding strategy is formulated to distribute the ciphertext data fragments to the storage nodes; the sharding strategy includes: Use multi-node storage and store sensitive data on different nodes; Implement data redundancy and store the same data fragments on multiple nodes; Set up active and standby nodes to ensure high data availability; According to the sharding strategy, a node mapping table is generated to record the corresponding node where each ciphertext data fragment is stored, as follows: Collect information about all available storage nodes, including type, capacity, and performance; classify nodes according to their characteristics, including high-performance nodes and large-capacity nodes; Record encrypted data fragments, including size, importance, and access frequency; Based on the sharding strategy, an initial storage node is allocated for each data fragment; redundant storage is set for important data, and copies are stored on multiple nodes; Create a table and record each data fragment and its corresponding storage node Traversing the homomorphically encrypted ciphertext data fragments, and transmitting each fragment to the corresponding storage node using a secure data transmission channel according to the node mapping table; After receiving the encrypted data fragment, the storage node stores it in a designated storage medium; monitors the online status and available storage space of each storage node, and switches to other nodes if a node fails; The step S400 includes: The client sends a data retrieval request and specifies the identification information to be retrieved; based on the identification information, the node mapping table is queried to locate the storage node, and the storage node is requested to return the stored ciphertext data fragment; the storage node checks the legality of the request, and if it is legal, the stored ciphertext data fragment is returned; if it is not legal, the request is rejected and no data is returned; The client constructs zero-knowledge proof technology based on access rights, using non-interactive zero-knowledge proof technology zk-SNARKs; submits the constructed zero-knowledge proof to the system, and uses the verifier to verify the submitted zero-knowledge proof; if the proof is valid, the collected ciphertext data fragments are sent to the client; After receiving the ciphertext data fragment, the client uses the private key to decrypt the ciphertext data fragment, reassembles it into the complete original data, performs retrieval, and returns it to the user; According to the search requirements, a suitable index structure is selected to index the decrypted source data; the source data is preprocessed; the user inputs the search conditions, the system receives and parses the search request, converts it into an executable query statement, and performs a search in the source data according to the index structure and the query statement; Sort search results by relevance, using additional filters, including time range and data type; paginate search results; cache commonly used search results to improve response speed for subsequent similar queries; implement cache invalidation mechanisms to ensure timely data updates; The performing of the search comprises: Suppose the formula for performing the search is: Among them, G is the search result value finally returned to the user; y is the number of decrypted data fragments; R i is the retrieval matching degree of the i-th decrypted data segment; δ(S, Q) is the matching function between the S-th index term and the query Q; W s is the weight of the Sth index word in the entire data; s is the total number of index words; M i is the size of the i-th decrypted data fragment; The matching function δ(S, Q) is defined as: The query Q represents the search keywords and conditions input by the user.

2. The terminal interactive data storage security management method for instant messaging according to claim 1 is characterized in that: The step S100 includes: Based on the hash function and the shard key, a shard function f(key)=hash(key)mod m is constructed to split the original data into original data fragments, where f(key) represents the shard number, mod represents the remainder sign; m is the number of original data fragments, key is the value of the shard key, hash(key) represents the hash value corresponding to the shard key value key in the hash table, and any i-th original data fragment is recorded as D i ; The sharding key is a key field used to shard the original data, including ID and timestamp; Use the sharding function to calculate the sharding number to which the original data belongs, and add it to the original data fragment D with the corresponding number. i middle.

3. The terminal interactive data storage security management method for instant messaging according to claim 1 is characterized in that: The step S500 includes: Select TEE technology and configure hardware and operating system; load security modules and libraries in the trusted execution environment; the security module includes a cryptographic algorithm library for homomorphic computing and decryption; use a signature verification mechanism to ensure that the loaded module has not been tampered with; At the client and data source, sensitive data is encrypted to generate ciphertext data fragments; the encrypted data fragments are transmitted to the server via a secure transmission protocol; On the server side, enter the trusted execution environment and load the encrypted data fragments transmitted to the server into the TEE to ensure that the data is not visible outside the TEE; in the TEE, use the homomorphic encryption algorithm to perform the required calculations on the ciphertext; Load the private key for decryption operation in TEE; ensure that the private key is only available in TEE to prevent external access; use the private key to decrypt the calculation result in TEE to generate the original data or the plain text form of the calculation result; perform necessary processing and formatting on the decrypted data in TEE; transmit the decrypted data back to the client through a secure transmission protocol.

4. A terminal interactive data storage security management system for instant messaging, which executes the terminal interactive data storage security management method for instant messaging as claimed in claim 1, characterized in that: The system includes: The data sharding processing module uses the hash sharding algorithm to split the original data into multiple fragments; Homomorphic encryption module, used to encrypt data fragments using the BFV homomorphic encryption algorithm; The ciphertext packaging module is used to package multiple homomorphic ciphertext fragments into one ciphertext; The storage node management module is used to select appropriate storage nodes according to the security level and formulate data sharding and redundancy strategies; A data retrieval module is used to locate and retrieve the stored ciphertext data fragments based on the client retrieval request, decrypt and reconstruct the original data, and perform the retrieval operation; Trusted Execution Environment module, used to perform encryption and decryption operations of sensitive data in TEE.

Images