Cloud storage data management method, system, electronic device and storage medium

Abstract

The embodiment of the present invention provides a cloud storage data management and control method, system, electronic device and storage medium, which belongs to the field of cloud storage data security. The method includes: when a user submits a file to cloud storage, according to whether the file contains sensitive data, a corresponding storage strategy is selected to store the file in a cloud storage disk, wherein the storage strategy is to add a key-value pair to the metadata of the file when the file contains sensitive data, and directly store the file when the file does not contain sensitive data; when the user initiates a read and write request for data, data access control is performed according to whether the request carries a key value. By selecting a corresponding storage strategy and storing the file according to whether the file contains sensitive data when submitting the file to cloud storage, and performing data access control according to whether the request carries a key value when the user requests to read and write data, it is ensured that the data in the cloud can only be accessed by limited users and limited operating computers, thereby improving data security.

Description

Technical Field

[0001] The present invention relates to the field of cloud storage data security technology, and in particular to a cloud storage data management and control method, system, electronic device and storage medium. Background Art

[0002] Cloud storage is a service that allows users to store, access and manage data through the Internet. It has been widely promoted in various industries due to its on-demand access, dynamic expansion and data encryption. While bringing convenience, the security of stored data is also increasingly being concerned by service consumers.

[0003] Generally, when building cloud storage services, major service providers ensure data security, which generally covers the following aspects: data encryption, including transmission encryption and static data encryption; access control, including identity authentication and permission management; network security; data redundant backup and geographic disaster recovery, etc.

[0004] Cases of cloud storage data being leaked due to security issues have continued to emerge in recent years, and there is no end to improving the security of cloud storage data. Especially in some scenarios with very high security requirements (such as SM environments), data security requirements are more stringent. Data security protection measures in public cloud scenarios need to be updated and iterated, and a change of thinking can prevent data leakage accidents in such scenarios. Summary of the invention

[0005] The purpose of the embodiments of the present invention is to provide a cloud storage data management method, system, electronic device and storage medium, which are used to fully or at least partially solve the technical problems existing in the above-mentioned prior art.

[0006] In order to achieve the above object, an embodiment of the present invention provides a cloud storage data management and control method, including:

[0007] When a user submits a file to cloud storage, a corresponding storage strategy is selected to store the file in the cloud storage disk according to whether the file contains sensitive data. The storage strategy is to add a key-value pair to the metadata of the file when the file contains sensitive data, and directly store the file when the file does not contain sensitive data.

[0008] When a user initiates a request to read or write data, data access control is performed based on whether the request carries a key value.

[0009] Optionally, when a user submits a file to cloud storage, a corresponding storage policy is selected to store the file in the cloud storage disk based on whether the file contains sensitive data, including:

[0010] When submitting files containing sensitive data to cloud storage, add key-value pairs to the file’s metadata;

[0011] The metadata is persisted and cut into pieces according to the preset length, and the first 128 bits of the key-value pair are intercepted to obtain multiple file segments;

[0012] For each file segment, the SM4 algorithm is used to encrypt it and then stored in the cloud storage disk.

[0013] Optionally, the cloud storage data management and control method further includes:

[0014] Determine whether the metadata of the file to be written already exists. If so, it is a modification operation of the existing file; if not, it is a new file writing operation;

[0015] Among them, for existing files, determine whether the persistent metadata contains key-value pairs. If so, obtain the relevant information in the write request and calculate SM3 using the national secret hash algorithm. If not, it indicates that non-sensitive data is modified and the file is directly stored in the cloud storage disk.

[0016] For newly written files, check whether the metadata write request contains a key-value pair. If so, encrypt the sensitive data that needs to be persisted using the national encryption SM4 algorithm, and cut and hash it according to the preset length. The encryption key uses the first 128 bits of the key value.

[0017] Optionally, when a user initiates a request to read or write data, data access control is performed based on whether the request carries a key value, including:

[0018] When a user initiates a request to read or write data, the metadata of the file to be read is obtained;

[0019] When it is detected that the metadata contains a key-value pair, the key value is obtained from the read and write request of the file, and the SM3 is calculated using the national secret hash algorithm to obtain the calculation result;

[0020] The calculation result is compared with the key value in the persistent metadata. If the match fails, the file read failure is returned. If the match succeeds, the hashed file fragments are aggregated, and the file data content is returned to the user after decryption using the first 128 bits of the key value.

[0021] Optionally, the calculation result includes but is not limited to the identity ID of the file operator, the personal key of the file operator, and the network card URL of the operator end.

[0022] On the other hand, the present invention also provides a cloud storage data management and control system, including:

[0023] The sensitive data reading and writing module is used to expand the key-value pair into the file metadata when submitting sensitive data to the cloud storage, where the key-value pair records the identity ID, personal key and network card address of the operator submitting the data;

[0024] The data access control module is used to persist the metadata and cut it into preset length after receiving sensitive data, and to intercept the first 128 bits of the value in the extended key-value pair, encrypt each shard using the national encryption SM4 algorithm and store it in the cloud storage disk, and to calculate the signature of the key information carried in the request after receiving the user's read and write request for existing sensitive data. If the calculated signature result is inconsistent with the signature result in the original record, the data access request will be rejected.

[0025] Optionally, the data access control module is specifically used to:

[0026] When submitting files containing sensitive data to cloud storage, add key-value pairs to the file’s metadata;

[0027] The metadata is persisted and cut into pieces according to the preset length, and the first 128 bits of the key-value pair are intercepted to obtain multiple file segments;

[0028] For each file segment, the SM4 algorithm is used to encrypt it and then stored in the cloud storage disk.

[0029] Optionally, the data access control module is specifically used to:

[0030] When a user initiates a request to read or write data, the metadata of the file to be read is obtained;

[0031] When it is detected that the metadata contains a key-value pair, the key value is obtained from the read and write request of the file, and the SM3 is calculated using the national secret hash algorithm to obtain the calculation result;

[0032] The calculation result is compared with the key value in the persistent metadata. If the match fails, the file read failure is returned. If the match succeeds, the hashed file fragments are aggregated, and the file data content is returned to the user after decryption using the first 128 bits of the key value.

[0033] On the other hand, the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned cloud storage data management and control method when executing the program.

[0034] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the above-mentioned cloud storage data management and control method are implemented.

[0035] Through the above technical solution, when submitting files to cloud storage, the corresponding storage strategy is selected according to whether the file contains sensitive data for storage, and when the user requests to read or write data, data access control is performed according to whether the request carries a key value, thereby ensuring that the data in the cloud can only be accessed by limited users and limited operating computers, thereby improving data security.

[0036] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0038] Figure 1 It is an implementation flow chart of a cloud storage data management and control method provided by an embodiment of the present invention;

[0039] Figure 2 It is a security management process for writing file data to cloud storage provided by an embodiment of the present invention;

[0040] Figure 3 It is a security management process for reading file data from cloud storage provided by an embodiment of the present invention;

[0041] Figure 4 It is a structural diagram of a cloud storage data management and control system provided by an embodiment of the present invention;

[0042] Figure 5 It is a detailed structural diagram of a cloud storage data management and control system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0043] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0044] See also Figure 1 FIG. 1 is a flowchart of an implementation method for managing and controlling cloud storage data provided by an embodiment of the present invention, comprising the following execution steps:

[0045] Step 100: When a user submits a file to cloud storage, a corresponding storage policy is selected to store the file in the cloud storage disk according to whether the file contains sensitive data.

[0046] The storage strategy is to add a key-value pair to the metadata of a file when the file contains sensitive data, and to directly store the file when the file does not contain sensitive data.

[0047] Specifically, when executing step 100, the following steps may be specifically performed:

[0048] S1000: When submitting a file containing sensitive data to cloud storage, add a key-value pair to the metadata of the file.

[0049] S1001: The metadata is persisted and cut into pieces according to a preset length, and the first 128 bits of the key-value pair are intercepted to obtain multiple file segments.

[0050] S1002: Each file segment is encrypted using the SM4 algorithm and then stored in a cloud storage disk.

[0051] In some implementations, the cloud storage data management and control method flow chart further includes the following execution steps:

[0052] Determine whether the metadata of the written file already exists. If so, it is a modification operation on the existing file; if not, it is a new file writing operation; among them, for existing files, determine whether the persisted metadata contains key-value pairs. If so, obtain the relevant information in the write request and use the national secret hash algorithm to calculate SM3; if not, it indicates that non-sensitive data is modified and the file is directly stored in the cloud storage disk; for newly written files, check whether the metadata write request contains key-value pairs. If so, encrypt the sensitive data that needs to be persisted using the national secret SM4 algorithm, cut and hash it according to the preset length, and use the encryption key to use the first 128 bits of the key value.

[0053] In some embodiments, see Figure 2 As shown, a security management process of writing file data to cloud storage provided by an embodiment of the present invention includes the following steps:

[0054] Step 1: The client initiates a data write request. After the sensitive data read / write module 11 detects the write request, it enters the sensitive data judgment phase.

[0055] Step 2: The sensitive data read-write module 11 confirms with the user whether the file to be written contains sensitive data? If the user chooses yes, the sensitive data read-write module 11 will add an additional key-value pair to the metadata of the file to be written. The added key-value pair is: security = SM3 (file operator identity ID, file operator personal key, operating computer network card address). SM3 is a national secret hash algorithm. After completion, the metadata is sent to the metadata management service of the cloud storage for persistence operation; if the user chooses that the data written this time is not sensitive data, the sensitive data read-write module 11 directly sends the metadata to the metadata management service of the cloud storage for persistence operation.

[0056] Step 3: To prevent the terminal user from maliciously tampering with the file data, the cloud storage metadata management service will determine whether the metadata of the written file already exists. If it does, it means that the operation is to modify the existing file; if the metadata of the written file does not exist, it means that the operation is to write a new file.

[0057] Step 4: For existing files, determine whether the persisted metadata contains a security key-value pair. If it does, obtain the relevant information in the write request and use the national secret hash algorithm to calculate: SM3 (file operator identity ID, file operator personal key, operating computer network card address); if it does not contain a security key-value pair, it means that non-sensitive data is modified, no hash calculation is required, and jump directly to step 7.

[0058] For newly written files, check whether the metadata write request contains the security key-value pair. If it does, jump to step 6; otherwise, jump to step 7.

[0059] Step 5: After obtaining the result of step 4, compare it with the security value in the persistent metadata. If they are not equal, there is a data security risk and the cloud storage access control module 12 refuses to write data; if they are equal, jump to step 6.

[0060] Step 6: The cloud storage data storage management module 13 uses the national secret SM4 algorithm to encrypt sensitive data that needs to be persisted. The encryption key uses the first 128 bits of the security key value. After encryption, the original data is sharded and hashed according to a fixed size. The hash algorithm is implemented with reference to the rados algorithm of Ceph. After completion, even if a disk has a data leak, the acquirer cannot restore the complete data.

[0061] Step 7: Store file data on disk for persistence.

[0062] Step 101: When a user initiates a request to read or write data, data access control is performed based on whether the request carries a key value.

[0063] Specifically, when executing step 101, the following steps may be specifically performed:

[0064] S1010: When a user initiates a request to read or write data, metadata of the file to be read is obtained.

[0065] S1011: When it is detected that the metadata contains a key-value pair, the key value is obtained from the read and write request of the file, and SM3 is calculated using the national secret hash algorithm to obtain the calculation result.

[0066] It should be understood that the calculation results include but are not limited to the identity ID of the file operator, the personal key of the file operator, and the network card URL of the operator end.

[0067] S1012: Compare the calculation result with the key value in the persistent metadata. If the match fails, return a file read failure. If the match succeeds, aggregate the hashed file fragments, use the first 128 bits of the key value to decrypt the file data content and return it to the user.

[0068] In some embodiments, see Figure 3 As shown, a security management process for reading file data from cloud storage provided by an embodiment of the present invention includes the following execution steps:

[0069] Step 1: The client initiates a data read request. The request is sent to the metadata management service of the cloud storage.

[0070] Step 2: The cloud storage access control module 12 obtains metadata of the file to be read. If it is detected that the metadata contains a security key-value pair, it means that the client needs to read sensitive data, and jumps to step 3; otherwise, the file data is directly returned to the client.

[0071] Step 3: The cloud storage access control module 12 obtains the key value from the file reading request information and uses the national secret hash algorithm to calculate: SM3 (file operator identity ID, file operator personal key, operating computer network card address).

[0072] Step 4: After getting the result of step 3, compare it with the security value in the persistent metadata. If a match fails, return a file read failure (unauthorized read); otherwise, jump to step 5.

[0073] Step 5: The cloud storage management and control module 13 aggregates the hashed file fragments, decrypts them using the first 128 bits of the security key value, and returns the file data content to the client.

[0074] This application expands the metadata of the data stored in the cloud, and uses the operator ID, operator personal key, and computer network card address sent by the client during the request as a keyword match after hash calculation, so as to ensure that the data in the cloud can only be accessed by limited users and limited computers. At the same time, this application implements further physical storage security protection for sensitive files by encrypting and sharding sensitive data and storing them in a hashing manner.

[0075] See also Figure 4 FIG. 1 is a schematic diagram of a cloud storage data management and control system provided by an embodiment of the present invention, including:

[0076] The sensitive data reading and writing module 40 is used to expand the key-value pair into the file metadata when submitting sensitive data to the cloud storage, wherein the key-value pair records the identity ID, personal key and network card address of the operator submitting the data;

[0077] The data access control module 41 is used to persist the metadata and cut it into a preset length after receiving sensitive data, and to intercept the first 128 bits of the value in the extended key-value pair, encrypt each shard using the national encryption SM4 algorithm and store it in the cloud storage disk, and to calculate the signature of the key information carried in the request after receiving a user's request to read or write existing sensitive data. If the calculated signature result is inconsistent with the signature result in the original record, the data access request is rejected.

[0078] In some implementations, the data access control module 41 is specifically used to:

[0079] When submitting files containing sensitive data to cloud storage, add key-value pairs to the file’s metadata;

[0080] The metadata is persisted and cut into pieces according to the preset length, and the first 128 bits of the key-value pair are intercepted to obtain multiple file segments;

[0081] For each file segment, the SM4 algorithm is used to encrypt it and then stored in the cloud storage disk.

[0082] In some implementations, the data access control module 41 is specifically used to:

[0083] When a user initiates a request to read or write data, the metadata of the file to be read is obtained;

[0084] When it is detected that the metadata contains a key-value pair, the key value is obtained from the read and write request of the file, and the SM3 is calculated using the national secret hash algorithm to obtain the calculation result;

[0085] The calculation result is compared with the key value in the persistent metadata. If the match fails, the file read failure is returned. If the match succeeds, the hashed file fragments are aggregated, and the file data content is returned to the user after decryption using the first 128 bits of the key value.

[0086] In some implementations, under the premise that certain sensitive data is only allowed to be read and written in a specific network, the present application proposes a method of expanding data metadata so that certain sensitive data is only allowed to be read and written in a specified operating computer. Figure 5 FIG. 1 is a detailed structural diagram of a cloud storage data management and control system provided by an embodiment of the present invention, including:

[0087] A sensitive data reading and writing module 11 running in the operating computer, a data access control module 12 running in the cloud storage metadata server, and a data storage control module 13, etc.

[0088] When submitting sensitive data to cloud storage, in addition to writing conventional information (such as file name, file size, creator username, creation time, and file access permissions, etc.) to the metadata, it is also necessary to expand a key-value pair to the file metadata through the sensitive data reading and writing module 11. This key-value pair records the identity ID of the operator submitting the data, the personal key, and the summary information after binding the network card address of the operating computer (based on SM3).

[0089] After receiving sensitive data, the cloud storage metadata service access control module 12 will persist the metadata and cut the data into fixed sizes, intercept the first 128 bits of the value in the extended key-value pair, encrypt each shard using the national encryption SM4 algorithm, and then store it in the cloud storage disk. Multiple shards of a file are discretely stored on multiple hard disks of multiple hosts. This strategy is determined by the scheduling algorithm in the data storage control module 13 in the metadata service.

[0090] When a user initiates a read or write request for existing sensitive data through the cloud storage resource manager, the metadata service access control module 12 will calculate the signature of the key information carried in the request after receiving the request. If the calculated signature result is inconsistent with the signature result in the original record, the data access request will be rejected.

[0091] On the other hand, the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the cloud storage data management method described in any one of the above embodiments are implemented.

[0092] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the cloud storage data management and control method described in any of the above embodiments are implemented.

[0093] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0094] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0095] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0096] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0097] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0098] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0099] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0100] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0101] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for managing and controlling cloud storage data, characterized in that: include: When a user submits a file to cloud storage, a corresponding storage strategy is selected to store the file in the cloud storage disk according to whether the file contains sensitive data. The storage strategy is to add a key-value pair to the metadata of the file when the file contains sensitive data, and directly store the file when the file does not contain sensitive data. When a user initiates a request to read or write data, data access control is performed based on whether the request carries a key value. When a user submits a file to cloud storage, the corresponding storage policy is selected to store the file in the cloud storage disk according to whether the file contains sensitive data, including: When submitting files containing sensitive data to cloud storage, add key-value pairs to the file’s metadata; The metadata is persisted and cut into pieces according to the preset length, and the first 128 bits of the key-value pair are intercepted to obtain multiple file segments; For each file segment, the SM4 algorithm is used to encrypt it and then stored in the cloud storage disk; The cloud storage data management method further includes: Determine whether the metadata of the file to be written already exists. If so, it is a modification operation of the existing file; if not, it is a new file writing operation; Among them, for existing files, determine whether the persistent metadata contains key-value pairs. If so, obtain the relevant information in the write request and calculate SM3 using the national secret hash algorithm. If not, it indicates that non-sensitive data is modified and the file is directly stored in the cloud storage disk. For newly written files, check whether the metadata write request contains a key-value pair. If so, encrypt the sensitive data that needs to be persisted using the national encryption SM4 algorithm, and cut and hash it according to the preset length. The encryption key uses the first 128 bits of the key value.

2. The cloud storage data management and control method according to claim 1, characterized in that: When a user initiates a request to read or write data, data access control is performed based on whether the request carries a key value, including: When a user initiates a request to read or write data, the metadata of the file to be read is obtained; When it is detected that the metadata contains a key-value pair, the key value is obtained from the read and write request of the file, and the SM3 is calculated using the national secret hash algorithm to obtain the calculation result; The calculation result is compared with the key value in the persistent metadata. If the match fails, the file read failure is returned. If the match succeeds, the hashed file fragments are aggregated, and the file data content is returned to the user after decryption using the first 128 bits of the key value.

3. The cloud storage data management and control method according to claim 2, characterized in that: The calculation results include but are not limited to the identity ID of the file operator, the personal key of the file operator, and the network card URL of the operator.

4. A cloud storage data management and control system applied to the cloud storage data management and control method according to any one of claims 1 to 3, characterized in that: include: The sensitive data reading and writing module is used to expand the key-value pair into the file metadata when submitting sensitive data to the cloud storage, where the key-value pair records the identity ID, personal key and network card address of the operator submitting the data; The data access control module is used to persist the metadata after receiving sensitive data, cut the metadata according to the preset length, intercept the first 128 bits of the value in the extended key-value pair, encrypt each shard using the national encryption SM4 algorithm, and store it in the cloud storage disk. It is also used to calculate the signature of the key information carried in the request after receiving the user's request to read and write existing sensitive data. If the calculated signature result is inconsistent with the signature result in the original record, the data access request is rejected; The data access control module is specifically used to: When submitting files containing sensitive data to cloud storage, add key-value pairs to the file’s metadata; The metadata is persisted and cut into pieces according to the preset length, and the first 128 bits of the key-value pair are intercepted to obtain multiple file segments; For each file segment, the SM4 algorithm is used to encrypt it and then stored in the cloud storage disk.

5. The cloud storage data management and control system according to claim 4, characterized in that: The data access control module is specifically used for: When a user initiates a request to read or write data, the metadata of the file to be read is obtained; When it is detected that the metadata contains a key-value pair, the key value is obtained from the read and write request of the file, and the SM3 is calculated using the national secret hash algorithm to obtain the calculation result; The calculation result is compared with the key value in the persistent metadata. If the match fails, the file read failure is returned. If the match succeeds, the hashed file fragments are aggregated, and the file data content is returned to the user after decryption using the first 128 bits of the key value.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the cloud storage data management and control method as described in any one of claims 1 to 3 are implemented.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the cloud storage data management and control method according to any one of claims 1 to 3 are implemented.

Images