Cloud storage encryption integrated management system and encryption and decryption method thereof

Abstract

The invention discloses a cloud storage encryption integrated management system and an encryption and decryption method thereof, relates to the technical field of data encryption management, can automatically select the most suitable encryption algorithm according to the file type, the file size and the user demand, improves the encryption flexibility and efficiency, utilizes the decentration and non-tampering characteristics of the block chain technology to manage keys, and improves the encryption efficiency. The security of the secret key is improved, and the risk of single-point failure is reduced. A Shamir secret sharing algorithm is adopted to segment a secret key, the segmented secret key segments are stored in a distributed mode, the safety of the secret key is improved, it is ensured that even if part of the secret key segments are lost or damaged, the whole secret key can still be recovered, data block redundancy storage and RAID technologies are adopted, the reliability and availability of data are ensured, and the safety of the secret key is improved. And the integrity of the data can be ensured even under the condition of hardware failure.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption management, and in particular to a cloud storage encryption integrated management system and an encryption and decryption method thereof. Background Art

[0002] Cloud storage encryption is a network security technology used to protect data stored on cloud service providers. Cloud storage encryption can ensure that data remains private and intact when it is transmitted to cloud storage services, stored in cloud storage services, and transmitted from cloud storage services to users. With the development of cloud computing technology, more and more users choose to store data on cloud storage platforms.

[0003] Although there are some cloud storage encryption solutions in the existing technology, there are generally problems such as difficult key management and single encryption algorithm. At the same time, key management often relies on centralized servers, which poses a risk of single point failure, and the key generation, distribution and storage process is still unsafe.

[0004] Therefore, we proposed a cloud storage encryption integrated management system and its encryption and decryption methods to solve the above problems. Summary of the invention

[0005] The purpose of the present invention is to provide a cloud storage encryption integrated management system and an encryption and decryption method thereof to solve the current market problems raised by the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] Cloud storage encryption integrated management system, including:

[0008] Encryption module: Encrypt files before uploading. Adaptive encryption algorithm selection mechanism is used to automatically select the most suitable encryption algorithm according to the file type, size and user requirements.

[0009] Key management module: used to manage the keys used in the encryption process, using the decentralized and tamper-proof characteristics of blockchain technology to store and manage keys, splitting the keys through the Shamir secret sharing algorithm, and distributing the split key fragments;

[0010] Storage module: used to store encrypted file data blocks in the cloud storage system. Through data block redundant storage and RAID technology, data reliability and availability can be maintained even in the event of hardware failure.

[0011] Decryption module: When a user requests to download a file, it is used to decrypt the encrypted file by retrieving the key fragments in the distributed storage, recombining them into a complete key, and using the key to decrypt the file;

[0012] Access Control Module: Used to control and verify users' access rights to stored data. Combining two-factor authentication and role-based access control to ensure that only authenticated users with appropriate permissions can access specific data;

[0013] Security Monitoring and Auditing Module: Used to monitor data access behaviors in real time, record operation logs, and provide a detailed audit trail of system activities.

[0014] The encryption and decryption method of the cloud storage encryption integrated management system. The encryption process includes the following steps:

[0015] S1: Generate a unique file encryption key, use the AES-256-bit algorithm to encrypt the file in chunks, upload the encrypted file to cloud storage, and protect the key security by splitting and distributing the storage of the FEK;

[0016] S2: Use a hardware security module to generate the FEK, split the FEK into multiple segments, use the Shamir secret sharing algorithm for splitting, store the split key segments in different geographical locations, use blockchain technology for distributed storage, so that only legitimate users and authorized servers can access the key segments. At the same time, multiple authentications are required during the access process;

[0017] S3: Split the encrypted file into multiple data blocks, store each data block independently, and use RAID technology for storage;

[0018] The decryption process includes the following steps:

[0019] S4: When a user requests to download a file, the system verifies the user's identity and permissions. After successful verification, the system retrieves the key segments from the distributed storage, recombines them into a complete FEK, decrypts the file using the FEK, and then sends the decrypted file to the user;

[0020] S5: Adopt a two-factor authentication mechanism and role-based access control, assign different access permissions to different roles, and record all access and operation logs for security auditing and anomaly detection.

[0021] As a further optimization solution of the present invention, in S2, the specific steps of using the Shamir secret sharing algorithm to split the FEK into multiple key segments are:

[0022] S201: Determine the total number of secret shares, denoted as n, select a threshold, denoted as t (t < n), which is the minimum number of shares required to recover the secret;

[0023] S202: Create a polynomial containing n points, where the points represent n secret share holders, and the points are composed of the holder's identity and the secret share value held by the holder;

[0024] S203: In the polynomial, a point is selected as a secret root, the coefficient of the point is FEK, and other n-1 points are selected, the coefficients of these points are randomly generated;

[0025] S204: For each secret share holder, calculate the secret share value held by the holder, where the value is the interpolation result of the polynomial at the holder's identity identification point;

[0026] S205: Distribute each secret share to the corresponding holder, and the holder only knows his own secret share but does not know the shares of other holders;

[0027] S206: When FEK needs to be reconstructed, at least t secret share holders need to cooperate. Each holder provides his or her own secret share and uses these shares to interpolate the polynomial to obtain the value of FEK.

[0028] S207: All t holders use the reconstructed FEK to verify its validity. The verification can be completed by encrypting and decrypting a known plaintext and ciphertext pair.

[0029] As a further optimization solution of the present invention, in step S3, the size of the data block is first determined, the encrypted file is read, and its content is divided into multiple data blocks, a unique identifier is generated for each data block, and each data block and its identifier are stored in a designated location of the cloud storage system;

[0030] Among them, multiple physical disks are combined into a logical unit according to the RAID level, and data blocks are stored in these logical units in a dispersed manner. The RAID controller is responsible for data redundancy and fault tolerance; the system regularly checks the consistency of copies to ensure that all copies are up to date. When a copy is detected to be damaged or the data is inconsistent, the system will automatically repair or replace the copy.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] The present invention can automatically select the most appropriate encryption algorithm according to file type, size and user needs, thereby improving the flexibility and efficiency of encryption, and utilizing the decentralized and tamper-proof characteristics of blockchain technology to manage keys, thereby improving the security of keys and reducing the risk of single point failures.

[0033] The present invention adopts Shamir's secret sharing algorithm to split the key and distributes the split key fragments, which increases the security of the key and ensures that the overall key can still be recovered even if some key fragments are lost or damaged. It also adopts data block redundant storage and RAID technology to ensure data reliability and availability, and can ensure data integrity even in the event of hardware failure.

[0034] The above summary is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features of the present invention will be readily apparent by reference to the accompanying drawings and the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a module block diagram of the cloud storage encryption integrated management system of the present invention;

[0036] Figure 2 It is a flowchart of the encryption module in the cloud storage encryption integrated management system of the present invention;

[0037] Figure 3 This is a flowchart of the key management module in the cloud storage encryption integrated management system of the present invention;

[0038] Figure 4 It is a flowchart of the storage module in the cloud storage encryption integrated management system of the present invention;

[0039] Figure 5 This is a flowchart of the decryption module in the cloud storage encryption integrated management system of the present invention;

[0040] Figure 6 This is a flowchart of the access control module in the cloud storage encryption integrated management system of the present invention;

[0041] Figure 7 This is a flowchart of the security monitoring and auditing module in the cloud storage encryption integrated management system of the present invention. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Embodiment 1

[0044] See also Figure 1-Figure 7 , cloud storage encryption integrated management system, including:

[0045] Encryption module: Encrypt files before uploading. Adaptive encryption algorithm selection mechanism is used to automatically select the most suitable encryption algorithm according to the file type, size and user requirements.

[0046] Key management module: used to manage the keys used in the encryption process, using the decentralized and tamper-proof characteristics of blockchain technology to store and manage keys, splitting the keys through the Shamir secret sharing algorithm, and distributing the split key fragments;

[0047] Storage module: used to store encrypted file data blocks in the cloud storage system. Through data block redundant storage and RAID technology, data reliability and availability can be maintained even in the event of hardware failure.

[0048] Decryption module: When a user requests to download a file, it is used to decrypt the encrypted file by retrieving the key fragments in the distributed storage, recombining them into a complete key, and using the key to decrypt the file;

[0049] Access control module: used to control and verify user access rights to stored data, combining two-factor authentication and role-based access control to ensure that only authenticated users with appropriate permissions can access specific data;

[0050] Security monitoring and auditing module: used to monitor data access behavior in real time, record operation logs, and provide detailed audit tracking of system activities.

[0051] The encryption and decryption method of the cloud storage encryption integrated management system, the encryption process includes the following steps:

[0052] S1: Generate a unique file encryption key, encrypt the file in blocks using the AES-256 algorithm, upload the encrypted file to the cloud storage, and protect the key security by splitting and distributing the FEK;

[0053] Example 1:

[0054] When the file size is 10MB, the specific steps for the client software to use the AES-256 encryption algorithm and the generated FEK to encrypt the file in blocks are as follows:

[0055] 1. Split a 10MB file into data blocks of 1MB each, i.e. the file is split into 10 data blocks of 1MB each.

[0056] 2. Generate IV1 for the first data block, generate IV2 for the second data block, and so on until IV10 is generated.

[0057] 3. Use CBC mode so that the encryption of each data block is based on the encryption result of the previous data block. That is, the encryption result of the first data block is C1, and the encryption result of the second data block will be C2 = AES-256 (FEK, IV1 ⊕ C1), until all data blocks are encrypted.

[0058] 4. Store each encrypted data block and the corresponding IV together, store the encryption result C1 and IV1 of the first data block, store the encryption result C2 and IV2 of the second data block, until the encryption result C10 and IV10 of the tenth data block are stored.

[0059] 5. Upload all encrypted data blocks to the cloud storage server, upload the first data block C1, upload the second data block C2, until the tenth data block C10 is uploaded.

[0060] S2: Use a hardware security module to generate FEK, split the FEK into multiple fragments, use the Shamir secret sharing algorithm to split, store the split key fragments in different geographical locations, and use blockchain technology for distributed storage, so that only legitimate users and authorized servers can access the key fragments. At the same time, the access process requires multiple authentications;

[0061] In S2, for each secret share holder, HSM calculates the secret share value held by the holder, and the interpolation result of the polynomial at the holder's identity point is the holder's secret share, and distributes each secret share fragment to the corresponding holder. The holder only knows his own secret share, but does not know the shares of other holders. Distribute each secret share fragment to the corresponding holder.

[0062] In S2, the specific steps for using Truffle for Ethereum smart contract development and deployment are:

[0063] 1. Install the Node.js environment and use npm to install Truffle and Ganache. Ganache is an Ethereum client for local test network.

[0064] 2. Run the truffle init command in the project directory to create a new Truffle project structure. Select a preset template, or select a template to manually create a project structure.

[0065] 3. In the project directory, create a new Solidity file, such as KeyManager.sol, to define the smart contract. In the KeyManager.sol file, write the smart contract code, including the creation, storage, retrieval, and reconstruction logic of key fragments.

[0066] 4. In the project directory, run the `truffle compile` command to compile the smart contract. The compiled smart contract will be compiled into bytecode and an ABI file will be generated for interacting with the smart contract.

[0067] 5. Use the `truffle migrate` command to deploy the smart contract to the Ganache local test network or the Ethereum mainnet. During the deployment process, specify the name, ABI, and bytecode of the contract, as well as the address and port to deploy to the network.

[0068] 6. Use the Shamir secret sharing algorithm to split the FEK into multiple key fragments and assign a unique identifier to each key fragment.

[0069] 7. Upload each key fragment and its identifier to the Ethereum blockchain and call the corresponding function in the smart contract to register and store the key fragments.

[0070] 8. Store the key fragments in different geographical locations. Each storage location can be an Ethereum node responsible for storing and verifying the key fragments.

[0071] 9. Implement access control logic in the smart contract to define which users or entities are authorized to access specific key fragments. The smart contract will verify the identity and permissions of the requester to ensure that only authorized users can access the key fragments.

[0072] 10. When it is necessary to reconstruct the FEK, a user or entity can request the smart contract, and the smart contract will coordinate multiple storage locations to collect enough key fragments to reconstruct the FEK.

[0073] The distributed nature of the Ethereum blockchain ensures the immutability and transparency of the key fragments. Once the data is stored on the blockchain, it is difficult to be tampered with or deleted.

[0074] In S2, the specific steps to split the FEK into multiple key fragments using the Shamir secret sharing algorithm are as follows:

[0075] S201: Determine the total number of secret shares, denoted as n, and select a threshold, denoted as t (t < n), which is the minimum number of shares required to recover the secret;

[0076] S202: Create a polynomial containing n points. The points represent n secret share holders, and each point consists of the holder's identity identifier and the value of the secret share they hold;

[0077] S203: In the polynomial, select one point as the root of the secret. The coefficient of this point is the FEK, and select the other n - 1 points, whose coefficients are randomly generated;

[0078] S204: For each secret share holder, calculate the secret share value held by the holder, where the value is the interpolation result of the polynomial at the holder's identity identification point;

[0079] S205: Distribute each secret share to the corresponding holder, and the holder only knows his own secret share but does not know the shares of other holders;

[0080] S206: When FEK needs to be reconstructed, at least t secret share holders need to cooperate. Each holder provides his or her own secret share and uses these shares to interpolate the polynomial to obtain the value of FEK.

[0081] S207: All t holders use the reconstructed FEK to verify its validity. The verification can be completed by encrypting and decrypting a known plaintext and ciphertext pair.

[0082] S3: Split the encrypted file into multiple data blocks, each of which is stored independently using RAID technology;

[0083] In S3, the specific steps of using RAID technology for storage are:

[0084] 1. Use three hard disk drives, each with the same capacity and interface type, and connect the hard disks to a RAID controller or use software RAID.

[0085] 2. Use a RAID controller or mdadm to configure RAID 5, specify the number of hard disks to use, and specify the stripe size when creating the RAID5 array.

[0086] 3. Format the RAID 5 array and create a file system such as ext4, xfs, or ntfs. The formatting process will create a volume that will contain the data on all RAID 5 member hard drives.

[0087] 4. Split the encrypted file into multiple data blocks. When the size of each data block is 1MB, a 10MB file will be split into 10 1MB data blocks.

[0088] 5. Stripe the encrypted data blocks to multiple hard disks in a RAID 5 array, where data blocks and parity information are stored alternately on different hard disks. The RAID 5 controller calculates parity information for each data block, and the parity information is used to recover lost data when a single hard disk fails.

[0089] 6. Write the encrypted data blocks and parity information to the RAID 5 array. Each striping unit, including the data blocks and parity information, will be written to different hard disks in the array.

[0090] 7. Regularly check the health of the RAID 5 array, monitor the performance and health of the RAID array, and ensure that there are no hard drive failures. In the event of a hard drive failure, the RAID 5 array will automatically fail over, the system detects the failure, and extracts data blocks and parity information from the remaining hard drives to reconstruct the lost data. At the same time, data can be recovered from the RAID 5 array. That is, when a single file needs to be recovered, the corresponding data block is extracted from the RAID array.

[0091] In step S3, first determine the size of the data block, read the encrypted file, and divide its content into multiple data blocks, generate a unique identifier for each data block, and store each data block and its identifier in a designated location of the cloud storage system;

[0092] Among them, multiple physical disks are combined into a logical unit according to the RAID level, and data blocks are stored in these logical units in a dispersed manner. The RAID controller is responsible for data redundancy and fault tolerance; the system regularly checks the consistency of copies to ensure that all copies are up to date. When a copy is detected to be damaged or the data is inconsistent, the system will automatically repair or replace the copy.

[0093] The decryption process includes the following steps:

[0094] S4: When a user requests to download a file, the system verifies the user's identity and permissions. After verification, the system retrieves the key fragments from the distributed storage and reassembles them into a complete FEK. The system uses the FEK to decrypt the file and then sends the decrypted file to the user.

[0095] S5: Adopts two-factor authentication mechanism and role-based access control, assigns different access rights to different roles, and records all access and operation logs for security auditing and anomaly detection.

[0096] In step S4, the user logs in to the system, and the system requires the user to enter a username and password. After the username and password are verified, the system starts the 2FA process, and the user provides the second authentication factor, and the system verifies it. After the verification is passed, the system assigns permissions according to the user role. The user operates in the system, and the system records all the user's operations and access requests. Each operation is recorded in the audit log, including timestamp, user information, operation type, operation results and related resources. Auditors regularly check the audit logs to conduct security audits and anomaly detection. When anomalies are found, the system takes corresponding restrictive measures.

[0097] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0098] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0099] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0100] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. Cloud storage encryption integrated management system, characterized by: It includes: Encryption module: Encrypts the file before uploading. Through the adaptive encryption algorithm selection mechanism, it automatically selects the most suitable encryption algorithm according to the file type, size, and user requirements. Key management module: Manages the keys used in the encryption process. Utilizes the decentralized and tamper-proof characteristics of blockchain technology to store and manage keys. Splits the keys through the Shamir secret sharing algorithm and distributes and stores the split key fragments. Storage module: Stores the encrypted file data blocks in the cloud storage system. Through data block redundant storage and RAID technology, it can maintain data availability in case of hardware failures.

2. The cloud storage encryption integrated management system according to claim 1, characterized in that: It also includes: Decryption module: When the user requests to download the file, it decrypts the encrypted file. Retrieves the key fragments from the distributed storage, recombines them into a complete key, and uses this key to decrypt the file. Access control module: Controls and verifies the user's access rights to the stored data. Combines two-factor authentication and role-based access control to ensure that only authenticated users with appropriate permissions can access specific data. Security monitoring and auditing module: Monitors data access behaviors in real-time, records operation logs, and provides a detailed audit trail of system activities.

3. The encryption and decryption method of the cloud storage encryption integrated management system is applied to the cloud storage encryption integrated management system as claimed in any one of claims 1 to 2, characterized in that: The encryption process includes the following steps: S1: Generates a unique file encryption key, encrypts the file in chunks using the AES-256-bit algorithm, uploads the encrypted file to the cloud storage, and protects the key security by splitting and distributing the storage of the FEK. S2: Uses a hardware security module to generate the FEK, splits the FEK into multiple fragments, splits them using the Shamir secret sharing algorithm, stores the split key fragments in different geographical locations, and uses blockchain technology for distributed storage, so that only legitimate users and authorized servers can access the key fragments. At the same time, multiple authentications are required during the access process. S3: Splits the encrypted file into multiple data blocks, stores each data block independently, and uses RAID technology for storage.

4. The encryption and decryption method of the cloud storage encryption integrated management system according to claim 3 is characterized in that: The decryption process includes the following steps: S4: When the user requests to download the file, the system verifies the user's identity and permissions. After successful verification, the system retrieves the key fragments from the distributed storage, recombines them into a complete FEK, decrypts the file using the FEK, and then sends the decrypted file to the user. S5: Adopts a two-factor authentication mechanism and role-based access control, assigns different access permissions to different roles, and records all access and operation logs for security auditing and anomaly detection.

5. The encryption and decryption method of the cloud storage encryption integrated management system according to claim 3 is characterized in that: In S2, the specific steps of splitting the FEK into multiple key fragments using the Shamir secret sharing algorithm are: S201: Determines the total number of secret shares, denoted as n, selects a threshold, denoted as t (t < n), which is the minimum number of shares required to recover the secret. S202: Creates a polynomial containing n points. The points represent n secret share holders, and each point consists of the holder's identity identifier and the value of the secret share it holds. S203: In the polynomial, a point is selected as a secret root, the coefficient of the point is FEK, and other n-1 points are selected, the coefficients of these points are randomly generated; S204: For each secret share holder, calculate the secret share value held by the holder, where the value is the interpolation result of the polynomial at the holder's identity identification point; S205: Distribute each secret share to the corresponding holder, and the holder only knows his own secret share but does not know the shares of other holders; S206: When FEK needs to be reconstructed, at least t secret share holders need to cooperate. Each holder provides his or her own secret share and uses these shares to interpolate the polynomial to obtain the value of FEK. S207: All t holders use the reconstructed FEK to verify its validity. The verification can be completed by encrypting and decrypting a known plaintext and ciphertext pair.

6. The encryption and decryption method of the cloud storage encryption integrated management system according to claim 3 is characterized in that: In step S3, first determine the size of the data block, read the encrypted file, and divide its content into multiple data blocks, generate a unique identifier for each data block, and store each data block and its identifier in a designated location of the cloud storage system; Among them, multiple physical disks are combined into a logical unit according to the RAID level, and data blocks are stored in these logical units in a dispersed manner. The RAID controller is responsible for data redundancy and fault tolerance; the system regularly checks the consistency of copies to ensure that all copies are up to date. When a copy is detected to be damaged or the data is inconsistent, the system will automatically repair or replace the copy.

7. The encryption and decryption method of the cloud storage encryption integrated management system according to claim 3 is characterized in that: In step S4, the user logs in to the system, and the system requires the user to enter a username and password. After the username and password are verified, the system starts the 2FA process, and the user provides the second authentication factor, and the system verifies it. After the verification is passed, the system assigns permissions according to the user role, and the user operates in the system. The system records all operations and access requests of the user. Each operation is recorded in the audit log, including timestamp, user information, operation type, operation results and related resources. Auditors regularly check the audit logs, conduct security audits and anomaly detection. When anomalies are found, the system takes corresponding restrictive measures.

Images