Cloud computing data trusted tracking method, system, storage medium and electronic device

Abstract

The present invention provides a method, system, storage medium and electronic device for trusted tracking of cloud computing data, the method comprising: a data owner uploads sensitive data and sets an access policy; a cloud computing data storage platform encrypts the sensitive data to generate ciphertext, and uploads the personal information and ciphertext of the data owner to a blockchain; an external visitor requests to access the ciphertext from a cloud service end and provides key information, the cloud service end sends a request for access and uploads the key information; the blockchain receives the key information, calls the access policy of the accessed ciphertext, and determines whether to send a dynamic key; the cloud service end requests to query data from the cloud computing data storage platform, the cloud computing data storage platform verifies the identity of the external visitor and the real-time nature of the dynamic key, and if the requirements are met, uses the current timestamp to unlock the dynamic key. The present invention improves the confidentiality of data, and provides comprehensive protection for the security of cloud computing data by recording each data access and operation in detail.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a cloud computing data trusted tracking method, system, storage medium and electronic device. Background Art

[0002] In today's cloud computing field, although the service and application ecosystem is quite mature, the risks of cloud computing data sharing are becoming increasingly prominent.

[0003] In existing technologies, when sensitive data is outsourced to cloud storage and shared, the loss of data control becomes a major problem. This not only involves data security and privacy protection, but also includes the risk of single point failure, which may threaten the reliability and authenticity of data; although cloud storage can strengthen the control and confidentiality of sensitive data, it also brings problems of computing and storage costs: blockchain systems generally face the problem of low data query efficiency and encryption and decryption requiring a certain amount of time. Summary of the invention

[0004] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a method for trusted tracking of cloud computing data, aiming to solve the problem that although cloud storage can enhance the control and confidentiality of sensitive data, it also brings about the problem of computing and storage costs: the blockchain system generally faces the technical problems of low data query efficiency and encryption and decryption requiring a certain amount of time cost.

[0005] In order to achieve the above object, the present invention is implemented by the following technical solutions:

[0006] A cloud computing data trustworthy tracking method comprises the following steps:

[0007] The cloud computing data storage platform collects sensitive data uploaded by the data owner and sets data attribute sets and access policies for the sensitive data according to the needs of the data owner; wherein the cloud computing data storage platform generates a master key MK and a corresponding public key PK for each user;

[0008] The cloud computing data storage platform encrypts the sensitive data using the public key PK and the access policy to generate a ciphertext, generates a personal private key GK based on the master key MK and the data attribute set, and uploads the ciphertext and the personal information containing the personal private key GK to the blockchain for secure storage;

[0009] The cloud service end receives a request from an external visitor to access the ciphertext and requires the external visitor to provide key information. The cloud service end sends a request to access the blockchain and uploads the key information of the external visitor at the same time.

[0010] The blockchain performs a primary identity authentication on the external visitor based on the personal information, receives key information of the external visitor who has passed the primary identity authentication, and calls the access policy of the accessed ciphertext to determine whether to send a dynamic key to the external visitor;

[0011] The cloud service end requests the cloud computing data storage platform to query data and uploads the dynamic key. The cloud computing data storage platform performs secondary identity authentication on the external visitor and performs real-time verification of the dynamic key for the external visitor who has passed the secondary identity authentication. If the requirements are met, the dynamic key is unlocked using the current timestamp, and the personal private key GK corresponding to the sensitive data is obtained to provide access rights to the ciphertext.

[0012] According to one aspect of the above technical solution, the data attribute set includes department and security level, and the access policy includes time, place, and reason for access.

[0013] According to one aspect of the above technical solution, before the cloud service end requires the external visitor to provide key information, it also includes:

[0014] The cloud service end checks whether the external visitor has been registered on the blockchain;

[0015] If not, the external visitor is required to fill in the primary identity information to complete the registration, and the primary identity information includes name and registration date.

[0016] According to one aspect of the above technical solution, the key information includes time, place and reason for visit.

[0017] According to one aspect of the above technical solution, the blockchain performs a primary identity authentication on the external visitor based on the personal information, specifically including:

[0018] The blockchain calls the personal information uploaded from the cloud computing data storage platform, and obtains a user group allowed to access from the personal information;

[0019] The blockchain compares the primary identity information filled in by the external visitor when registering with the user group to determine whether the external visitor has the right to obtain the dynamic key.

[0020] According to one aspect of the above technical solution, the blockchain receives the key information of the external visitor who has passed the primary identity authentication, and calls the access policy of the accessed ciphertext to determine whether to send a dynamic key to the external visitor, specifically including:

[0021] The blockchain receives key information of the external visitor that has passed the primary identity verification;

[0022] The blockchain calls the ciphertext uploaded from the cloud computing data storage platform and obtains the access policy from the ciphertext;

[0023] The blockchain compares the key information provided by the external visitor with the access policy to determine whether to send a dynamic key to the external visitor.

[0024] According to one aspect of the above technical solution, the cloud computing data storage platform performs secondary identity authentication on the external visitor, specifically including:

[0025] The blockchain calls the personal information uploaded from the cloud computing data storage platform and obtains the data attribute set from the personal information;

[0026] The blockchain sends the data attribute set to the cloud service end, and the cloud service end then uploads the data attribute set to the cloud computing data storage platform;

[0027] The cloud computing data storage platform is provided with secondary access rights information for each user;

[0028] The cloud computing data storage platform compares the data attribute set with the secondary access permission information to determine whether the external visitor has access permission.

[0029] According to one aspect of the above technical solution, the cloud computing data storage platform performs real-time dynamic key verification on external visitors who have passed the secondary identity verification, specifically including:

[0030] The cloud computing data storage platform verifies the time interval between the acquisition time of the dynamic key and the current time;

[0031] If the time interval exceeds the preset buffer time, the external visitor is notified that the dynamic key has expired;

[0032] If the time interval is within the buffer time, the real-time verification of the dynamic key is passed.

[0033] The present invention also provides a cloud computing data trustworthy tracking system, comprising:

[0034] Cloud computing data storage platform: used to collect sensitive data uploaded by data owners, and set data attribute sets and access policies for the sensitive data according to the needs of the data owners; wherein the cloud computing data storage platform generates a master key MK and a corresponding public key PK for each user; the sensitive data is encrypted using the public key PK and the access policy to generate a ciphertext, a personal private key GK is generated by encryption based on the master key MK and the data attribute set, and the ciphertext and personal information containing the personal private key GK are uploaded to the blockchain for secure storage; secondary identity authentication is performed on external visitors, and dynamic key real-time verification is performed on external visitors who have passed the secondary identity authentication. If the requirements are met, the dynamic key is unlocked using the current timestamp, and the personal private key GK corresponding to the sensitive data is obtained to provide access rights to the ciphertext;

[0035] Cloud service end: used to receive the access request of the external visitor for the ciphertext, and require the external visitor to provide key information, the cloud service end sends the access request to the blockchain, and uploads the key information of the external visitor at the same time; requests the cloud computing data storage platform to query data, and uploads the dynamic key;

[0036] Blockchain: used to perform primary identity authentication on the external visitor based on the personal information. The blockchain receives the key information of the external visitor who has passed the primary identity authentication, and calls the access policy of the accessed ciphertext to determine whether to send a dynamic key to the external visitor.

[0037] The present invention also provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned cloud computing data trusted tracking method.

[0038] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned method for trusted tracking of cloud computing data when executing the computer program.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] The present invention aims to provide an advanced security and privacy protection mechanism for sensitive data in cloud computing through blockchain technology. The core is to utilize the tamper-proof and transparent characteristics of blockchain to strengthen the tracking ability of data access and operation, and ensure the integrity and security of data. In this technical solution, data is encrypted on the cloud platform, and blockchain plays the role of recording and verification. Whenever a user requests access to data, his identity information and access request will be submitted to the blockchain network. The blockchain network not only stores the user's identity and access policy, but also records in detail the key information of each data access activity (time, place, reason, etc.). The present invention conducts two reviews of user access through blockchain and cloud computing data storage platform, which greatly improves the security of access.

[0041] This blockchain-based data tracking and auditing mechanism not only improves data confidentiality, but also provides users with comprehensive control over sensitive data. By recording every data access and operation in detail, the present invention provides comprehensive protection for cloud computing data security, and is particularly suitable for application scenarios with strict requirements on data security and privacy protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0043] Figure 1 It is a flowchart of a method for credible tracking of cloud computing data in a first embodiment of the present invention;

[0044] Figure 2 It is a structural block diagram of a cloud computing data trustworthy tracking method in a first embodiment of the present invention;

[0045] Figure 3 It is a structural block diagram of a cloud computing data trusted tracking system in a second embodiment of the present invention;

[0046] Figure 4 is a structural block diagram of an electronic device in a third embodiment of the present invention;

[0047] The following specific implementation manner will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0048] In order to facilitate the understanding of the present invention, the present invention will be described more fully below with reference to the relevant drawings. Several embodiments of the present invention are given in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive.

[0049] It should be noted that when an element is referred to as being "fixed to" another element, it may be directly on the other element or there may be a central element. When an element is considered to be "connected to" another element, it may be directly connected to the other element or there may be a central element at the same time. The terms "vertical", "horizontal", "left", "right" and similar expressions used herein are for illustrative purposes only.

[0050] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present invention belongs. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more of the related listed items.

[0051] Embodiment 1

[0052] See also Figure 1 to Figure 2 , which shows a cloud computing data trustworthy tracking method in the first embodiment of the present invention, comprising the following steps S10-S50:

[0053] S10, the cloud computing data storage platform collects sensitive data uploaded by the data owner, and sets a data attribute set and an access policy for the sensitive data according to the needs of the data owner; wherein the cloud computing data storage platform generates a master key MK and a corresponding public key PK for each user;

[0054] S20, the cloud computing data storage platform encrypts the sensitive data using the public key PK and the access policy to generate a ciphertext, generates a personal private key GK based on the master key MK and the data attribute set, and uploads the ciphertext and the personal information containing the personal private key GK to the blockchain for secure storage;

[0055] S30, the cloud service end receives a request from an external visitor to access the ciphertext, and requires the external visitor to provide key information, and the cloud service end sends a request to access the blockchain, and uploads the key information of the external visitor at the same time;

[0056] S40, the blockchain performs a primary identity authentication on the external visitor based on the personal information, the blockchain receives the key information of the external visitor who has passed the primary identity authentication, and calls the access policy of the accessed ciphertext to determine whether to send a dynamic key to the external visitor;

[0057] S50, the cloud service end requests the cloud computing data storage platform to query data and uploads the dynamic key. The cloud computing data storage platform performs secondary identity authentication on the external visitor and performs real-time verification of the dynamic key for the external visitor who has passed the secondary identity authentication. If the requirements are met, the dynamic key is unlocked using the current timestamp, and the personal private key GK corresponding to the sensitive data is obtained to provide access rights to the ciphertext.

[0058] It can be understood that the present invention aims to provide an advanced security and privacy protection mechanism for sensitive data in cloud computing through blockchain technology. The core is to utilize the tamper-proof and transparent characteristics of blockchain to strengthen the tracking ability of data access and operation, and ensure the integrity and security of data. In this technical solution, the data is encrypted on the cloud platform, and the blockchain assumes the role of recording and verification. Whenever a user requests access to data, his identity information and access request will be submitted to the blockchain network. The blockchain network not only stores the user's identity and access policy, but also records in detail the key information of each data access activity (time, place, reason, etc.). The present invention conducts two reviews of user access through blockchain and cloud computing data storage platform, which greatly improves the security of access.

[0059] This blockchain-based data tracking and auditing mechanism not only improves data confidentiality, but also provides users with comprehensive control over sensitive data. By recording every data access and operation in detail, the present invention provides comprehensive protection for cloud computing data security, and is particularly suitable for application scenarios with strict requirements on data security and privacy protection.

[0060] Furthermore, the data attribute set includes department and security level, and the access policy includes time, location, and reason for access.

[0061] It is understandable that the data owner defines his own data attribute set and defines access policies to screen external visitors who can access the sensitive data. For example, user A uploads data (SECRECT) for storage and specifies the attribute set AP = (security level is "Top Secret" and department is "Research"). The access policy can be to ask the external visitor the reason for access, when or where the access can be made, etc.

[0062] Sensitive data is encrypted, and a personal private key GK is created based on the user's data attribute set and master key MK. Finally, the personal information (including the personal private key) and the ciphertext are uploaded to the blockchain together. In this way, the hash value of the data owner's ciphertext and the personal private key GK can be stored on the blockchain, providing technical support for subsequent external visitors to more conveniently call the ciphertext and for data owners to more conveniently track browsing records of sensitive data.

[0063] Furthermore, before the cloud service end requires the external visitor to provide key information, it also includes:

[0064] The cloud service end checks whether the external visitor has been registered on the blockchain;

[0065] If not, the external visitor is required to fill in the primary identity information to complete the registration, and the primary identity information includes name and registration date.

[0066] Understandably, if an external visitor wants to query ciphertext from the cloud server, he or she must first be verified by the blockchain. If the system detects that the external visitor has not completed registration on the blockchain, the user needs to fill in the main identity information such as name and registration date to complete the registration.

[0067] If yes, the cloud service end requires the external visitor to provide key information, the key information including time, location and reason for visit;

[0068] The cloud service sends a request for access to the blockchain and uploads key information provided by the external visitor.

[0069] It is understandable that after successful registration, the external visitor applies for access to the data again, and provides key information such as access time, access location and access reason, sends a reference request to the blockchain through the cloud service end, and uploads the key information of the external visitor at the same time; for example, the registration form of user B is (name: B, registration date: 2024-05-28 10:00:00), and the key information is (time: "2024-05-28 10:00:00", location: xx company, xx street, Ningbo City, Zhejiang Province, reason: use data for statistical analysis, file: SECRECT, data owner name: "Alice").

[0070] Furthermore, the blockchain performs a primary identity verification on the external visitor based on the personal information, specifically including:

[0071] The blockchain calls the personal information uploaded from the cloud computing data storage platform, and obtains a user group allowed to access from the personal information;

[0072] The blockchain compares the primary identity information filled in by the external visitor when registering with the user group to determine whether the external visitor has the right to obtain the dynamic key.

[0073] It can be understood that this step can provide primary identity authentication for external visitors through the primary identity information during registration, avoiding the problem in the prior art that it is too difficult and time-consuming to verify all identity information on the cloud computing data storage platform.

[0074] Furthermore, the blockchain receives the key information of the external visitor who has passed the primary identity authentication, and calls the access policy of the accessed ciphertext to determine whether to send a dynamic key to the external visitor, specifically including:

[0075] The blockchain receives key information of the external visitor that has passed the primary identity verification;

[0076] The blockchain calls the ciphertext uploaded from the cloud computing data storage platform and obtains the access policy from the ciphertext;

[0077] The blockchain compares the key information provided by the external visitor with the access policy to determine whether to send a dynamic key to the external visitor.

[0078] It is understandable that the key information provided by the external visitor can be verified to be within the preset access policy. For example, only when the access reason, access time, and access location in the key information are within the access policy, the dynamic key can be allowed to be sent, or only a few of them need to be met to allow the dynamic key to be sent.

[0079] Furthermore, the cloud computing data storage platform performs secondary identity authentication on the external visitor, specifically including:

[0080] The blockchain calls the personal information uploaded from the cloud computing data storage platform and obtains the data attribute set from the personal information;

[0081] The blockchain sends the data attribute set to the cloud service end, and the cloud service end then uploads the data attribute set to the cloud computing data storage platform;

[0082] The cloud computing data storage platform is provided with secondary access rights information for each user;

[0083] The cloud computing data storage platform compares the data attribute set with the secondary access permission information to determine whether the external visitor has access permission.

[0084] It is understandable that after the blockchain issues the dynamic key, the cloud server will upload the dynamic key and the data attribute set to the cloud computing data storage platform, where the data attribute set can be used for secondary identity authentication, such as whether the external visitor is from the same department and whether the security level allows their access. The identity authentication procedures of the cloud computing data storage platform and the blockchain are separated, thereby reducing the burden on the system and operating more smoothly.

[0085] Furthermore, the cloud computing data storage platform performs real-time dynamic key verification on external visitors who have passed the secondary identity verification, specifically including:

[0086] The cloud computing data storage platform verifies the time interval between the acquisition time of the dynamic key and the current time;

[0087] If the time interval exceeds the preset buffer time, the external visitor is notified that the dynamic key has expired;

[0088] If the time interval is within the buffer time, the real-time verification of the dynamic key is passed.

[0089] It can be understood that in this embodiment, if the request time is more than 5 minutes away from the dynamic key acquisition, the external visitor is notified that the dynamic key has expired. If it is within 5 minutes, the dynamic key is decrypted using the current timestamp to obtain the data owner's personal private key GK, and the ciphertext is decrypted using GK to provide access to cloud computing data.

[0090] In general, cloud computing data storage platform has the following functions:

[0091] 1. As the core of data hosting, the platform is responsible for storing users' encrypted sensitive data, and users can set access policies to limit access users.

[0092] 2. Realize the interface with blockchain technology to ensure the integrity and consistency of data, and protect the authenticity of data through the tamper-proof records of blockchain.

[0093] The cloud server has the following functions:

[0094] 1. The cloud server serves as the hub for users to interact with the cloud computing platform and blockchain, processing user access requests and data operation requests.

[0095] 2. Responsible for implementing CP-ABE-based access control policies to ensure that only requests that comply with the policies can access encrypted data.

[0096] 3. Manage the user’s authentication and authorization process, including receiving and verifying the user’s identity information, and registering the user’s identity on the blockchain.

[0097] 4. Dynamic key generation and distribution for processing data, ensuring that authorized users can decrypt and access requested data.

[0098] Blockchain integration has the following features:

[0099] 1. Provide a transparent and verifiable environment where users can audit data access history and strengthen control and privacy over data.

[0100] 2. Work with the cloud server to ensure that all data access requests are verified and recorded by the blockchain, enhancing the credibility of data operations.

[0101] 3. Use smart contracts to automatically execute access control policies and key distribution policies, reduce the need for centralized management, and improve the flexibility and responsiveness of the system.

[0102] In summary, the cloud computing data trusted tracking method in the above embodiments of the present invention can provide dual verification of the blockchain and the cloud computing data storage platform, greatly improving the security of the data. At the same time, the cloud computing data storage platform can upload the data owner's information to the blockchain in advance, and external visitors also need to obtain the dynamic key through blockchain verification when accessing, and then obtain the personal private key GK through the dynamic key, and decrypt the ciphertext with the personal private key GK. The data owner can view all access records of the ciphertext data through the blockchain system to track the flow of data, so as to achieve trusted tracking and protection of the data.

[0103] Embodiment 2

[0104] Please refer to Figure 3 , shown is a cloud computing data trusted tracking system 40 in a second embodiment of the present invention, comprising:

[0105] Cloud computing data storage platform 11: used to collect sensitive data uploaded by data owners, and set data attribute sets and access policies for the sensitive data according to the needs of the data owners; wherein the cloud computing data storage platform generates a master key MK and a corresponding public key PK for each user; encrypts the sensitive data using the public key PK and the access policy to generate a ciphertext, generates a personal private key GK based on the master key MK and the data attribute set, and uploads the ciphertext and personal information including the personal private key GK to the blockchain for secure storage; performs secondary identity authentication for external visitors, and performs real-time verification of dynamic keys for external visitors who have passed the secondary identity authentication. If the requirements are met, the dynamic key is unlocked using the current timestamp, and the personal private key GK corresponding to the sensitive data is obtained to provide access rights to the ciphertext;

[0106] Cloud server 12: used to receive a request from an external visitor to access the ciphertext and require the external visitor to provide key information. The cloud server sends a request to access the blockchain and uploads the key information of the external visitor; requests to query data from the cloud computing data storage platform and uploads the dynamic key;

[0107] Blockchain 13: used to perform primary identity authentication on the external visitor based on the personal information. The blockchain receives the key information of the external visitor who has passed the primary identity authentication, and calls the access policy of the accessed ciphertext to determine whether to send a dynamic key to the external visitor.

[0108] Embodiment 3

[0109] See also Figure 4 , shown is an electronic device in the third embodiment of the present invention, including a memory 10, a processor 20, and a computer program 30 stored in the memory 10 and executable on the processor 20, and when the processor 20 executes the computer program 30, the above-mentioned cloud computing data trusted tracking method is implemented.

[0110] Among them, the memory 10 includes at least one type of storage medium, and the storage medium includes a flash memory, a hard disk, a multimedia card, a card-type memory (for example, an SD or DX memory, etc.), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the memory 10 can be an internal storage unit of an electronic device, such as a hard disk of the electronic device. In other embodiments, the memory 10 can also be an external storage device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Further, the memory 10 can also include both an internal storage unit of the electronic device and an external storage device. The memory 10 can not only be used to store application software and various types of data installed in the electronic device, but also can be used to temporarily store data that has been output or is to be output.

[0111] Among them, in some embodiments, the processor 20 can be an electronic control unit (Electronic Control Unit, abbreviated as ECU, also known as a vehicle computer), a central processing unit (Central Processing Unit, CPU), a controller, a microcontroller, a microprocessor or other data processing chip, used to run the program code stored in the memory 10 or process data, such as executing access restriction programs, etc.

[0112] It should be pointed out that Figure 4The structure shown does not constitute a limitation on the electronic device. In other embodiments, the electronic device may include fewer or more components than those shown in the figure, or combine certain components, or arrange the components differently.

[0113] An embodiment of the present invention further provides a readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the cloud computing data trusted tracking method as described above is implemented.

[0114] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0115] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0116] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0117] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0118] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A method for credible tracking of cloud computing data, characterized in that: The steps include: The cloud computing data storage platform collects sensitive data uploaded by the data owner and sets data attribute sets and access policies for the sensitive data according to the needs of the data owner; wherein the cloud computing data storage platform generates a master key MK and a corresponding public key PK for each user; The cloud computing data storage platform encrypts the sensitive data using the public key PK and the access policy to generate a ciphertext, generates a personal private key GK based on the master key MK and the data attribute set, and uploads the ciphertext and the personal information containing the personal private key GK to the blockchain for secure storage; The cloud service end receives a request from an external visitor to access the ciphertext and requires the external visitor to provide key information. The cloud service end sends a request to access the blockchain and uploads the key information of the external visitor at the same time. The blockchain performs a primary identity authentication on the external visitor based on the personal information, receives key information of the external visitor who has passed the primary identity authentication, and calls the access policy of the accessed ciphertext to determine whether to send a dynamic key to the external visitor; The cloud service end requests the cloud computing data storage platform to query data and uploads the dynamic key. The cloud computing data storage platform performs secondary identity authentication on the external visitor and performs real-time verification of the dynamic key on the external visitor who has passed the secondary identity authentication. If the requirements are met, the dynamic key is unlocked using the current timestamp, and the personal private key GK corresponding to the sensitive data is obtained to provide access rights to the ciphertext; Before the cloud service end requires the external visitor to provide key information, it also includes: The cloud service end checks whether the external visitor has been registered on the blockchain; If not, the external visitor is required to fill in the primary identity information to complete the registration, wherein the primary identity information includes name and registration date; The key information includes time, place and reason for the visit; The blockchain performs a primary identity authentication on the external visitor based on the personal information, specifically including: The blockchain calls the personal information uploaded from the cloud computing data storage platform, and obtains a user group allowed to access from the personal information; The blockchain compares the primary identity information filled in by the external visitor when registering with the user group to determine whether the external visitor has the right to obtain the dynamic key; The blockchain receives the key information of the external visitor who has passed the primary identity authentication, and calls the access policy of the accessed ciphertext to determine whether to send a dynamic key to the external visitor, specifically including: The blockchain receives key information of the external visitor that has passed the primary identity verification; The blockchain calls the ciphertext uploaded from the cloud computing data storage platform and obtains the access policy from the ciphertext; The blockchain compares the key information provided by the external visitor with the access policy to determine whether to send a dynamic key to the external visitor.

2. The cloud computing data trustworthy tracking method according to claim 1, characterized in that: The data attribute set includes department and security level, and the access policy includes time, location, and reason for access.

3. The cloud computing data trustworthy tracking method according to claim 2, characterized in that: The cloud computing data storage platform performs secondary identity authentication on the external visitor, specifically including: The blockchain calls the personal information uploaded from the cloud computing data storage platform and obtains the data attribute set from the personal information; The blockchain sends the data attribute set to the cloud service end, and the cloud service end then uploads the data attribute set to the cloud computing data storage platform; The cloud computing data storage platform is provided with secondary access rights information for each user; The cloud computing data storage platform compares the data attribute set with the secondary access permission information to determine whether the external visitor has access permission.

4. The cloud computing data trustworthy tracking method according to claim 3, characterized in that: The cloud computing data storage platform performs real-time dynamic key verification on external visitors who have passed the secondary identity verification, specifically including: The cloud computing data storage platform verifies the time interval between the acquisition time of the dynamic key and the current time; If the time interval exceeds the preset buffer time, the external visitor is notified that the dynamic key has expired; If the time interval is within the buffer time, the real-time verification of the dynamic key is passed.

5. A cloud computing data trusted tracking system, characterized in that: include: Cloud computing data storage platform: used to collect sensitive data uploaded by data owners, and set data attribute sets and access policies for the sensitive data according to the needs of the data owners; wherein the cloud computing data storage platform generates a master key MK and a corresponding public key PK for each user; the sensitive data is encrypted using the public key PK and the access policy to generate a ciphertext, a personal private key GK is generated by encryption based on the master key MK and the data attribute set, and the ciphertext and personal information containing the personal private key GK are uploaded to the blockchain for secure storage; secondary identity authentication is performed on external visitors, and real-time verification of dynamic keys is performed on external visitors who have passed the secondary identity authentication. If the requirements are met, the dynamic key is unlocked using the current timestamp, and the personal private key GK corresponding to the sensitive data is obtained to provide access rights to the ciphertext; Cloud service end: used to receive the access request of the external visitor for the ciphertext, and require the external visitor to provide key information, the cloud service end sends the access request to the blockchain, and uploads the key information of the external visitor at the same time; requests the cloud computing data storage platform to query data, and uploads the dynamic key; Blockchain: used to perform primary identity authentication on the external visitor based on the personal information, the blockchain receives key information of the external visitor who has passed the primary identity authentication, and calls the access policy of the accessed ciphertext to determine whether to send a dynamic key to the external visitor; Before the cloud service end requires the external visitor to provide key information, it also includes: The cloud service end checks whether the external visitor has been registered on the blockchain; If not, the external visitor is required to fill in the primary identity information to complete the registration, wherein the primary identity information includes name and registration date; The key information includes time, place and reason for the visit; The blockchain performs a primary identity authentication on the external visitor based on the personal information, specifically including: The blockchain calls the personal information uploaded from the cloud computing data storage platform, and obtains a user group allowed to access from the personal information; The blockchain compares the primary identity information filled in by the external visitor when registering with the user group to determine whether the external visitor has the right to obtain the dynamic key; The blockchain receives the key information of the external visitor who has passed the primary identity authentication, and calls the access policy of the accessed ciphertext to determine whether to send a dynamic key to the external visitor, specifically including: The blockchain receives key information of the external visitor that has passed the primary identity verification; The blockchain calls the ciphertext uploaded from the cloud computing data storage platform and obtains the access policy from the ciphertext; The blockchain compares the key information provided by the external visitor with the access policy to determine whether to send a dynamic key to the external visitor.

6. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the cloud computing data trusted tracking method as described in any one of claims 1 to 4 is implemented.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the cloud computing data trusted tracking method according to any one of claims 1 to 4 is implemented.

Images