One-time key update method, system, device and readable storage medium

Abstract

This invention discloses a one-time pad storage key update method, system, device, and readable storage medium, including the use of a long-term key K. B The original plaintext is encrypted using an encryption algorithm to obtain the first encrypted ciphertext C. B Use an updatable key K S Generate a random sequence R using a sequence encryption algorithm S When updating data by encrypting the ciphertext with the updatable key, the current updatable key K is obtained. S and the new updatable key K S+1 Use the updatable key K S and K S+1 Generate random sequences R respectively S and R S+1 The update token T is calculated; the update token T is XORed with the ciphertext to be updated to obtain the ciphertext encrypted with the new key, based on the latest updatable key K. S Generate a random sequence R S The ciphertext is calculated to obtain the first-level decrypted ciphertext C. B Use long-term key K B The ciphertext C is encrypted using the block cipher algorithm used during encryption. B Decryption yields the plaintext file.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a one-time key storage key update method, system, device, and readable storage medium. Background Technology

[0002] In today's digital age, cloud storage has become increasingly common. However, with its widespread use, data security issues have become increasingly prominent. In the network environment, the security of both file transmission and storage has become a pressing problem. To address this issue, file encryption has become an important method.

[0003] To ensure system performance, the industry has made compromises in security, currently employing two main key update schemes: those based on storage platform trust and those based on digital envelope replacement. The storage platform trust-based scheme assumes the data storage platform (i.e., the cloud platform) is trustworthy. When the encrypted storage key needs updating, the storage platform directly decrypts the data using the old key and encrypts it with the new key. This avoids the communication overhead of data downloading, but the computational overhead remains significant. Furthermore, the storage key is exposed to the cloud platform, making it vulnerable to attacks from within the cloud platform. The digital envelope replacement scheme uses a long-term key to encrypt stored data, and a periodic key generated by the data owner to encrypt the long-term key (the encrypted version of the long-term key is called a "digital envelope"). The digital envelope is stored alongside the encrypted data. When a legitimate user downloads data, they obtain the decryption key for the digital envelope from the data owner and retrieve the digital envelope and encrypted data from the cloud server. After decrypting the digital envelope to obtain the long-term key, the legitimate user can decrypt the encrypted data. When a key update is needed, the data owner downloads the digital envelope, replaces its encryption key, and then re-uploads the digital envelope. This process only replaces the key protecting the long-term key; it doesn't actually update the encrypted storage key. If the storage key is leaked, the data will still be compromised. Both of these methods are widely used by cloud service providers such as Google, Amazon, and Alibaba Cloud. While they offer high performance, they cannot effectively protect data security.

[0004] To address the security issues of the aforementioned industry solutions, academia has proposed the concept of updatable encryption. In updatable encryption, the data owner only needs to generate a short update token, which allows the cloud server to re-encrypt the data based on the existing ciphertext while maintaining encryption security. Updatable encryption can directly implement ciphertext storage key rotation on the cloud server, eliminating the need for decryption and re-encryption operations, thus providing an ideal key update model.

[0005] Existing updatable encryption technologies often use decryption and re-encryption to update ciphertext. For example, patent application number CN201811364409.6, entitled "Secure and Reliable Cloud Storage Method and Apparatus Based on Updatable Encryption," involves a searcher applying for a one-time decryption token from the storage provider. The search is then performed on the server using encoded and encrypted feature vectors, and the decryption token is used to decrypt the search results. After the search is complete, the storage provider updates the key on the server-side ciphertext.

[0006] However, this current decryption-re-encryption method does not take into account the needs of large-scale data processing. In situations requiring large-scale ciphertext updates, the time overhead of decryption is enormous. When the key is updated, users need to download the file from the cloud, decrypt it using the old key, and then encrypt it again using the new key, which incurs significant time costs. Especially for large-scale, high-volume file storage systems, decrypting and re-encrypting files is impractical. Summary of the Invention

[0007] To address the problems existing in the prior art, this invention provides a one-time key storage key update method, system, device, and readable storage medium for efficiently updating data encryption keys in encrypted file storage systems for big data cloud storage.

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] One-time pad storage key update methods include,

[0010] Using long-term key K B The original plaintext is encrypted using an encryption algorithm to obtain the first encrypted ciphertext C. B ;

[0011] Use the updatable key K S Generate a random sequence R using a sequence encryption algorithm S and calculate Obtain the ciphertext encrypted with the updatable key.

[0012] When updating data, obtain the currently updatable key K. S and the new updatable key K S+1 Use the updatable key K S and K S+1 Generate random sequences R respectively S and R S+1 And calculate the update token T; use the update token T with the ciphertext to be updated Perform an XOR operation to obtain the ciphertext encrypted with the new key.

[0013] According to the latest updatable key K S Generate a random sequence R S Calculate ciphertext We obtain the ciphertext C after the first layer of decryption. B Use long-term key K B The ciphertext C is encrypted using the block cipher algorithm used during encryption. B Decryption yields the plaintext file.

[0014] Preferably, a long-term key K is used. B The original plaintext is encrypted using a block cipher algorithm to obtain the first encrypted ciphertext C. B .

[0015] Preferably, the calculation method for the update token T is to use R... S and R S+1 Perform the XOR operation, i.e.

[0016] Preferred, encrypted The calculation method involves XORing the update token T with the ciphertext to be updated, specifically:

[0017]

[0018] Preferably, when updating the key in the key management center,

[0019] During the data encryption phase, the key management center first initializes the ciphertext state S=0 and uses the key derivation function KDF to generate an updatable key K. S =KDF(K D S), and generate a random sequence R. S The key K can be updated. B and random sequence R S Send to authorized users; when authorized users encrypt data, they use the long-term key K. B The original plaintext is encrypted using a block cipher algorithm to obtain the first encrypted ciphertext C. B Then use random sequence calculation Obtain the final ciphertext

[0020] During the data update phase, the key management center first obtains the ciphertext update status S from the cloud server, and then calculates the currently updatable key K. S =KDF(K D ,S) and the new renewable key K S+1 =KDF(K D (S+1); Subsequently, the updatable key K is used respectively. S and K S+1Generate a random sequence R S and R S+1 The update token T is calculated; the update token T and the new update state S = S + 1 are sent to the cloud server; the cloud server performs subsequent ciphertext update operations to obtain the ciphertext encrypted with the new key.

[0021] During the data decryption phase, the key management center can generate the latest updatable key K based on the latest update status S and KD. S and with the long-term key K B Send the encrypted message together to the authorized user; the authorized user downloads the original encrypted message from the cloud. Use the obtained key K S and K B Decryption will yield the plaintext file.

[0022] Preferably, when updating the key for a digital envelope, the user possesses a long-term key K using block encryption. B and the key K used to derive the renewable key D ;

[0023] During the data encryption phase, the user first uses the long-term key K. B Encrypting the original plaintext yields the first encrypted ciphertext C. B Then initialize the ciphertext state S=0, and use the key derivation function KDF to generate an updatable key K. S =KDF(K D ,S), and use an updatable key K S Generate a random sequence R S and calculate Obtain the final ciphertext After encryption is complete, the user uses the public key. Encrypted ciphertext state S, long-term key K B and the key K that can be updated S and with the ciphertext Stored on a cloud server;

[0024] During the data update phase, the cloud server first uses the private key. The digital envelope is decrypted to obtain the ciphertext state S, which is then sent to the authorized user. Simultaneously, the cloud server needs to update the asymmetric key to obtain a new public key. and private key The new public key is then made public to the user; the user is authorized to update the ciphertext state S = S + 1, and then the current updateable key K is calculated. S =KDF(K D ,S) and the new renewable key K S+1 =KDF(K D(S+1), using the updatable key K according to the above data update method. S and K S+1 Perform encrypted update; authorize users to use the new public key. Encrypted ciphertext state S = S + 1 and update token and long-term key K B and the latest updatable key K S And send it to the cloud server; the cloud server uses the new private key After decryption to obtain the ciphertext state and update token, subsequent ciphertext update operations are performed to obtain the ciphertext encrypted with the new key.

[0025] During the data decryption phase, the cloud server uses the latest updated private key. Decrypt the digital envelope to obtain the ciphertext state S, and send it to the authorized user; the authorized user then decrypts the ciphertext using the data decryption method described above.

[0026] Preferably, when updating the key of the trusted platform module,

[0027] During the data encryption phase, the user will use the long-term key K. B The key KD used to derive the renewable key and the plaintext to be encrypted are sent to the TPM; the TPM will store the long-term key K. B and the key K used to derive the renewable key D The two keys are then used to encrypt the plaintext file to obtain the final ciphertext. Finally, TPM will replace the user to transfer the ciphertext state S and the ciphertext. Send to the cloud server;

[0028] During the data update phase, the user only needs to send a ciphertext update command, and the TPM will complete the ciphertext update on behalf of the user. Specifically, the TPM will obtain the ciphertext state S from the cloud server and then calculate the current update key K. S =KDF(K D ,S) and the new renewable key K S+1 =KDF(K D (S+1); Subsequently, the updatable key K is used respectively. S and K S+1 Generate a random sequence R S and R S+1 And calculate the update token TPM sends T and the new update state S = S + 1 to the cloud server; the cloud server performs subsequent ciphertext update operations to obtain the ciphertext encrypted with the new key.

[0029] During the data decryption phase, TPM obtains the ciphertext from the cloud server. Given the ciphertext state S, the ciphertext is decrypted using the data decryption method described above to obtain the plaintext file, which is then sent to the user.

[0030] A one-time key storage key update system includes a data encryption module, a data update module, and a data decryption module;

[0031] The data encryption module is used to employ a long-term key K. B and the updatable key K S Encrypting the original plaintext yields ciphertext encrypted with an updatable key.

[0032] The data update module is used to obtain the currently updatable key K when performing a data update. S and the new updatable key K S+1 Use the updatable key K S and K S+1 Generate random sequences R respectively S and R S+1 And calculate the update token T; use the update token T with the ciphertext to be updated Perform an XOR operation to obtain the ciphertext encrypted with the new key.

[0033] The data decryption module is used to decrypt the data based on the latest updatable key K. S Generate a random sequence R S Calculate ciphertext We obtain the ciphertext C after the first layer of decryption. B Use long-term key K B The ciphertext C is encrypted using the block cipher algorithm used during encryption. B Decryption yields the plaintext file.

[0034] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the one-time key update method as described in any of the preceding claims.

[0035] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the one-time key update method for storage keys as described in any of the preceding claims.

[0036] Compared with the prior art, the present invention has the following beneficial technical effects:

[0037] This invention provides a one-time pad storage key update method. By selecting block ciphers (SM4 / AES) and stream ciphers (RC4 / ZUC), it constructs an efficient encrypted storage mechanism for dynamic key updates. The nested encryption mode of block and stream ciphers achieves efficient one-time pad data access, thereby accelerating the ciphertext update speed and making it more adaptable to large-scale file storage systems. This invention successfully constructs a high-efficiency key update mechanism for a secure ciphertext storage access system. The design and implementation of this system are aimed at improving data security and availability. This invention satisfies the requirement of rapidly updating ciphertext without affecting system performance. This feature allows the new system to maintain high performance even when processing large amounts of data.

[0038] This invention provides a one-time key storage key update system that supports one-time key access for data operations. This system supports the need for encrypted updates of large-scale data in the cloud without decrypting the original file, thus meeting the demands of big data processing while maintaining good performance. Attached Figure Description

[0039] Figure 1 This is a flowchart of the one-time key update method for the storage key in an embodiment of the present invention;

[0040] Figure 2 This is a flowchart illustrating the encrypted update process in an embodiment of the present invention.

[0041] Figure 3 This is an overall architecture diagram based on a key management center in an embodiment of the present invention;

[0042] Figure 4 This is a flowchart based on a key management center in an embodiment of the present invention;

[0043] Figure 5 This is a diagram illustrating the overall architecture of the digital envelope based on an embodiment of the present invention.

[0044] Figure 6 This is a flowchart based on a digital envelope in an embodiment of the present invention;

[0045] Figure 7 This is a flowchart illustrating data encryption using digital envelopes in an embodiment of the present invention;

[0046] Figure 8 This is a diagram of the overall architecture based on TPM in an embodiment of the present invention;

[0047] Figure 9 This is a flowchart of the encrypted update process based on TPM in an embodiment of the present invention;

[0048] Figure 10 This is a comparison diagram between the present invention and the traditional mechanism. Detailed Implementation

[0049] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0050] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0051] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0052] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection, an electrical connection, or a communication connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0053] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can include direct contact between the first and second features, or contact between the first and second features through another feature between them. Furthermore, "above," "over," and "on top" of the second feature includes the first feature being directly above or diagonally above the second feature, or simply indicates that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature includes the first feature being directly above or diagonally above the second feature, or simply indicates that the first feature is at a lower horizontal level than the second feature.

[0054] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0055] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0056] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0057] The accompanying drawings illustrate various structural schematic diagrams according to embodiments disclosed in this invention. These drawings are not to scale, and some details have been enlarged for clarity, and some details may have been omitted. The shapes of the various regions and layers shown in the drawings, as well as their relative sizes and positional relationships, are merely exemplary and may deviate from reality due to manufacturing tolerances or technical limitations. Furthermore, those skilled in the art can design regions / layers with different shapes, sizes, and relative positions as needed.

[0058] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0059] like Figure 1 As shown, the one-time key update method for storage keys of the present invention mainly consists of three stages: data encryption, data update, and data decryption. The specific process is as follows:

[0060] Step 1: Data Encryption

[0061] The original data encryption mechanism uses a single block cipher algorithm and a permanent key to encrypt the original plaintext, which cannot achieve efficient key updates. However, research has shown that the XOR encryption property of stream ciphers provides updability. But encrypting multiple data items with the same key using a stream cipher does not satisfy semantic security. Therefore, a nested encryption mode is designed, using block ciphers to ensure semantic security and stream ciphers to ensure updability.

[0062] Nested encryption primarily uses two types of keys: one is a long-term key K used in block ciphers. B One is the updatable key K used for stream ciphers. S When encrypting data: First, use the long-term key K. B The original plaintext is encrypted using a block cipher algorithm (such as SM4, AES, etc.) to obtain the first encrypted ciphertext C. B Subsequently, the updatable key K is used. S Generate a random sequence R using sequence encryption algorithms (such as ZUC, RC4, etc.). S and calculate Obtain the final ciphertext

[0063] Step 2: Data Update

[0064] When data updates are needed, the currently available update key K is first obtained. S and the new updatable key K S+1 Subsequently, the updatable key K was used respectively. S and K S+1 Generate a random sequence R S and R S+1 And calculate the update token T, which is calculated by taking R S and R S+1 Perform the XOR operation, i.e. like Figure 2 As shown, by performing an XOR operation between the update token T and the ciphertext to be updated, we obtain...

[0065]

[0066] This is the ciphertext encrypted with the new key. This mechanism utilizes the property of XOR, where XORing a number with itself results in 0. Therefore, it can efficiently update the ciphertext without downloading and decrypting the original ciphertext.

[0067] Step 3: Data Decryption

[0068] The decryption process is the reverse of the encryption process, that is, based on the latest updatable key K. S Generate a random sequence R S ,calculate We obtain the ciphertext C after the first layer of decryption. BSecondly, use the permanent key K. B Using the block cipher algorithm used during encryption to encrypt C B Decryption will yield the plaintext file.

[0069] This invention uses block ciphers (SM4 / AES) and stream ciphers (RC4 / ZUC) to construct an efficient encrypted storage mechanism with dynamic key updates. It uses a nested encryption mode of block ciphers and stream ciphers to achieve efficient data access with "one-time pad", thereby accelerating the speed of ciphertext updates and making it more suitable for large-scale file storage systems.

[0070] The application scenarios of this invention are mainly divided into three types: key update based on key management center, key update based on data envelope, and key update based on TPM (Trusted Platform Module).

[0071] Example 1

[0072] When the use case is a key management center, key updates based on the key management center include the following steps.

[0073] This scenario introduces the role of a key management center. The key management center secretly stores two keys long-term, such as... Figure 3 As shown, one is a long-term key K using block cipher. B One is the key K used to derive the updatable key. D In the subsequent key update phase, only K needs to be used. D The key can be updated with the number of updates, while the long-term key K is retained. B That's it. The overall flowchart is as follows: Figure 4 As shown.

[0074] During the data encryption phase, the key management center first initializes the ciphertext state S=0 and uses the key derivation function KDF to generate an updatable key K. S =KDF(K D Using the key, a random sequence R is generated using a sequence encryption algorithm. S , will K B and R S Send to authorized users. When users need to encrypt data, they use the long-term key K. B The original plaintext is encrypted using a block cipher algorithm to obtain the first encrypted ciphertext C. B Then use random sequence calculation Obtain the final ciphertext

[0075] During the data update phase, the key management center first obtains the ciphertext update status S from the cloud server, and then calculates the currently updatable key K. S =KDF(KD ,S) and the new renewable key K S+1 =KDF(K D (S+1). Subsequently, the updatable key K is used respectively. S and K S+1 Generate a random sequence R S and R S+1 And calculate the update token T, which is calculated by taking R S and R S+1 Perform the XOR operation, i.e. The system sends T and the new update state S = S + 1 to the cloud server. The cloud server then performs subsequent ciphertext update operations to obtain the ciphertext encrypted with the new key.

[0076] During the data decryption phase, the key management center updates the status S and K based on the latest status. D This will generate the latest updatable key K. S and with the long-term key K B Send it together to the authorized user. The authorized user then downloads the original encrypted text from the cloud. Use the obtained key K S and K B Decryption will yield the plaintext file.

[0077] Example 2

[0078] When the use case is a digital envelope, key updates based on a digital envelope include the following steps, where the key is protected using a digital envelope method.

[0079] The original digital envelope process involved the sender encrypting data M using a symmetric key K, and then using a public key K. pub The ciphertext is encrypted using the symmetric key K, and finally, the encrypted data and the ciphertext are sent together to the recipient. When data decryption is needed, the recipient uses their own private key K. pri Decrypt the symmetric key ciphertext, then use the decrypted symmetric key to decrypt the data ciphertext to obtain the original data. The original process, during key updates, only changed the asymmetric key K used for digital envelope protection. pub and K pri The update is performed, thereby updating the symmetric key ciphertext, but not the data ciphertext.

[0080] In this scenario, updating the key also synchronously updates the ciphertext. The digital envelope needs to protect the ciphertext state S and store it along with the ciphertext on the cloud server. Its overall architecture diagram is as follows: Figure 5 As shown, the specific process is as follows: Figure 6 As shown.

[0081] The user possesses a long-term key K used for block ciphers.B and the key K used to derive the renewable key D .

[0082] During the data encryption phase, the user first uses the long-term key K. B Encrypting the original plaintext yields the first encrypted ciphertext C. B Then initialize the ciphertext state S=0, and use the key derivation function KDF to generate an updatable key K. S =KDF(K D ,S), and use an updatable key K S Generate a random sequence R S and calculate Obtain the final ciphertext After encryption is complete, the user uses the public key. Encrypted ciphertext state S, long-term key K B and the key K that can be updated S and with the ciphertext Stored on a cloud server.

[0083] During the data update phase, the cloud server first uses the private key. The digital envelope is decrypted to obtain the ciphertext state S, which is then sent to the authorized user. Simultaneously, the cloud server needs to update the asymmetric key to obtain the new public key. and private key The new public key is then made public to the user. The authorized user updates the ciphertext state S = S + 1, and then calculates the current updateable key K. S =KDF(K D ,S) and the new renewable key K S+1 =KDF(K D (S+1), using the updatable key K according to the above data update method. S and K S+1 Perform a encrypted update. Authorize users to use the new public key. Encrypted ciphertext state S = S + 1 and update token and long-term key K B and the latest updatable key K S And then send it to the cloud server. The cloud server uses the new private key. After decryption to obtain the ciphertext state and update token, subsequent ciphertext update operations are performed to obtain the ciphertext encrypted with the new key.

[0084] During the data decryption phase, the cloud server uses the latest updated private key. The digital envelope is decrypted to obtain the ciphertext state S, which is then sent to the authorized user. The authorized user then decrypts the ciphertext using the data decryption method described above.

[0085] Example 3

[0086] When the use case is TPM (Trusted Platform Module), key updates based on TPM include the following steps:

[0087] This scenario introduces a Trusted Platform Module (TPM) for key management and ciphertext updates. Users only need to send a ciphertext update command, and the TPM will handle the interaction with the cloud server and the related ciphertext update operations. The overall architecture diagram is as follows: Figure 8 As shown, the overall flowchart is as follows: Figure 9 As shown.

[0088] During the data encryption phase, the user will use the long-term key K. B Key K used to derive an updatable key D The plaintext that needs to be encrypted is sent to the TPM. The TPM stores the long-term key K. B and the key K used to derive the renewable key D The two keys are then used to encrypt the plaintext file to obtain the final ciphertext. Finally, TPM will replace the user to transfer the ciphertext state S and the ciphertext. Send to the cloud server.

[0089] During the data update phase, the user only needs to send a ciphertext update command, and the TPM will complete the ciphertext update on behalf of the user. Specifically, the TPM will obtain the ciphertext state S from the cloud server and then calculate the current updateable key K. S =KDF(K D ,S) and the new renewable key K S+1 =KDF(K D (S+1). Subsequently, the updatable key K is used respectively. S and K S+1 Generate a random sequence R S and R S+1 And calculate the update token The TPM sends T and the new update state S = S + 1 to the cloud server. The cloud server then performs a subsequent ciphertext update operation to obtain the ciphertext encrypted with the new key.

[0090] During the data decryption phase, TPM obtains the ciphertext from the cloud server. Given the ciphertext state S, the ciphertext is decrypted using the data decryption method described above to obtain the plaintext file, which is then sent to the user.

[0091] This invention constructs a key update mechanism for a highly efficient encrypted secure storage and access system, replacing the original single AES encrypted file storage system. It supports key updates while ensuring the speed of encrypted updates; users can decrypt the encrypted file content based on the latest update count and the key. This invention is designed to support the Chinese national cryptographic algorithm SM4 and the ZUC algorithm, ensuring the system complies with commercial cryptographic applications.

[0092] Example 4

[0093] This invention provides a one-time key storage key update system, including a data encryption module, a data update module, and a data decryption module.

[0094] The data encryption module is used to employ a long-term key K B and the updatable key K S Encrypting the original plaintext yields ciphertext encrypted with an updatable key.

[0095] The data update module is used to obtain the currently updatable key K when performing data updates. S and the new updatable key K S+1 Use the updatable key K S and K S+1 Generate random sequences R respectively S and R S+1 And calculate the update token T; use the update token T with the ciphertext to be updated Perform an XOR operation to obtain the ciphertext encrypted with the new key.

[0096] The data decryption module is used to decrypt data based on the latest updatable key K. S Generate a random sequence R S Calculate ciphertext We obtain the ciphertext C after the first layer of decryption. B Use long-term key K B The ciphertext C is encrypted using the block cipher algorithm used during encryption. B Decryption yields the plaintext file.

[0097] This invention successfully constructs a key update mechanism for an efficient encrypted secure storage and access system. The design and implementation of this system are aimed at improving data security and availability.

[0098] This invention enables rapid updates of encrypted data without compromising system performance. This feature allows the new system to maintain high performance even when processing large amounts of data.

[0099] The solution proposed in this invention is implemented using the JAVA programming language. For example... Figure 10As shown, the ciphertext update efficiency of this invention and existing solutions was compared on a simulated dataset. Tests were conducted using different numbers and sizes of files to cover various possible use cases. In each case, the ciphertext update time of this invention and existing solutions was recorded, and the results were compared.

[0100] The results show that this invention demonstrates significant advantages in both the number and size of files. Specifically, whether processing a large number of small files or a small number of large files, the encrypted update time of this invention is significantly shorter than that of existing solutions. This indicates that this invention maintains high performance when processing various types of data.

[0101] This invention is designed to support the national cryptographic algorithms SM4 and ZUC, ensuring that the system complies with commercial cryptographic applications.

[0102] In summary, this invention represents a significant improvement over existing solutions in terms of security, efficiency, and user experience. This is a major technological breakthrough that will provide stronger protection for data security. Furthermore, by supporting RC4 and the Chinese national cryptographic algorithm ZUC, this invention ensures good randomness in its encryption method, which undoubtedly provides even stronger protection for data security.

[0103] The following are embodiments of the apparatus of the present invention, which can be used to execute embodiments of the method of the present invention. For details not omitted in the apparatus embodiments, please refer to the embodiments of the method of the present invention.

[0104] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to implement a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used for the operation of a one-time key update method.

[0105] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the one-time key update method in the above embodiments.

[0106] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0107] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0108] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0109] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0110] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

[0111] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the scope of the invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0112] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can be appropriately combined to form other embodiments that can be understood by those skilled in the art. The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. A method for updating a storage key using a one-time pad, characterized in that, include, Use long-term key The original plaintext is encrypted using an encryption algorithm to obtain the first encrypted ciphertext. ; Use the current updatable key Generating random sequences using sequence encryption algorithms and calculate The ciphertext encrypted with the updatable key is obtained. ; When updating data, obtain the currently updatable key. and the latest updatable key Use the currently updatable key and the latest updatable key Generate random sequences respectively and And calculate the update token Use update token With the ciphertext to be updated Perform an XOR operation to obtain the ciphertext encrypted with the new key. ; Based on the latest currently available updatable key Generate random sequences Calculate ciphertext The first layer of decrypted ciphertext is obtained. Use long-term keys The ciphertext is encrypted using the block cipher algorithm used during encryption. Decryption yields the plaintext file.

2. The one-time key update method for storage keys according to claim 1, characterized in that, Use long-term key The original plaintext is encrypted using a block cipher algorithm to obtain the ciphertext encrypted in the first step. .

3. The one-time key update method for storage keys according to claim 1, characterized in that, Update token The calculation method is to use and Perform the XOR operation, i.e. .

4. The one-time key update method for storage keys according to claim 1, characterized in that, Cipher The calculation method is to update the token. Perform an XOR operation with the ciphertext to be updated, specifically: .

5. The one-time key update method for storage keys according to claim 1, characterized in that, When updating the key in the key management center, During the data encryption phase, the key management center first initializes the ciphertext state. Using key derivation functions Generate a currently updatable key And generate random sequences ; Long-term key and random sequences Send to authorized users; when authorized users encrypt data, they use a long-term key. The original plaintext is encrypted using a block cipher algorithm to obtain the ciphertext encrypted in the first step. Then use random sequence calculation The final ciphertext was obtained. ; During the data update phase, the key management center first obtains the ciphertext update status S from the cloud server, and then calculates the currently updatable key. and new renewable keys Subsequently, the currently updatable key is used respectively. and the latest updatable key Generate random sequences and And calculate the update token ; will update token The new update status is sent to the cloud server; the cloud server then performs a subsequent ciphertext update operation to obtain the ciphertext encrypted with the new key. ; During the data decryption phase, the key management center updates the data based on the latest status. and This will generate the latest currently updatable key. and with the long-term key Send them together to legitimate users; Legitimate users download the original encrypted text from the cloud. Use the obtained currently updatable key and Decryption will yield the plaintext file.

6. The one-time key update method for storage keys according to claim 1, characterized in that, When updating the key for a digital envelope, the user possesses a long-term key using block encryption. and the derived key used to derive the renewable key ; During the data encryption phase, the user first uses a long-term key. The original plaintext is encrypted to obtain the ciphertext encrypted in the first encryption. Then initialize the ciphertext state. Using key derivation functions Generate a currently updatable key and using the current renewable key Generate random sequences and calculate , obtain the final ciphertext After encryption is complete, the user uses the public key. Encrypted ciphertext state Long-term key and the currently updatable key and with the ciphertext Stored on a cloud server; During the data update phase, the cloud server first uses the private key. Decrypt the digital envelope to obtain the ciphertext state. It is then sent to the authorized user; simultaneously, the cloud server also needs to update the asymmetric key to obtain a new public key. and private key The new public key is then made public to the user; the user is authorized to update the ciphertext state, and then the current updatable key is calculated. and the latest updatable key The currently updatable key is used according to the data update method described above. and the latest updatable key Perform encrypted update; authorize users to use the new public key. Encrypted ciphertext state and update token and long-term keys and the currently updatable key And send it to the cloud server; the cloud server uses the new private key After decryption to obtain the ciphertext state and update token, subsequent ciphertext update operations are performed to obtain the ciphertext encrypted with the new key. ; During the data decryption phase, the cloud server uses the latest updated private key. Decrypt the digital envelope to obtain the ciphertext state. Send it to the legitimate user; Authorized users can then decrypt the ciphertext using the data decryption method described above.

7. The one-time key update method for storage keys according to claim 1, characterized in that, When updating the key of the trusted platform module, During the data encryption phase, the user will use a long-term key. Derived keys used to derive renewable keys The plaintext that needs to be encrypted is sent to the TPM; the TPM stores the long-term key. and derived key The two keys are then used to encrypt the plaintext file to obtain the final ciphertext. Finally, TPM will replace the user with the encrypted state. and ciphertext Send to the cloud server; During the data update phase, users only need to send a ciphertext update command, and the TPM will complete the ciphertext update on behalf of the user; specifically, the TPM will obtain the ciphertext status from the cloud server. Then calculate the current updatable key. and the latest updatable key Subsequently, the currently updatable key is used respectively. and the latest updatable key Generate random sequences and And calculate the update token TPM will And the new update status The message is sent to the cloud server; the cloud server then performs a subsequent ciphertext update operation to obtain the ciphertext encrypted with the new key. ; During the data decryption phase, TPM obtains the ciphertext from the cloud server. and ciphertext state The ciphertext is decrypted using the above data decryption method to obtain the plaintext file, which is then sent to the user. TPM stores long-term keys and derived key The two keys are then used to encrypt the plaintext file to obtain the final ciphertext. This includes: TPM storage of long-term keys and derived key First, use a long-term key. The original plaintext is encrypted using a block cipher algorithm to obtain the first encrypted ciphertext. Then use an updateable key. Generating random sequences using sequence encryption algorithms and calculate Obtain the final ciphertext .

8. A one-time key storage key update system, characterized in that, It includes a data encryption module, a data update module, and a data decryption module; The data encryption module is used to employ a long-term key. and the currently updatable key Encrypting the original plaintext yields ciphertext encrypted with an updatable key. ; The data update module is used to obtain the currently updatable key when performing a data update. and the latest updatable key Use the currently updatable key and the latest updatable key Generate random sequences respectively and And calculate the update token Use update token With the ciphertext to be updated Perform an XOR operation to obtain the ciphertext encrypted with the new key. ; The data decryption module is used to decrypt the data based on the latest currently updatable key. Generate random sequences Calculate ciphertext The first layer of decrypted ciphertext is obtained. Use long-term keys The ciphertext is encrypted using the block cipher algorithm used during encryption. Decryption yields the plaintext file.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the one-time key update method for storage keys as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the one-time key update method for the storage key as described in any one of claims 1-7.

Images