Ciphertext data tampering judgment method and device and storage medium

Abstract

The invention discloses a ciphertext data tampering judgment method and device and a storage medium, and the method comprises the steps: determining the ciphertext data of to-be-stored plaintext data and a message authentication code during data storage, and transmitting the ciphertext data and the message authentication code to a cloud provider; and when a service is executed through the ciphertext data in the cloud provider, acquiring encrypted data sent by the cloud provider, and decrypting the ciphertext data in the encrypted data to determine a message authentication code of a decryption result. And judging whether the ciphertext data in the encrypted data is tampered or not according to the message authentication code of the decryption result and the message authentication code in the encrypted data. As the determined message authentication code is related to the encryption key, an attacker cannot know the encryption key and cannot forge the message authentication code. When the enterprise side uses the encrypted data, whether the ciphertext data in the encrypted data is tampered or not can be judged through the message authentication code of the decryption result corresponding to the ciphertext data and the message authentication code in the encrypted data.

Description

Technical Field

[0001] This specification relates to the field of computers, and in particular, to a method, device, and storage medium for judging the tampering of ciphertext data. Background Art

[0002] In the current scenario where the amount of data is increasing day by day, an enterprise can store its own data on the side of a cloud service provider, thereby reducing the cost of storing data by the enterprise itself. To prevent the leakage of the enterprise's own private data, the enterprise generally uses homomorphic encryption technology to encrypt the data and conducts data transmission in a trusted execution environment to ensure the security of data transmission, storage, and calculation on the enterprise side and the cloud service provider side.

[0003] Since business operations usually involve comparison operations, that is, comparing the sizes of data, the enterprise can use the order-preserving encryption algorithm in homomorphic encryption technology to encrypt its own data, because the order-preserving encryption algorithm maintains the relative order of the data during the encryption process.

[0004] However, the order-preserving encryption algorithm cannot provide integrity protection for plaintext data, that is, the enterprise cannot determine whether the data obtained after decrypting the ciphertext data is the original plaintext data, which is likely to cause losses to the enterprise itself. For example, there is a plaintext data {1, 2, 3, 4}, and the encrypted ciphertext data is {C1, C2, C3, C4}, where C1 < C2 < C3 < C4. An attacker tampers with the ciphertext data C3 into C3', and C3' is still less than C4 and greater than C2. The decrypted plaintext data is {1, 2, 3.2, 4}, and this relative order is still reasonable, but it is obviously not the original plaintext data, and the enterprise cannot identify that the ciphertext data has been tampered with. Then, in the financial scenario, if the ciphertext data is tampered with and not discovered, it may lead to incorrect account reconciliation of financial institutions and direct economic losses.

[0005] Therefore, how to judge whether the ciphertext data has been tampered with is an urgent problem to be solved. Based on this, this specification provides a method for judging the tampering of ciphertext data. Summary of the Invention

[0006] This specification provides a method, device, storage medium, and electronic device for judging the tampering of ciphertext data to at least partially solve the above problems existing in the prior art.

[0007] This specification adopts the following technical solutions: This specification provides a method for judging the tampering of ciphertext data, including: When storing the plaintext data to be stored in a cloud service provider, encrypt the plaintext data to be stored to obtain the ciphertext data of the plaintext data to be stored; determine the message authentication code of the plaintext data to be stored according to a preset algorithm; Sending the ciphertext data and the message authentication code to the cloud service provider for storage; When executing a service through ciphertext data stored in the cloud service provider, receiving encrypted data sent by the cloud service provider, the encrypted data including ciphertext data and a message authentication code; Decrypting the ciphertext data in the encrypted data to obtain a decryption result; Determine the message authentication code of the decryption result according to the preset algorithm; According to the message authentication code of the decryption result and the message authentication code in the encrypted data, it is determined whether the ciphertext data in the encrypted data has been tampered with.

[0008] Optionally, encrypting the plaintext data to be stored to obtain ciphertext data of the plaintext data to be stored specifically includes: The plaintext data to be stored is encrypted by an order-preserving encryption algorithm to obtain ciphertext data of the plaintext data to be stored.

[0009] Optionally, the preset algorithm includes a hash-based message authentication code algorithm or a Galois hash algorithm.

[0010] Optionally, sending the ciphertext data and the message authentication code to the cloud service provider for storage specifically includes: Determining the encrypted data of the plaintext data to be stored based on the ciphertext data of the plaintext data to be stored and the message authentication code; The encrypted data of the plaintext data to be stored is sent to the cloud service provider for storage.

[0011] Optionally, determining the encrypted data of the plaintext data to be stored based on the ciphertext data of the plaintext data to be stored and the message authentication code specifically includes: According to a preset splicing order, the ciphertext data and the message authentication code of the plaintext data to be stored are spliced ​​to obtain a splicing result; The splicing result is determined as the encrypted data of the plaintext data to be stored.

[0012] Optionally, receiving the encrypted data sent by the cloud service provider specifically includes: Sending a query request to the cloud service provider, the query request including a query condition for the acquired encrypted data; Receive encrypted data determined by the cloud service provider based on the query condition.

[0013] Optionally, judging whether the ciphertext data in the encrypted data has been tampered with according to the message authentication code of the decryption result and the message authentication code in the encrypted data specifically includes: Determine whether the message authentication code of the decryption result matches the message authentication code in the encrypted data, and obtain a determination result; If the judgment result is mismatch, the ciphertext data in the encrypted data has been tampered with; If the judgment result is a match, the ciphertext data in the encrypted data has not been tampered with.

[0014] Optionally, when the ciphertext data is tampered with, the method further includes: Stop executing the business; and send data tampering information to the cloud service provider so that the cloud service provider sends log records; Receiving log records sent by the cloud service provider; Based on the log records, security vulnerabilities are identified and fixed.

[0015] This specification provides a device for determining whether ciphertext data has been tampered with, the device comprising: An encryption module is used to encrypt the plaintext data to be stored when storing the plaintext data to be stored in the cloud service provider to obtain the ciphertext data of the plaintext data to be stored; and determine the message authentication code of the plaintext data to be stored according to a preset algorithm; A storage module, used for sending the ciphertext data and the message authentication code to the cloud service provider for storage; An encrypted data acquisition module, used to receive encrypted data sent by the cloud service provider when executing a business through the ciphertext data stored in the cloud service provider, the encrypted data including the ciphertext data and the message authentication code; A decryption module, used to decrypt the ciphertext data in the encrypted data to obtain a decryption result; A message authentication code determination module, used to determine the message authentication code of the decryption result according to the preset algorithm; The judgment module is used to judge whether the ciphertext data in the encrypted data has been tampered with according to the message authentication code of the decryption result and the message authentication code in the encrypted data.

[0016] Optionally, the encryption module is specifically used to encrypt the plaintext data to be stored by using an order-preserving encryption algorithm to obtain ciphertext data of the plaintext data to be stored.

[0017] Optionally, the preset algorithm includes a hash-based message authentication code algorithm or a Galois hash algorithm.

[0018] Optionally, the storage module is specifically used to determine the encrypted data of the plaintext data to be stored based on the ciphertext data and the message authentication code of the plaintext data to be stored; and send the encrypted data of the plaintext data to be stored to the cloud service provider for storage.

[0019] Optionally, the storage module is specifically used to splice the ciphertext data and the message authentication code of the plaintext data to be stored according to a preset splicing order to obtain a splicing result; and determine the splicing result as the encrypted data of the plaintext data to be stored.

[0020] Optionally, the encrypted data acquisition module is specifically configured to send a query request to the cloud service provider, wherein the query request includes a query condition for the acquired encrypted data; and receive the encrypted data determined by the cloud service provider based on the query condition.

[0021] Optionally, the judgment module is specifically used to judge whether the message authentication code of the decryption result matches the message authentication code in the encrypted data to obtain a judgment result; if the judgment result is mismatch, the ciphertext data in the encrypted data has been tampered with; if the judgment result is match, the ciphertext data in the encrypted data has not been tampered with.

[0022] Optionally, when the ciphertext data is tampered with, the device further includes: The repair module is used to stop executing the business; send data tampering information to the cloud service provider so that the cloud service provider sends log records; receive the log records sent by the cloud service provider; and determine and repair security vulnerabilities based on the log records.

[0023] This specification provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned method for determining whether ciphertext data has been tampered with is implemented.

[0024] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned method for determining whether tampering of ciphertext data has occurred when executing the program.

[0025] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects: In the method for determining tampering of ciphertext data provided in this specification, when the plaintext data to be stored is stored in a cloud service provider, the plaintext data to be stored is encrypted to obtain the ciphertext data of the plaintext data to be stored; and the message authentication code of the plaintext data to be stored is determined according to a preset algorithm. The ciphertext data and the message authentication code are sent to the cloud service provider for storage, and when a business is performed through the ciphertext data stored in the cloud service provider, the encrypted data sent by the cloud service provider is received, and the encrypted data includes the ciphertext data and the message authentication code. The ciphertext data in the encrypted data is decrypted to obtain a decryption result, and the message authentication code of the decryption result is determined according to the preset algorithm. Based on the message authentication code of the decryption result and the message authentication code in the encrypted data, it is determined whether the ciphertext data in the encrypted data has been tampered with.

[0026] It can be seen from the above method that since the determined message authentication code is related to the encryption key, and the attacker cannot know the encryption key, the message authentication code cannot be forged. The ciphertext data corresponding to the plaintext data is combined with the message authentication code. When the enterprise uses it, it can judge whether the ciphertext data in the encrypted data has been tampered with by the message authentication code of the decryption result corresponding to the ciphertext data and the message authentication code in the encrypted data. If the ciphertext data in the encrypted data is tampered with, the message authentication code corresponding to the decryption result of the ciphertext data will also change. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The illustrative embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification. In the drawings: Figure 1 A schematic diagram of the data outsourcing scenario interaction provided in this manual; Figure 2 A flowchart of a method for determining tampering of encrypted data provided in this specification; Figure 3 A schematic diagram for determining encrypted data provided for this specification; Figure 4 The encryption flow chart provided for this manual; Figure 5 A schematic diagram of the process of determining a message authentication code provided in this specification; Figure 6 A schematic diagram of the decryption process provided for this manual; Figure 7 A schematic diagram of a device for determining tampering of encrypted data provided in this specification; Figure 8 The corresponding Figure 2 Schematic diagram of electronic equipment. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0029] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0030] Figure 1 The interactive diagram of the data outsourcing scenario provided for this manual is as follows: Figure 1 shown.

[0031] In the data outsourcing DBMS (Database Management System, DBMS) query scenario, that is, in order to reduce the enterprise's own data storage costs and ensure data security, the enterprise encrypts its own data through secret computing technology, obtains encrypted data, and sends it to the cloud service provider (cloud merchant). When the enterprise needs to perform business based on the encrypted data, it sends a query request to the cloud service provider, and the cloud service provider will determine the query result based on the query request and return the query result to the enterprise.

[0032] However, when the secret computing technology is an order-preserving encryption algorithm, the enterprise cannot confirm whether the ciphertext data obtained from the cloud service provider has been tampered with, that is, there is a lack of integrity protection. Integrity protection refers to a series of measures and technologies to ensure that data is not modified, deleted, added or tampered with in other ways without authorization during storage, transmission or processing. The lack of integrity protection may have an impact on subsequent business, such as the inability to execute business, incorrect business execution results, etc. Therefore, this specification provides a method for determining whether the ciphertext data has been tampered with. The execution subject of this specification can be a computing device of a user who can execute the method for determining whether the ciphertext data has been tampered with provided in this specification, such as a server, or it can be a device such as a desktop computer, a laptop computer, etc. This specification does not limit this. For the sake of ease of description, the following only takes the server as the execution subject to illustrate the method for determining whether the ciphertext data has been tampered with provided in this specification.

[0033] Figure 2 The flowchart of a method for determining whether ciphertext data has been tampered with provided in this specification specifically includes the following steps: S100: When storing the plaintext data to be stored in the cloud service provider, encrypt the plaintext data to be stored to obtain the ciphertext data of the plaintext data to be stored; and determine the message authentication code of the plaintext data to be stored according to a preset algorithm.

[0034] In one or more embodiments of this specification, a cloud service provider (Cloud Service Provider, CSP) refers to a service provider that provides various cloud computing services, which generally include Infrastructure as a Service (Infrastructure as a Service, IaaS), Platform as a Service (Platform as a Service, PaaS) and Software as a Service (Software as a Service, SaaS). Cloud service providers allow users to access and utilize these resources through the Internet without having to purchase and maintain physical hardware and software locally. Among them, users in this specification may include users of cloud computing services provided by cloud vendors, such as the aforementioned corporate parties, etc.

[0035] When the server needs to store the plaintext data to be stored to the cloud service provider, it can first encrypt the plaintext data to be stored to obtain the ciphertext data of the plaintext data to be stored to ensure that the plaintext data to be stored is not stolen or tampered with by other parties. The server can encrypt the plaintext data to be stored by an order-preserving encryption algorithm to obtain the ciphertext data of the plaintext data to be stored. The order-preserving encryption algorithm can be non-indexed, and of course, it can also be indexed, and this manual does not limit this. Order-preserving encryption is a type of secret computing technology that supports enterprises to transmit and store encrypted ciphertext data to cloud service providers, and supports comparison operations based on ciphertext data (such as >, <, =, >=, <=).

[0036] In order to facilitate subsequent verification of whether the ciphertext data has been tampered with, the server can also determine the message authentication code (MAC) of the plaintext data to be stored according to a preset algorithm, which includes a hash-based message authentication code algorithm (Hash-based Message Authentication Code, HMAC) or a Galois hash algorithm (GHash).

[0037] Figure 3 A schematic diagram for determining encrypted data provided in this specification, such as Figure 3 shown.

[0038] There is a plaintext data A to be stored which is 1234. The ciphertext data 12341234 is obtained through the order-preserving encryption algorithm, and the message authentication code FEABCDEA of the plaintext data to be stored is obtained through the HMAC algorithm.

[0039] S102: Send the ciphertext data and the message authentication code to the cloud service provider for storage.

[0040] Specifically, the server can determine the encrypted data of the plaintext data to be stored based on the ciphertext data of the plaintext data to be stored and the message authentication code. After obtaining the encrypted data, the encrypted data of the plaintext data to be stored can be sent to the cloud service provider for storage.

[0041] When determining the encrypted data, the server can splice the ciphertext data and the message authentication code of the plaintext data to be stored according to a preset splicing order to obtain a splicing result, and determine the splicing result as the encrypted data of the plaintext data to be stored. Generally speaking, the splicing order can be ciphertext data first and message authentication code later, so as to facilitate comparison and calculation on the cloud service provider side. This is because the ciphertext data is encrypted using an order-preserving encryption algorithm, and the ciphertext data retains the relative order of the plaintext data. The comparison operation can be completed by comparing the ciphertext data alone, without comparing the message authentication code, thus saving computing resources. Continuing with the above example, if Figure 3 As shown, the encrypted data of the plaintext data 1234 to be stored is Enc (A) 12341234FEABCDEA. Of course, splicing can be omitted, and the ciphertext data and message authentication code of the plaintext data to be stored can be directly sent to the cloud service provider for storage. However, there needs to be a corresponding relationship between the ciphertext data and the message authentication code. In other words, the server and the cloud service provider need to know the message authentication code corresponding to each ciphertext data, so as to determine whether the ciphertext data has been tampered with based on the message authentication code. For example, there is a ciphertext data A, and a corresponding message authentication code 1. The server can also record the corresponding relationship between the ciphertext data and the message authentication code, and send the corresponding relationship, the ciphertext data, and the message authentication code to the cloud service provider for storage.

[0042] It should be noted that since an encryption key is required in the process of determining a message authentication code, and an attacker usually cannot obtain and tamper with the encryption key, the ciphertext data is combined with the message authentication code, and the message authentication code can be determined later to determine whether the ciphertext data has been tampered with.

[0043] S104: When executing a service through the ciphertext data stored in the cloud service provider, receiving encrypted data sent by the cloud service provider, the encrypted data including the ciphertext data and a message authentication code.

[0044] When executing business through ciphertext data stored in the cloud service provider, the server can send a query request to the cloud service provider, and the query request includes the query conditions for the obtained encrypted data. For example, the query condition is to obtain ciphertext data with an ID number greater than 10 in the stored ciphertext data. Of course, the query condition will also be encrypted by the order-preserving encryption algorithm. This is because the object of the comparison operation is the ciphertext data, so the query condition is also to filter the ciphertext data. In addition, encrypting the query condition also further protects the security of the data to prevent attackers from determining the stored data based on the query condition, causing data leakage.

[0045] For cloud service providers, based on the query conditions, they can query the stored ciphertext data, obtain the ciphertext data that meets the query conditions, and return the ciphertext data and the message authentication code of the ciphertext data to the server. If the ciphertext data and the message authentication code are spliced, then the encrypted data is the ciphertext data. If not spliced, then when returning, after obtaining the ciphertext data that meets the query conditions, the cloud service provider must also determine the message authentication code corresponding to the ciphertext data that meets the query conditions based on the stored correspondence, and return the message authentication code and the ciphertext data to the server together. Then, the encrypted data includes the ciphertext data and the message authentication code.

[0046] The server receives the encrypted data determined by the cloud service provider based on the query condition.

[0047] S106: Decrypt the ciphertext data in the encrypted data to obtain a decryption result.

[0048] Since the server uses an order-preserving encryption algorithm during encryption, when decrypting the ciphertext data in the encrypted data, the decryption algorithm corresponding to the order-preserving encryption algorithm should be used to decrypt and obtain the decryption result.

[0049] S108: Determine a message authentication code of the decryption result according to the preset algorithm.

[0050] In one or more embodiments of the present specification, when determining the message authentication code of the decryption result, the preset algorithm needs to be consistent with the preset algorithm used by the server to determine the message authentication code of the plaintext data to be stored. For example, if the preset algorithm used by the server to determine the message authentication code of the plaintext data to be stored is the HMAC algorithm, then the HMAC algorithm should also be used when determining the message authentication code of the decryption result.

[0051] S110: Determine whether the ciphertext data in the encrypted data has been tampered with based on the message authentication code of the decryption result and the message authentication code in the encrypted data.

[0052] Specifically, if the ciphertext data has not been tampered with, the message authentication code of the decryption result should be consistent with the message authentication code in the encryption result. In other words, the server can determine whether the message authentication code of the decryption result matches the message authentication code in the encrypted data, obtain a judgment result, and determine whether the ciphertext data in the encrypted data has been tampered with based on the judgment result. If the judgment result is not a match, the ciphertext data in the encrypted data has been tampered with. If the judgment result is a match, the ciphertext data in the encrypted data has not been tampered with.

[0053] It should be noted that even if the ciphertext data and the message authentication code are concatenated, the server can distinguish the ciphertext data and the message authentication code in the encrypted data by marking, etc., so as to subsequently decrypt the ciphertext data in the encrypted data and use the message authentication code in the encrypted data to determine whether the ciphertext data in the encrypted data has been tampered with.

[0054] For example, when performing splicing to obtain encrypted data, the server determines the number of data bits of the ciphertext data and records it. Then, the ciphertext data and the message authentication code can be distinguished based on the number of data bits.

[0055] based on Figure 2 The method for determining whether ciphertext data has been tampered with is shown in the example. Since the determined message authentication code is related to the encryption key, and the attacker cannot know the encryption key, the message authentication code cannot be forged. The ciphertext data corresponding to the plaintext data is combined with the message authentication code. When the enterprise uses it, it can determine whether the ciphertext data in the encrypted data has been tampered with by comparing the message authentication code of the decryption result corresponding to the ciphertext data with the message authentication code in the encrypted data. If the ciphertext data in the encrypted data has been tampered with, the message authentication code corresponding to the decryption result of the ciphertext data will also change.

[0056] For step S100, Figure 4 The encryption flow chart provided for this manual is as follows: Figure 4 shown.

[0057] The server can use a traditional order-preserving encryption algorithm to encrypt the plaintext data to be stored. Specifically, the server needs to first determine the first boundary value and the second boundary value of the encryption domain, the third boundary value and the fourth boundary value of the ciphertext domain, and the plaintext data to be stored. After that, the encryption intermediate variable is determined according to the first boundary value and the second boundary value, and the ciphertext domain difference is determined according to the third boundary value and the fourth boundary value. Among them, the encryption intermediate variable is used to divide the value of the search range. Then, the pseudo-random number generator is initialized by a deterministic seed function, and a random number is determined based on the pseudo-random number generator according to a preset screening condition. Then, the encrypted mapping data is determined based on the random number, the first boundary value and the encrypted intermediate variable. Finally, the relationship between the encrypted intermediate variable and the plaintext data to be stored is determined, and the ciphertext data is determined according to the relationship and the encrypted mapping data. That is, if the relationship is that the encrypted intermediate variable is equal to the plaintext data to be stored, it means that the correct ciphertext data has been found, and the encrypted mapping data is determined as the ciphertext data. If the encrypted intermediate variable is larger than the plaintext data to be stored, it means that the encrypted intermediate variable is smaller than the second boundary value, and the plaintext data to be stored is between the encrypted intermediate variable and the first boundary value, then the second boundary value is replaced by the encrypted intermediate variable, and the encryption process is re-executed. If the encrypted intermediate variable is smaller than the plaintext data to be stored, it means that the encrypted intermediate variable is larger than the first boundary value, and the plaintext data to be stored is between the encrypted intermediate variable and the second boundary value, then the first boundary value is replaced by the encrypted intermediate variable, and the encryption process is re-executed.

[0058] For example, the first boundary value and the second boundary value of the encryption domain are respectively a 1 and b 1 , the third boundary value and the fourth boundary value of the ciphertext domain are f(a 1 ) and f(b 1 ), the plaintext data to be stored is m, and the encrypted intermediate variable is x 1 Then, when x 1 =(a 1 +b 1 ) / 2, it means that the encrypted intermediate variable is the midpoint of the current search range. The encrypted intermediate variable can be used to enable the order-preserving encryption algorithm to determine the direction of the next search. If the ciphertext domain difference y 1 =f(b 1 )-f(a 1 ), through the deterministic seed function S(a 1 , b 1 , f(a 1 ), f(b 1 )) Initialize the pseudo-random number generator F. Use the preset conditions to randomly select a number between [0, y 1 ], such that the probability Pr(z∈[y 1 / 4,3y 1 / 4]) can be ignored to obtain a random number z. The encrypted mapped data is f(x 1 ) = f(a 1 ) + z. Then, by determining whether m is on the left or right side of x 1 , the next search direction can be determined. When x 1 is equal to m, the order-preserving encryption algorithm finds the correct encrypted value and returns it. If x 1 is not equal to m, the order-preserving encryption algorithm will narrow the search range to the left half or the right half according to the size relationship between x 1 and m, and then recursively apply the encryption process again. That is, if x 1 > m, recursively call the order-preserving encryption algorithm, passing in (a 1 , x 1 , f(a 1 ), f(x 1 ), m). If x 1 < m, recursively call the order-preserving encryption algorithm, passing in (x 1 , b 1 , f(x 1 ), f(b 1 ), m).

[0059] Figure 5 is a schematic flow diagram for determining the message authentication code provided in this specification, as Figure 5 shown.

[0060] Taking HMAC-SHA256 as an example, the calculation formula of HMAC-SHA256 is as follows:

[0061] Among them, is the information to be authenticated. In this specification, the information to be authenticated can be the plaintext data to be stored in step S100, or the decryption result in S106. is the original key, is the initial key, which can be obtained through . refers to the external padding constant, refers to the internal padding constant, is a sequence composed of the hexadecimal value 0x36, and this sequence will repeat until it is equal to the block size of the hash function is a sequence composed of the hexadecimal value 0x5C, and it will also repeat until it is equal to the block size of the hash function.

[0062] When determining the message authentication code of the plaintext data to be stored, the server may first determine the initial key. If the length of the original key is greater than the maximum input length of the hash function, such as 256 bits for SHA-256, the original key is used directly. Otherwise, the original key is extended through the hash function to reach the maximum length to obtain the initial key. After that, the initial key is XORed with the internal padding constant to obtain the XORed result. The XORed result is connected with the information to be authenticated, that is, the XORed result is attached to the beginning of the plaintext data to be stored. The connected data is hashed once to obtain an intermediate result. At the same time, the server may also XOR the initial key with the external padding constant, and connect the XORed result with the intermediate result. Finally, the connected data is hashed for the second time to obtain the final HMAC value, which is the message authentication code of the plaintext data to be stored.

[0063] For step S106, Figure 6 The decryption process diagram provided for this manual is as follows: Figure 6 shown.

[0064] When the server uses the decryption algorithm corresponding to the order-preserving encryption algorithm for decryption, first, the server needs to determine the fifth boundary value and the sixth boundary value of the decryption domain, the seventh boundary value and the eighth boundary value of the plaintext domain, and the ciphertext data. After that, the decryption intermediate variable is determined according to the fifth boundary value and the sixth boundary value, and the plaintext domain difference is determined according to the seventh boundary value and the eighth boundary value. Then, the pseudo-random number generator is initialized by the deterministic seed function, and the random number is determined based on the pseudo-random number generator according to the preset screening conditions. Then, the decryption mapping data is determined based on the random number, the fifth boundary value and the decryption intermediate variable. Finally, the relationship between the decryption mapping data and the ciphertext data is determined, and the plaintext data is determined according to the relationship and the decryption intermediate variable corresponding to the decryption mapping data. That is, if the relationship is that the decryption mapping data is equal to the ciphertext data, it means that the correct plaintext data has been found, and the decryption intermediate variable corresponding to the decryption mapping data is determined as the plaintext data. If the decryption mapping data is greater than the ciphertext data, the sixth boundary value is replaced with the decryption intermediate variable corresponding to the decryption mapping data, and the encryption process is re-executed. If the decrypted mapping data is smaller than the ciphertext data, the fifth boundary value is replaced with the decryption intermediate variable corresponding to the decrypted mapping data, and the encryption process is re-executed.

[0065] For example, if the fifth boundary value and the sixth boundary value of the decryption domain are a 2 and b 2 , the seventh and eighth boundary values ​​of the plaintext domain are f(a 2 ) and f(b 2 ), the ciphertext data is c, and the decryption intermediate variable is x 1 =(a 2 +b2 ) / 2 indicates that the decryption intermediate variable is the midpoint of the current search range. The plaintext domain difference y 2 = f(b 2 ) - f(a 2 ). Through the deterministic seed function S(a 2 , b 2 , f(a 2 ), f(b 2 )) to initialize the pseudorandom number generator F. Using the preset condition to randomly select an integer z' within the range of [0, y 2 , such that the probability Pr(z ∈ [y 2 / 4, 3y 2 / 4]) is negligible, to obtain the random number z'. Determine that the decryption mapping data is f(x 2 ) = f(a 2 ) + z'. Determine the relationship between the decryption mapping data f(x 2 ) and the ciphertext data c. If f(x 2 ) = c, then x 2 is the plaintext data. If f(x 2 ) > c, then recursively call the decryption algorithm, passing in (a 2 , x 2 , f(a 2 ), f(x 2 ), c). If f(x 2 ) < c, then recursively call the decryption algorithm, passing in (x 2 , b 2 , f(x 2 ), f(b 2 ), c).

[0066] After executing step S110, if the ciphertext data is tampered with, in order to reduce the negative impact brought by the tampering of the ciphertext data, the server should stop executing this service and send data tampering information to the cloud service provider, so that the cloud service provider sends log records, which may include system logs, security logs, network traffic logs, API call logs, identity and access management logs, etc. The server receives the log records sent by the cloud service provider and determines and repairs security vulnerabilities based on the log records.

[0067] Specifically, the server can analyze the timestamps recorded in the logs to determine the time window during which data tampering occurred, so as to narrow down the scope of investigation and identify abnormal behaviors. After that, abnormal behaviors are identified, including abnormal login attempts, unauthorized access, changes in data transfer patterns, abnormal network connection requests, etc. The server can confirm whether there is unauthorized access or account theft by checking which accounts or IP addresses accessed the relevant data before and after the data was tampered with, so as to identify abnormal behaviors. It can also view the recent configuration change and update records to determine whether new security vulnerabilities have been introduced or security settings have been wrongly changed, so as to identify abnormal behaviors. It can also compare the current log records with the previous benchmarks or log records under normal operations to find the differences, so as to identify abnormal behaviors. Finally, based on the identified abnormal behaviors, the discovered security vulnerabilities are patched, and security controls are enhanced, such as strengthening authentication, updating firewall rules, optimizing access control lists, etc. And a continuous log monitoring system is established or enhanced so that abnormal behaviors can be detected more quickly in the future.

[0068] It should be noted that this specification does not limit the subsequent steps that the server can implement when the ciphertext data is tampered with. That is to say, when the ciphertext data is tampered with, the server can determine and repair security vulnerabilities through other means.

[0069] In addition, in this specification, since the business layer needs to perform comparison operations and encrypts through other encryption algorithms, a large amount of encrypted data needs to be obtained from the cloud provider during subsequent business operations, decrypted and then the comparison operations are performed, wasting a large amount of computing resources and having low efficiency. Therefore, an order-preserving encryption algorithm that can utilize ciphertext data for comparison operations is selected as the encryption algorithm for the plaintext data to be stored. This means that if there are two values A and B, and A < B, then after encrypting A and B respectively using the order-preserving encryption algorithm, the ciphertext data Enc(A) of A and the ciphertext data Enc(B) of B are obtained, and Enc(A) and Enc(B) will also satisfy Enc(A) < Enc(B). Then, the comparison operations can be directly performed on the cloud provider side, where there are more computing resources and higher efficiency. However, since the order-preserving encryption algorithm has the aforementioned problems and cannot be replaced by other encryption algorithms, the message authentication code of the plaintext data can be determined so as to determine whether the ciphertext data has been tampered with based on whether the message authentication codes match subsequently.

[0070] Furthermore, based on the aforementioned idea, the server can also determine the unique identifier of other non-tamperable plaintext data to be stored, combine the unique identifier with the ciphertext data to obtain encrypted data, and then subsequently determine whether the unique identifier of the decryption result matches the unique identifier in the encrypted data to determine whether the ciphertext data has been tampered with.

[0071] For example, the unique identifier can be a digital signature. Then, the server can use the private key to determine the digital signature of the plaintext data to be stored. This can verify the source and integrity of the data because only the server's public key can verify the signature. The server then sends the ciphertext data and the digital signature to the cloud service provider for storage.

[0072] When executing business through ciphertext data stored in the cloud service provider, the server receives the encrypted data sent by the cloud service provider. The encrypted data includes the ciphertext data and the digital signature. The server uses its own public key to verify whether the digital signature is valid. If so, the ciphertext data has not been tampered with. The server can use the corresponding decryption key to decrypt the ciphertext data and execute subsequent business.

[0073] The above is a method for determining tampering of ciphertext data provided by one or more embodiments of this specification. Based on the same idea, this specification also provides a corresponding device for determining tampering of ciphertext data, such as Figure 7 As shown, the device comprises: The encryption module 700 is used to encrypt the plaintext data to be stored to obtain the ciphertext data of the plaintext data to be stored when storing the plaintext data to be stored in the cloud service provider; and determine the message authentication code of the plaintext data to be stored according to a preset algorithm; Storage module 702, used to send the ciphertext data and the message authentication code to the cloud service provider for storage; The encrypted data acquisition module 704 is used to receive the encrypted data sent by the cloud service provider when executing the business through the ciphertext data stored in the cloud service provider, wherein the encrypted data includes the ciphertext data and the message authentication code; A decryption module 706, used to decrypt the ciphertext data in the encrypted data to obtain a decryption result; A message authentication code determination module 708, configured to determine a message authentication code of the decryption result according to the preset algorithm; The judgment module 710 is used to judge whether the ciphertext data in the encrypted data has been tampered with according to the message authentication code of the decryption result and the message authentication code in the encrypted data.

[0074] Optionally, the encryption module 700 is specifically configured to encrypt the plaintext data to be stored by using an order-preserving encryption algorithm to obtain ciphertext data of the plaintext data to be stored.

[0075] Optionally, the preset algorithm includes a hash-based message authentication code algorithm or a Galois hash algorithm.

[0076] Optionally, the storage module 702 is specifically used to determine the encrypted data of the plaintext data to be stored based on the ciphertext data and the message authentication code of the plaintext data to be stored; and send the encrypted data of the plaintext data to be stored to the cloud service provider for storage.

[0077] Optionally, the storage module 702 is specifically configured to splice the ciphertext data and the message authentication code of the plaintext data to be stored according to a preset splicing order to obtain a splicing result; and determine the splicing result as the encrypted data of the plaintext data to be stored.

[0078] Optionally, the encrypted data acquisition module 704 is specifically configured to send a query request to the cloud service provider, wherein the query request includes a query condition for the acquired encrypted data; and receive the encrypted data determined by the cloud service provider based on the query condition.

[0079] Optionally, the judgment module 710 is specifically used to judge whether the message authentication code of the decryption result matches the message authentication code in the encrypted data to obtain a judgment result; if the judgment result is mismatch, the ciphertext data in the encrypted data has been tampered with; if the judgment result is match, the ciphertext data in the encrypted data has not been tampered with.

[0080] Optionally, when the ciphertext data is tampered with, the device further includes: The repair module 712 is used to stop executing the business; send data tampering information to the cloud service provider so that the cloud service provider sends log records; receive the log records sent by the cloud service provider; and determine and repair security vulnerabilities based on the log records.

[0081] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 2 Provides a method for determining whether ciphertext data has been tampered with.

[0082] This manual also provides Figure 8 The structural diagram of the electronic device shown in FIG. Figure 8 As shown, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 2 Of course, in addition to the software implementation, this specification does not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0083] In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with hardware entity modules. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0084] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0085] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0086] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0087] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0088] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0089] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0090] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0091] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0092] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0093] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0094] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0095] It should be understood by those skilled in the art that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0096] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0097] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0098] The above description is only an embodiment of this specification and is not intended to limit this specification. For those skilled in the art, this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification should be included in the scope of the claims of this application.

Claims

1. A method for determining whether ciphertext data has been tampered with, the method comprising: When storing the plaintext data to be stored in the cloud service provider, encrypting the plaintext data to be stored to obtain ciphertext data of the plaintext data to be stored; Determine the message authentication code of the plaintext data to be stored according to a preset algorithm; Sending the ciphertext data and the message authentication code to the cloud service provider for storage; When executing a service through ciphertext data stored in the cloud service provider, receiving encrypted data sent by the cloud service provider, the encrypted data including ciphertext data and a message authentication code; Decrypting the ciphertext data in the encrypted data to obtain a decryption result; Determine the message authentication code of the decryption result according to the preset algorithm; According to the message authentication code of the decryption result and the message authentication code in the encrypted data, it is determined whether the ciphertext data in the encrypted data has been tampered with.

2. The method according to claim 1, encrypting the plaintext data to be stored to obtain the ciphertext data of the plaintext data to be stored, specifically comprising: The plaintext data to be stored is encrypted by an order-preserving encryption algorithm to obtain ciphertext data of the plaintext data to be stored.

3. The method according to claim 1, wherein the preset algorithm comprises a hash-based message authentication code algorithm or a Galois hash algorithm.

4. The method according to claim 1, sending the ciphertext data and the message authentication code to the cloud service provider for storage, specifically comprising: Determining the encrypted data of the plaintext data to be stored based on the ciphertext data of the plaintext data to be stored and the message authentication code; The encrypted data of the plaintext data to be stored is sent to the cloud service provider for storage.

5. The method according to claim 4, determining the encrypted data of the plaintext data to be stored based on the ciphertext data of the plaintext data to be stored and the message authentication code, specifically comprises: According to a preset splicing order, the ciphertext data and the message authentication code of the plaintext data to be stored are spliced ​​to obtain a splicing result; The splicing result is determined as the encrypted data of the plaintext data to be stored.

6. The method according to claim 1, receiving the encrypted data sent by the cloud service provider, specifically comprising: Sending a query request to the cloud service provider, the query request including a query condition for the acquired encrypted data; Receive encrypted data determined by the cloud service provider based on the query condition.

7. The method according to claim 1, judging whether the ciphertext data in the encrypted data has been tampered with according to the message authentication code of the decryption result and the message authentication code in the encrypted data, specifically comprising: Determine whether the message authentication code of the decryption result matches the message authentication code in the encrypted data, and obtain a determination result; If the judgment result is mismatch, the ciphertext data in the encrypted data has been tampered with; If the judgment result is a match, the ciphertext data in the encrypted data has not been tampered with.

8. The method according to claim 1, when the ciphertext data is tampered with, the method further comprises: Stop executing the business; and send data tampering information to the cloud service provider so that the cloud service provider sends log records; Receiving log records sent by the cloud service provider; Based on the log records, security vulnerabilities are identified and fixed.

9. A device for determining whether ciphertext data has been tampered with, the device comprising: An encryption module is used to encrypt the plaintext data to be stored when storing the plaintext data to be stored in the cloud service provider to obtain the ciphertext data of the plaintext data to be stored; Determine the message authentication code of the plaintext data to be stored according to a preset algorithm; A storage module, used for sending the ciphertext data and the message authentication code to the cloud service provider for storage; An encrypted data acquisition module, used to receive encrypted data sent by the cloud service provider when executing a business through the ciphertext data stored in the cloud service provider, the encrypted data including the ciphertext data and the message authentication code; A decryption module, used to decrypt the ciphertext data in the encrypted data to obtain a decryption result; A message authentication code determination module, used to determine the message authentication code of the decryption result according to the preset algorithm; The judgment module is used to judge whether the ciphertext data in the encrypted data has been tampered with according to the message authentication code of the decryption result and the message authentication code in the encrypted data.

10. The device according to claim 9, wherein the encryption module is specifically used to encrypt the plaintext data to be stored by using an order-preserving encryption algorithm to obtain ciphertext data of the plaintext data to be stored.

11. The device according to claim 9, wherein the preset algorithm comprises a hash-based message authentication code algorithm or a Galois hash algorithm.

12. In the device as described in claim 9, the storage module is specifically used to determine the encrypted data of the plaintext data to be stored based on the ciphertext data and the message authentication code of the plaintext data to be stored; and send the encrypted data of the plaintext data to be stored to the cloud service provider for storage.

13. The device as described in claim 12, wherein the storage module is specifically used to splice the ciphertext data and the message authentication code of the plaintext data to be stored according to a preset splicing order to obtain a splicing result; and determine the splicing result as the encrypted data of the plaintext data to be stored.

14. In the device as described in claim 9, the encrypted data acquisition module is specifically used to send a query request to the cloud service provider, the query request including query conditions for the acquired encrypted data; and receive the encrypted data determined by the cloud service provider based on the query conditions.

15. In the device as described in claim 9, the judgment module is specifically used to judge whether the message authentication code of the decryption result matches the message authentication code in the encrypted data to obtain a judgment result; if the judgment result is mismatch, the ciphertext data in the encrypted data has been tampered with; if the judgment result is match, the ciphertext data in the encrypted data has not been tampered with.

16. The device according to claim 9, when the ciphertext data is tampered with, the device further comprises: A repair module, used to stop executing the service; and send data tampering information to the cloud service provider so that the cloud service provider sends a log record; Receive log records sent by the cloud service provider; and determine and repair security vulnerabilities based on the log records.

17. A computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

18. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 8 when executing the program.

Images