Data security archiving service system and method based on digital envelope

Abstract

The invention relates to the technical field of communication, in particular to a data security archiving service system and method based on a digital envelope. The method comprises the following steps: extracting metadata of each archived file; storing the archived file in the encrypted state and the corresponding secret key and metadata to a database of a server according to a preset classification rule; the client retrieves a database of the server according to an instruction of a user by taking the metadata as a basis, and finds out a to-be-downloaded archived file; the client generates a secret key pair of a public key and a secret key by using an asymmetric encryption algorithm; the client sends the public key to the server; the server encrypts by using the public key to obtain a digital envelope; and the client performs decryption by using the private key to obtain the archived file in the plaintext state. Compressed storage is encrypted in a symmetric encryption mode, and data is downloaded in a digital envelope mode, so that the main storage space is released, and meanwhile, the integrity, the safety and the manageability of the data are improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a data security archiving service system and method based on a digital envelope. Background Art

[0002] With the rapid development of product digitalization, a large amount of physical data has accumulated in product business systems over a long period of time, and the cost of data storage has also increased. These data are no longer used in normal times, but they still need to be provided to users for query and download at critical times. Therefore, how to archive data securely and trace back data at any time is the current research focus.

[0003] The traditional data archiving method is to migrate all data from the production database to a database outside the current system for unified archiving and storage. However, due to unified archiving, this method cannot guarantee data security and cannot provide users with the ability to backtrack and download data on their own. As a result, operation and maintenance personnel need to manually retrieve and move data, which increases operation and maintenance costs. Summary of the invention

[0004] In view of the above problems, the present invention proposes the following technical solutions:

[0005] A data security archiving service method based on a digital envelope is used to archive data to a server and provide it to a client for query. The method comprises the following steps:

[0006] S1: extracting metadata of each archived file, where the metadata is descriptive information of the archived file for user retrieval;

[0007] Generate a unique secret key for each archive file, compress the archive file, and then use the corresponding secret key to symmetrically encrypt the archive file to obtain an encrypted archive file;

[0008] S2: The encrypted archive files and their corresponding keys and metadata are stored in the database of the server according to the preset classification rules;

[0009] S3: The client searches the server's database based on the metadata according to the user's instructions to find the archived file to be downloaded;

[0010] The client uses an asymmetric encryption algorithm to generate a key pair consisting of a public key and a secret key;

[0011] The client sends the public key to the server;

[0012] S4; the server encrypts the secret key of the archive file to be downloaded using the public key sent by the client to obtain a digital envelope; the archive file to be downloaded and the corresponding digital envelope are sent to the client; the archive file to be downloaded is in an encrypted state;

[0013] S5: The client uses the private key to decrypt the digital envelope, obtains the secret key, and then uses the secret key to decrypt the downloaded archive file to obtain the archive file in plain text.

[0014] Preferably, before extracting the metadata of each archived file, the integrity and validity of the archived file are verified first; after passing the verification, subsequent steps are performed.

[0015] Preferably, the metadata includes file name, file size or storage time.

[0016] The present invention also provides a data security archiving service system based on a digital envelope, which is used to archive data to a server and provide it to a client for query. The method includes the following modules:

[0017] Archive preprocessing module: used to extract metadata of each archive file, where the metadata is descriptive information of the archive file for user retrieval;

[0018] Generate a unique secret key for each archive file, compress the archive file, and then use the corresponding secret key to symmetrically encrypt the archive file to obtain an encrypted archive file;

[0019] Archiving module: used to store encrypted archive files and their corresponding keys and metadata in the server database according to preset classification rules;

[0020] Retrieval module: The user client searches the server's database based on metadata according to the user's instructions to find the archived files to be downloaded;

[0021] The client uses an asymmetric encryption algorithm to generate a key pair consisting of a public key and a secret key;

[0022] The client sends the public key to the server;

[0023] File processing and transmission module; used for the server to encrypt the secret key of the archive file to be downloaded using the public key sent by the client to obtain a digital envelope; send the archive file to be downloaded and the corresponding digital envelope to the client; the archive file to be downloaded is in an encrypted state;

[0024] Client decryption module: The user client uses the private key to decrypt the digital envelope, obtains the secret key, and then uses the secret key to decrypt the downloaded archive file to obtain the archive file in plain text.

[0025] Preferably, before extracting the metadata of each archived file, the integrity and validity of the archived file are verified first; after passing the verification, subsequent steps are performed.

[0026] Preferably, the metadata includes file name, file size or storage time.

[0027] Beneficial effects:

[0028] The data archiving method provided by the present invention is used to encrypt and compress historical data with a long time span that needs to be retained through symmetric encryption. The data can be downloaded in the form of digital envelopes at a later time, thereby freeing up the main storage space and achieving long-term data retention, while improving the integrity, security and manageability of the data. DETAILED DESCRIPTION

[0029] In order to make the purpose, features and advantages of the present invention more obvious and easy to understand, the technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the embodiments described below are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] A data security archiving service method based on a digital envelope is used to archive data to a server and provide it to a client for query. The method comprises the following steps:

[0031] S1: Verify the integrity and validity of archived files;

[0032] After verification, the metadata of each archived file is extracted. The metadata is the description information of the archived file for user retrieval. The metadata includes the file name, file size or storage time.

[0033] Generate a unique secret key for each archive file, compress the archive file, and then use the corresponding secret key to symmetrically encrypt the archive file to obtain an encrypted archive file;

[0034] S2: The encrypted archive files and their corresponding keys and metadata are stored in the database of the server according to the preset classification rules;

[0035] The preset classification rules are formulated according to user needs, and can generally be classified according to year, file type, etc.

[0036] S3: The client searches the server's database based on the metadata according to the user's instructions to find the archived file to be downloaded;

[0037] The client uses an asymmetric encryption algorithm to generate a key pair consisting of a public key and a secret key;

[0038] The client sends the public key to the server;

[0039] S4; the server encrypts the secret key of the archive file to be downloaded using the public key sent by the client to obtain a digital envelope; the archive file to be downloaded and the corresponding digital envelope are sent to the client; the archive file to be downloaded is in an encrypted state;

[0040] S5: The client uses the private key to decrypt the digital envelope, obtains the secret key, and then uses the secret key to decrypt the downloaded archive file to obtain the archive file in plain text.

[0041] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data security archiving service method based on a digital envelope, which is used to archive data to a server and provide it to a client for query, characterized in that: The method comprises the following steps: S1: extracting metadata of each archived file, where the metadata is descriptive information of the archived file for user retrieval; Generate a unique secret key for each archive file, compress the archive file, and then use the corresponding secret key to symmetrically encrypt the archive file to obtain an encrypted archive file; S2: The encrypted archive files and their corresponding keys and metadata are stored in the database of the server according to the preset classification rules; S3: The client searches the server's database based on the metadata according to the user's instructions to find the archived file to be downloaded; The client uses an asymmetric encryption algorithm to generate a key pair consisting of a public key and a secret key; The client sends the public key to the server; S4; the server encrypts the secret key of the archive file to be downloaded using the public key sent by the client to obtain a digital envelope; the archive file to be downloaded and the corresponding digital envelope are sent to the client; the archive file to be downloaded is in an encrypted state; S5: The client uses the private key to decrypt the digital envelope, obtains the secret key, and then uses the secret key to decrypt the downloaded archive file to obtain the archive file in plain text.

2. A data security archiving service method based on digital envelope according to claim 1, characterized in that: Before extracting the metadata of each archive file, the integrity and validity of the archive file are verified; after passing the verification, the subsequent steps are carried out.

3. A data security archiving service method based on digital envelope according to claim 1, characterized in that: The metadata includes file name, file size or storage time.

4. A data security archiving service system based on digital envelopes, used to archive data to a server and provide it to a client for query, characterized in that: The method includes the following modules: Archive preprocessing module: used to extract metadata of each archive file, where the metadata is descriptive information of the archive file for user retrieval; Generate a unique secret key for each archive file, compress the archive file, and then use the corresponding secret key to symmetrically encrypt the archive file to obtain an encrypted archive file; Archiving module: used to store encrypted archive files and their corresponding keys and metadata in the server database according to preset classification rules; Retrieval module: The user client searches the server's database based on metadata according to the user's instructions to find the archived files to be downloaded; The client uses an asymmetric encryption algorithm to generate a key pair consisting of a public key and a secret key; The client sends the public key to the server; File processing and transmission module; The server uses the public key sent by the client to encrypt the secret key of the archive file to be downloaded to obtain a digital envelope; the archive file to be downloaded and the corresponding digital envelope are sent to the client; the archive file to be downloaded is in an encrypted state; Client decryption module: The user client uses the private key to decrypt the digital envelope, obtains the secret key, and then uses the secret key to decrypt the downloaded archive file to obtain the archive file in plain text.

5. A data security archiving service system based on digital envelope according to claim 4, characterized in that: Before extracting the metadata of each archive file, the integrity and validity of the archive file are verified; after passing the verification, the subsequent steps are carried out.

6. A data security archiving service system based on digital envelope according to claim 4, characterized in that: The metadata includes file name, file size or storage time.