Data storage method and system in cloud platform

Abstract

The present invention discloses a data storage method and system in a cloud platform, which uses a private password set by a user as a confusion particle and an encryption key, performs segmented confusion on the original data stream according to a preset rule, and then encrypts multiple arrays after segmented confusion, and finally sends the encrypted data segments to multiple nodes of the cloud platform for storage. When data is leaked from one or more nodes of the cloud platform, the attacker cannot obtain the encryption private key and does not know the data stream segmented confusion rules, so the original file cannot be restored. The present invention utilizes the randomness and uncertainty of the private password setting, performs segmented confusion and encryption on the original data stream according to the password particles, and then stores it in a decentralized manner on the cloud platform, thereby improving the security of data storage on the cloud platform.

Description

Technical Field

[0001] The present invention relates to the field of cloud storage technology, and more specifically, to the security of data stored on a cloud platform. Background Art

[0002] In recent years, the wave of big data development has swept the world, and the explosive growth of data volume has given rise to a new data storage method, namely cloud storage. The core technologies of cloud storage mainly include virtualization technology, data deduplication technology, distributed storage technology, data backup technology, content distribution network technology and storage encryption technology. Cloud storage uses these core technologies to bring together a large number of different types of storage devices in the network through application software to work together, jointly providing data storage and business access functions to the outside world, thereby saving storage space.

[0003] Cloud storage is a new product form that is based on the extension and development of cloud computing related technologies. It was born out of enterprise cloud service applications, such as Alibaba, Tencent, Baidu, etc. Although data cloud storage saves costs for users and improves convenience, it also faces corresponding security issues, such as: whether the cloud platform itself is safe, how to ensure that important data is not lost, and once the cloud platform is maliciously attacked, will the data stored in the cloud cause a large-scale leak. Summary of the invention

[0004] To solve the above problems, the present invention provides a data storage method and system in a cloud platform, which specifically includes the following steps:

[0005] S1: Prompt the user to enter a password, obtain a password string PasswordStr, obtain a password array PasswordSet[] according to the password string PasswordStr, and obtain the array length N;

[0006] S2: Store the initial data into DataByte[], obtain the array length M, create P arrays, where P = M / N rounded up, and for the i-th array among the P arrays, it sequentially stores the elements with subscripts (i-1)*N to i*N-1 in DataByte[]; i is a positive integer less than or equal to P;

[0007] S3: Determine the size of N and P. If N is less than or equal to P, for the i-th array in the P arrays, insert the element with subscript i-1 in PasswordSet[] into the position with subscript Ni, where i is a positive integer less than or equal to N; otherwise, split PasswordSet[] into K arrays, and then insert the K arrays into the specified positions of the P arrays, where K=P;

[0008] S4: The obtained P arrays are numbered in the order of 0 to P-1, and the numbered data are encrypted in turn using the password input by the user, and the encrypted arrays are sent to multiple nodes of the cloud platform for storage.

[0009] The encrypted array is sent to multiple nodes of the cloud platform for storage, specifically including:

[0010] The remaining storage space of each node of the cloud platform is obtained. If the remaining space is insufficient, no data is allocated to the node; otherwise, the array is allocated to the node according to the remaining space.

[0011] The PasswordSet[] is split into K arrays, and then the K arrays are inserted into the specified positions of the P arrays. Specifically, for the kth array of the K arrays, it is inserted into the kth array of the P arrays after the element with subscript k-1 and before the element with subscript k, k = "1, 2, ..., K".

[0012] The array is allocated to the node according to the remaining space, specifically:

[0013] Get the idle time t of the remaining space of the node and the transmission cost of data transmitted to the node, get the weight λ according to the transmission cost, set the priority of the node according to t*λ, sort the nodes according to the priority, take the nodes with priority greater than the threshold as candidate nodes, and allocate data to the candidate nodes; the transmission cost refers to the time it takes for data to be transmitted to the node and the occupied network bandwidth.

[0014] The password array PasswordSet[] is obtained according to the password string PasswordStr, specifically:

[0015] Perform a hash construction on the string PasswordStr, convert an input of any length into a fixed-length encoded output, and then store the generated hash value in PasswordSet[].

[0016] In addition, the present invention also provides a data storage system in a cloud platform, the system comprising the following modules:

[0017] The key generation module is used to prompt the user to enter a password, obtain the password string PasswordStr, obtain the password array PasswordSet[] according to the password string PasswordStr, and obtain the array length N;

[0018] Data segmentation module: used to store the initial data into DataByte[], obtain the array length M, create P arrays, where P = M / N rounded up, and for the i-th array among the P arrays, it sequentially stores the elements with subscripts (i-1)*N to i*N-1 in DataByte[]; i is a positive integer less than or equal to P;

[0019] Data obfuscation module: used to determine the size of N and P. If N is less than or equal to P, for the i-th array in the P arrays, insert the element with subscript i-1 in PasswordSet[] into its subscript Ni position, where i is a positive integer less than or equal to N; otherwise, split PasswordSet[] into K arrays, and then insert the K arrays into the specified positions of the P arrays, where K = P;

[0020] Encryption storage module: used to number the obtained P arrays in the order of 0 to P-1, and then encrypt the numbered data in turn using the password entered by the user, and send the encrypted arrays to multiple nodes of the cloud platform for storage.

[0021] The method of encrypting the array and sending it to multiple nodes of the cloud platform for storage specifically includes: obtaining the remaining storage space of each node of the cloud platform, if the remaining space is insufficient, not allocating data to the node; otherwise, allocating the array to the node according to the remaining space.

[0022] The PasswordSet[] is split into K arrays, and then the K arrays are inserted into the specified positions of the P arrays. Specifically, for the kth array of the K arrays, it is inserted after the element with subscript k-1 and before the element with subscript k in the kth array of the P arrays, k="1,2,...,K".

[0023] The array is allocated to the node according to the remaining space, specifically:

[0024] Get the idle time t of the remaining space of the node and the transmission cost of data transmitted to the node, get the weight λ according to the transmission cost, set the priority of the node according to t*λ, sort the nodes according to the priority, take the nodes with priority greater than the threshold as candidate nodes, and allocate data to the candidate nodes; the transmission cost refers to the time it takes for data to be transmitted to the node and the occupied network bandwidth.

[0025] The password array PasswordSet[] is obtained according to the password string PasswordStr, specifically:

[0026] Perform a hash construction on the string PasswordStr, convert an input of any length into a fixed-length encoded output, and then store the generated hash value in PasswordSet[].

[0027] The present invention combines data stream segmentation obfuscation, data encryption, and the random uncertainty of privatization password setting to create a data security storage method and system in a cloud platform. In the current cloud platform storage environment, if a cloud platform node data is lost, the method cannot completely restore the original data because the encryption private key cannot be obtained and the data stream segmentation obfuscation method is unknown, thereby improving the security of data storage in the cloud platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present invention.

[0029] Figure 1 A structural diagram provided for an embodiment of the present invention;

[0030] Figure 2 A flowchart provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0031] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] In a first example, the present invention provides a data storage method in a cloud platform, comprising the following steps:

[0033] S1: Prompt the user to enter a password, obtain a password string PasswordStr, obtain a password array PasswordSet[] according to the password string PasswordStr, and obtain the array length N;

[0034] The custom password is both a data obfuscation particle and an encryption key. In a specific example, in order to improve the security of the key, the password can be any combination of uppercase letters, lowercase letters, numbers, and special characters. For example, the password string is: Yptsjcc@008.

[0035] S2: Store the initial data into DataByte[], obtain the array length M, create P arrays, where P = M / N rounded up, and for the i-th array among the P arrays, it sequentially stores the elements with subscripts (i-1)*N to i*N-1 in DataByte[]; i is a positive integer less than or equal to P;

[0036] If the length of DataByte[] is M=52, and the length of the password array PasswordSet[] is N=6, then P=9. For the 9 arrays, the first array stores the elements with subscripts 0 to 5 in DataByte[]; the second array stores the elements with subscripts 6 to 11 in DataByte[]; the third array stores the elements with subscripts 12 to 17 in DataByte[]; and so on. The ninth array stores the elements with subscripts 48 to 51 in DataByte[].

[0037] S3: Determine the size of N and P. If N is less than or equal to P, for the i-th array in the P arrays, insert the element with subscript i-1 in PasswordSet[] into the position with subscript Ni, where i is a positive integer less than or equal to N; otherwise, split PasswordSet[] into K arrays, and then insert the K arrays into the specified positions of the P arrays, where K=P;

[0038] For example, N=6, P=9, among the 9 arrays, for the first array, insert the element with subscript 0 in PasswordSet[] into its subscript 5 position; for the second array, insert the element with subscript 1 in PasswordSet[] into its subscript 4 position; for the third array, insert the element with subscript 2 in PasswordSet[] into its subscript 3 position; for the fourth array, insert the element with subscript 3 in PasswordSet[] into its subscript 2 position; for the fifth array, insert the element with subscript 4 in PasswordSet[] into its subscript 1 position; for the sixth array, insert the element with subscript 5 in PasswordSet[] into its subscript 0 position; the other arrays remain unchanged.

[0039] For another example, N=5, P=5, among the 5 arrays, for the first array, insert the element with subscript 0 in PasswordSet[] into its subscript 4 position; for the second array, insert the element with subscript 1 in PasswordSet[] into its subscript 3 position; for the third array, insert the element with subscript 2 in PasswordSet[] into its subscript 2 position; for the fourth array, insert the element with subscript 3 in PasswordSet[] into its subscript 1 position; for the fifth array, insert the element with subscript 4 in PasswordSet[] into its subscript 0 position.

[0040] For another example, if N=9 and P=6, PasswordSet[] is split into 6 arrays, and then the 6 arrays are inserted into the specified positions.

[0041] S4: The obtained P arrays are numbered in the order of 0 to P-1, and the numbered data are encrypted in turn using the password input by the user, and the encrypted arrays are sent to multiple nodes of the cloud platform for storage.

[0042] For example, if 9 arrays are obtained, they are numbered 0, 1, 2, 3, 4, 5, 6, 7, 8 in sequence, and then encrypted with the private key PasswordStr = "Yptsjcc@008" set by privatization, and the encrypted arrays are sent to multiple nodes of the cloud platform for storage. The encryption of the arrays and sending them to multiple nodes of the cloud platform for storage specifically includes:

[0043] The remaining storage space of each node of the cloud platform is obtained. If the remaining space is insufficient, no data is allocated to the node; otherwise, the array is allocated to the node according to the remaining space.

[0044] The remaining storage space of each node in the cloud platform is used as the primary judgment for allocating data. For example, if the remaining storage space of a node in the cloud platform is 20kb, and the smallest array size among the P arrays obtained is 30kb, it is not suitable to allocate data to the node; otherwise, data can be allocated to the node.

[0045] The PasswordSet[] is split into K arrays, and then the K arrays are inserted into the specified positions of the P arrays. Specifically, for the kth array of the K arrays, it is inserted into the kth array of the P arrays after the element with subscript k-1 and before the element with subscript k, k = "1, 2, ..., K".

[0046] For example, if N=11 and P=6, PasswordSet[] is split into 6 arrays. For the first array, it is inserted after the element with subscript 0 of the first array of the P arrays and before the element with subscript 1; for the second array, it is inserted after the element with subscript 1 of the second array of the P arrays and before the element with subscript 2; for the third array, it is inserted after the element with subscript 2 of the third array of the P arrays and before the element with subscript 3; for the fourth array, it is inserted after the element with subscript 3 of the fourth array of the P arrays and before the element with subscript 4; for the fifth array, it is inserted after the element with subscript 4 of the fifth array of the P arrays and before the element with subscript 5; for the sixth array, it is inserted after the element with subscript 5 of the sixth array of the P arrays and before the element with subscript 6.

[0047] The array is allocated to the node according to the remaining space, specifically:

[0048] Get the idle time t of the remaining space of the node and the transmission cost of data transmitted to the node, get the weight λ according to the transmission cost, set the priority of the node according to t*λ, sort the nodes according to the priority, take the nodes with priority greater than the threshold as candidate nodes, and allocate data to the candidate nodes; the transmission cost refers to the time it takes for data to be transmitted to the node and the occupied network bandwidth.

[0049] For example, when the idle time t = 60S, the transmission cost weights λ of the 10 cloud platform nodes are 0.8, 0.9, 0.5, 0.1, 0.2, 0.4, 0.1,

[0050] 0.5, 0.2.1.0, then t*λ is: 48, 54, 30, 6, 12, 24, 6, 30, 12, 60. The threshold is set to 28. After sorting according to the node priority, the candidate nodes greater than the threshold are: node 1, node 2, node 3, node 8, node 10. Data is allocated to the obtained candidate nodes.

[0051] The password array PasswordSet[] is obtained according to the password string PasswordStr, specifically:

[0052] Perform a hash construction on the string PasswordStr, convert an input of any length into a fixed-length encoded output, and then store the generated hash value in PasswordSet[].

[0053] In a specific example, the password string PasswordStr is converted into a Hash array through Hash hashing. The array has the characteristics of easy addressing and difficult insertion and deletion, which further improves the security of the data obfuscation particle.

[0054] In a second example, the present invention further provides a data storage system in a cloud platform, the system comprising the following modules: a key generation module: used to prompt a user to enter a password, obtain a password string PasswordStr, obtain a password array PasswordSet[] according to the password string PasswordStr, and obtain an array length N;

[0055] Data segmentation module: used to store the initial data into DataByte[], obtain the array length M, create P arrays, where P = M / N rounded up, and for the i-th array among the P arrays, it sequentially stores the elements with subscripts (i-1)*N to i*N-1 in DataByte[]; i is a positive integer less than or equal to P;

[0056] Data obfuscation module: used to determine the size of N and P. If N is less than or equal to P, for the i-th array in the P arrays, insert the element with subscript i-1 in PasswordSet[] into its subscript Ni position, where i is a positive integer less than or equal to N; otherwise, split PasswordSet[] into K arrays, and then insert the K arrays into the specified positions of the P arrays, where K = P;

[0057] Encryption storage module: used to number the obtained P arrays in the order of 0 to P-1, and then encrypt the numbered data in turn using the password entered by the user, and send the encrypted arrays to multiple nodes of the cloud platform for storage.

[0058] The encrypted array is sent to multiple nodes of the cloud platform for storage, specifically including:

[0059] The remaining storage space of each node of the cloud platform is obtained. If the remaining space is insufficient, no data is allocated to the node; otherwise, the array is allocated to the node according to the remaining space.

[0060] The PasswordSet[] is split into K arrays, and then the K arrays are inserted into the specified positions of the P arrays. Specifically, for the kth array of the K arrays, it is inserted into the kth array of the P arrays after the element with subscript k-1 and before the element with subscript k, k = "1, 2, ..., K".

[0061] The array is allocated to the node according to the remaining space, specifically:

[0062] Get the idle time t of the remaining space of the node and the transmission cost of data transmitted to the node, get the weight λ according to the transmission cost, set the priority of the node according to t*λ, sort the nodes according to the priority, take the nodes with priority greater than the threshold as candidate nodes, and allocate data to the candidate nodes; the transmission cost refers to the time it takes for data to be transmitted to the node and the occupied network bandwidth.

[0063] The password array PasswordSet[] is obtained according to the password string PasswordStr, specifically:

[0064] Perform a hash construction on the string PasswordStr, convert an input of any length into a fixed-length encoded output, and then store the generated hash value in PasswordSet[].

[0065] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0066] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data storage method in a cloud platform, characterized in that: The following steps are involved: S1: Prompt the user to enter a password, obtain a password string PasswordStr, obtain a password array PasswordSet[] according to the password string PasswordStr, and obtain the array length N; S2: Store the initial data into DataByte[], obtain the array length M, create P arrays, where P = M / N rounded up, and for the i-th array among the P arrays, it sequentially stores the elements with subscripts (i-1)*N to i*N-1 in DataByte[]; i is a positive integer less than or equal to P; S3: Determine the size of N and P. If N is less than or equal to P, for the i-th array in the P arrays, insert the element with subscript i-1 in PasswordSet[] into the position with subscript Ni, where i is a positive integer less than or equal to N. Otherwise, split PasswordSet[] into K arrays, and then insert the K arrays into the specified positions of the P arrays, where K=P; S4: The obtained P arrays are numbered in the order of 0 to P-1, and the numbered data are encrypted in turn using the password input by the user, and the encrypted arrays are sent to multiple nodes of the cloud platform for storage.

2. The method according to claim 1, characterized in that The encrypted array is sent to multiple nodes of the cloud platform for storage, specifically including: The remaining storage space of each node of the cloud platform is obtained. If the remaining space is insufficient, no data is allocated to the node; otherwise, the array is allocated to the node according to the remaining space.

3. The method according to claim 1, characterized in that , the PasswordSet[] is split into K arrays, and then the K arrays are inserted into the specified positions of the P arrays, specifically: For the kth array of the K arrays, insert it into the kth array of the P arrays after the element with subscript k-1 and before the element with subscript k, k=1,2,...,K.

4. The method according to claim 2, characterized in that , the array is allocated to the node according to the remaining space, specifically: Get the idle time t of the remaining space of the node and the transmission cost of data to the node, get the weight λ according to the transmission cost, set the priority of the node according to t*λ, sort the nodes according to the priority, take the nodes with priority greater than the threshold as candidate nodes, and allocate data to the candidate nodes; The transmission cost refers to the time it takes to transmit data to a node and the network bandwidth occupied.

5. The method according to any one of claims 1 to 4, characterized in that , the password array PasswordSet[] is obtained according to the password string PasswordStr, specifically: Perform a hash construction on the string PasswordStr, convert an input of any length into a fixed-length encoded output, and then store the generated hash value in PasswordSet[].

6. A data storage system in a cloud platform, characterized in that: Includes the following modules: The key generation module is used to prompt the user to enter a password, obtain the password string PasswordStr, obtain the password array PasswordSet[] according to the password string PasswordStr, and obtain the array length N; Data segmentation module: used to store the initial data into DataByte[], obtain the array length M, create P arrays, where P = M / N rounded up, and for the i-th array among the P arrays, it sequentially stores the elements with subscripts (i-1)*N to i*N-1 in DataByte[]; i is a positive integer less than or equal to P; Data obfuscation module: used to determine the size of N and P. If N is less than or equal to P, for the i-th array in the P arrays, insert the element with subscript i-1 in PasswordSet[] into the position with subscript Ni, where i is a positive integer less than or equal to N. Otherwise, split PasswordSet[] into K arrays, and then insert the K arrays into the specified positions of the P arrays, where K=P; Encryption storage module: used to number the obtained P arrays in the order of 0 to P-1, and then encrypt the numbered data in turn using the password entered by the user, and send the encrypted arrays to multiple nodes of the cloud platform for storage.

7. The system according to claim 6, characterized in that The encrypted array is sent to multiple nodes of the cloud platform for storage, specifically including: The remaining storage space of each node of the cloud platform is obtained. If the remaining space is insufficient, no data is allocated to the node; otherwise, the array is allocated to the node according to the remaining space.

8. The system according to claim 6, characterized in that The PasswordSet[] is split into K arrays, and then the K arrays are inserted into the specified positions of the P arrays, specifically: For the kth array of the K arrays, insert it into the kth array of the P arrays after the element with subscript k-1 and before the element with subscript k, k=1,2,...,K.

9. The system according to claim 7, characterized in that The array is allocated to the node according to the remaining space, specifically: Get the idle time t of the remaining space of the node and the transmission cost of data to the node, get the weight λ according to the transmission cost, set the priority of the node according to t*λ, sort the nodes according to the priority, take the nodes with priority greater than the threshold as candidate nodes, and allocate data to the candidate nodes; The transmission cost refers to the time it takes to transmit data to a node and the network bandwidth occupied.

10. The system according to any one of claims 6 to 9, characterized in that: The password array PasswordSet[] is obtained according to the password string PasswordStr, specifically: Perform a hash construction on the string PasswordStr, convert an input of any length into a fixed-length encoded output, and then store the generated hash value in PasswordSet[].

Images