Method and system for cloud data storage security

Abstract

The invention provides a method and system for cloud data storage security, the method comprises a client, a business server and an encryption and decryption server, the business server and the encryption and decryption server are deployed to different servers, and the method specifically comprises the following steps: the client uploads user data, and the business server receives the user data; the business server side sends the user data and the first user ID to an encryption and decryption server side; the encryption and decryption server side receives the user data and the first user ID; generating a first secret key according to the first user ID, encrypting the user data through the first secret key to obtain first encrypted data, and then sending the encrypted data to the business server; and the business server stores the first encrypted data to ensure the security of cloud data.

Description

Technical Field

[0001] The present invention relates to the technical field, and in particular to a method and system for cloud data storage security. Background Art

[0002] In today's digital age, data security has become the focus of attention for enterprises and users. With the popularization of the Internet, most of the existing data is stored in the cloud, and existing data leaks occur frequently, especially those involving user sensitive data, which may lead to serious economic losses and reputation damage. In addition, there are also large-scale database drag incidents in reality, including some large Internet companies. Therefore, it is crucial to protect the security and privacy of user sensitive data;

[0003] Common data protection solutions in the industry include:

[0004] 1. Direct encryption at the database layer: The disadvantage is that the key and the database server are usually deployed together, which can be easily obtained by attackers at the same time;

[0005] 2. Encryption at the application layer before storage: The key needs to be managed in the application, increasing the risk of key leakage;

[0006] 3. Strict access control: There is no guarantee that there will be no loopholes in the control, and it is impossible to avoid malicious behavior by insiders. Summary of the invention

[0007] The technical problem to be solved by the present invention is to provide a method and system for cloud data storage security to ensure cloud data security.

[0008] In a first aspect, the present invention provides a method for cloud data storage security, including a client, a business server, a storage service, and an encryption and decryption server, wherein the business server, the storage service, and the encryption and decryption server are deployed on different servers, and specifically include the following steps:

[0009] Step 1: The client uploads user data, and the business server receives the user data;

[0010] Step 2: The business server sends the user data and the first user ID to the encryption and decryption server;

[0011] Step 3, the encryption and decryption server receives the user data and the first user ID; the encryption and decryption server obtains the corresponding first secret key from the storage service side according to the first user ID. If the first secret key does not exist, the encryption and decryption server generates a random string of set bits, generates a first secret key according to the first user ID and the random string, encrypts the user data by using the first secret key to obtain first encrypted data, and then sends the encrypted data to the business server, and sends the first secret key and the first user ID to the storage service side for storage; if the first secret key exists, the encryption and decryption server encrypts the user data by using the first secret key to obtain first encrypted data, and then sends the encrypted data to the business server;

[0012] Step 4: The business service end stores the first encrypted data.

[0013] In a second aspect, the present invention provides a system for cloud data storage security, including a client, a business server, a storage service, and an encryption and decryption server, wherein the business server, the storage service, and the encryption and decryption server are deployed on different servers, and specifically include the following modules:

[0014] Upload data module, the client uploads user data, and the business server receives user data;

[0015] The data forwarding module sends the user data and the first user ID to the encryption and decryption server.

[0016] The encryption data module, the encryption and decryption server receives the user data and the first user ID; the encryption and decryption server obtains the corresponding first secret key from the storage service side according to the first user ID. If the first secret key does not exist, the encryption and decryption server generates a random string of set bits, generates a first secret key according to the first user ID and the random string, encrypts the user data by the first secret key to obtain the first encrypted data, and then sends the encrypted data to the business service side, and sends the first secret key and the first user ID to the storage service side for storage; if the first secret key exists, the encryption and decryption server encrypts the user data by the first secret key to obtain the first encrypted data, and then sends the encrypted data to the business service side;

[0017] The data storage module stores the first encrypted data.

[0018] One or more technical solutions provided by the present invention have at least the following technical effects or advantages:

[0019] The present invention encrypts the data uploaded by the client and then stores it; and the decryption key used for each user's data is different, so even if one user's data is decrypted, it will not affect the data security of other users; the location where the data is stored is different from the location where it is encrypted and decrypted, so even if a server is hacked, it will not cause data leakage, which greatly increases data security.

[0020] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The present invention will be further described below in conjunction with embodiments with reference to the accompanying drawings.

[0022] Figure 1 is a flow chart of the method in Embodiment 1 of the present invention;

[0023] Figure 2 It is a schematic diagram of the structure of the system in the second embodiment of the present invention. DETAILED DESCRIPTION

[0024] The technical solution in the embodiment of the present application has the following general idea:

[0025] User data encryption steps:

[0026] 1. Business server: Receive user data, perform business verification and business logic processing, do not save to disk, and send user data to an independent encryption and decryption service;

[0027] 2. Encryption and decryption server: obtain the corresponding user ID according to the user account, generate the corresponding key according to the user ID; encrypt the data; for example, use the AES-128 encryption algorithm; each user ID is different, so the key generated is also different; these keys and user IDs are saved to the storage service end;

[0028] 3. Business server: use the encrypted data to save the data;

[0029] Steps to decrypt user data:

[0030] 1. Business server: reads the user data to be decrypted from the database and sends the user data to an independent encryption and decryption service for decryption;

[0031] 2. Encryption and decryption server: Obtain the previously generated key from the storage service server based on the user ID and perform AES-128 decryption on the data;

[0032] Business service: Use the decrypted data to perform business logic processing and respond to the user.

[0033] Embodiment 1

[0034] like Figure 1 As shown, this embodiment provides a method for cloud data storage security, including a client, a business server, a storage service, and an encryption and decryption server, wherein the business server, the storage service, and the encryption and decryption server are deployed on different servers, and specifically include the following steps:

[0035] Step 1: The client uploads user data, and the business server receives the user data;

[0036] Step 2: The business server sends the user data and the first user ID to the encryption and decryption server;

[0037] Step 3, the encryption and decryption server receives the user data and the first user ID; the encryption and decryption server obtains the corresponding first secret key from the storage service side according to the first user ID. If the first secret key does not exist, the encryption and decryption server generates a random string of set bits, generates a first secret key according to the first user ID and the random string, encrypts the user data by using the first secret key to obtain first encrypted data, and then sends the encrypted data to the business server, and sends the first secret key and the first user ID to the storage service side for storage; if the first secret key exists, the encryption and decryption server encrypts the user data by using the first secret key to obtain first encrypted data, and then sends the encrypted data to the business server;

[0038] Step 4: The business service end stores the first encrypted data.

[0039] This embodiment preferably also includes step 5, the client requests data from the business service end, the business service end obtains the second encrypted data corresponding to the client, and sends the second encrypted data and the second user ID corresponding to the client to the encryption and decryption server; the encryption and decryption server obtains the second key from the storage service end through the second user ID, decrypts the second encrypted data through the second key to obtain decrypted data, sends the decrypted data to the business service end, and the business service end forwards the decrypted data to the client.

[0040] In this embodiment, preferably, step 2 is specifically as follows: the business service end queries and obtains the corresponding first user ID according to the client, and the business service end sends the user data and the first user ID to the encryption and decryption service end.

[0041] In this embodiment, preferably, the step 3 is specifically as follows: the encryption and decryption server receives user data and a first user ID; the encryption and decryption server obtains the corresponding first secret key from the storage service end according to the first user ID; if the first secret key does not exist, the encryption and decryption server generates a random character string of a set number of bits, generates a first secret key through a hash algorithm according to the first user ID and the random character string, encrypts the user data through an AES encryption algorithm through the first key to obtain first encrypted data, and then sends the encrypted data to the business server; if the first secret key exists, the encryption and decryption server encrypts the user data through the first key to obtain first encrypted data, and then sends the encrypted data to the business server; the encryption and decryption server deletes the first key and the first user ID.

[0042] Based on the same inventive concept, the present application also provides a system corresponding to the method in Example 1, see Example 2 for details.

[0043] Embodiment 2

[0044] like Figure 2 As shown, in this embodiment, a system for cloud data storage security is provided, including a client, a business server, a storage service, and an encryption and decryption server, wherein the business server, the storage service, and the encryption and decryption server are deployed on different servers, and specifically include the following modules:

[0045] Upload data module, the client uploads user data, and the business server receives user data;

[0046] The data forwarding module sends the user data and the first user ID to the encryption and decryption server.

[0047] The encryption data module, the encryption and decryption server receives the user data and the first user ID; the encryption and decryption server obtains the corresponding first secret key from the storage service side according to the first user ID. If the first secret key does not exist, the encryption and decryption server generates a random string of set bits, generates a first secret key according to the first user ID and the random string, encrypts the user data by the first secret key to obtain the first encrypted data, and then sends the encrypted data to the business service side, and sends the first secret key and the first user ID to the storage service side for storage; if the first secret key exists, the encryption and decryption server encrypts the user data by the first secret key to obtain the first encrypted data, and then sends the encrypted data to the business service side;

[0048] The data storage module stores the first encrypted data.

[0049] In this embodiment, preferably, it also includes a decryption data module, the client requests data from the business service end, the business service end obtains the second encrypted data corresponding to the client, and sends the second encrypted data and the second user ID corresponding to the client to the encryption and decryption server; the encryption and decryption server obtains the second key from the storage service end through the second user ID, decrypts the second encrypted data through the second key to obtain decrypted data, sends the decrypted data to the business service end, and the business service end forwards the decrypted data to the client.

[0050] In this embodiment, preferably, the data forwarding module is specifically: the business server queries and obtains the corresponding first user ID according to the client, and the business server sends the user data and the first user ID to the encryption and decryption server.

[0051] In this embodiment, preferably, the encryption data module is specifically as follows: the encryption and decryption server receives user data and a first user ID; the encryption and decryption server obtains the corresponding first secret key from the storage service end according to the first user ID. If the first secret key does not exist, the encryption and decryption server generates a random character string of a set number of bits, generates a first secret key through a hash algorithm according to the first user ID and the random character string, encrypts the user data through an AES encryption algorithm through the first key to obtain first encrypted data, and then sends the encrypted data to the business server; if the first secret key exists, the encryption and decryption server encrypts the user data through the first key to obtain first encrypted data, and then sends the encrypted data to the business server; the encryption and decryption server deletes the first key and the first user ID.

[0052] Since the system introduced in the second embodiment of the present invention is a system used to implement the method of the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the system based on the method introduced in the first embodiment of the present invention, so it is not described here in detail. All systems used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0053] The technical solution provided in the embodiments of the present application has at least the following technical effects or advantages:

[0054] Data security: Encrypted data storage ensures that data is not leaked even in the event of a database leak. At the same time, through independent encryption and decryption servers, the risk of keys and data being exposed in applications is reduced.

[0055] Internal risk prevention: By setting up business servers, storage services, and encryption and decryption servers, the management mechanism deployed by different teams and environments can avoid the risk of internal personnel leaking data in most cases, ensuring that data is only available when authorized for decryption. Internal personnel cannot obtain all the data and decrypt it, ensuring internal security;

[0056] Key independence: Assign an independent key to each user to ensure that even if a key is leaked, it will not affect the data security of other users.

[0057] Although the specific implementation modes of the present invention are described above, those skilled in the art should understand that the specific implementation modes described are only illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for secure cloud data storage, characterized in that: It includes a client, a business server, a storage service, and an encryption and decryption server, which are deployed on different servers, and specifically includes the following steps: Step 1: The client uploads user data, and the business server receives the user data; Step 2: The business server sends the user data and the first user ID to the encryption and decryption server; Step 3, the encryption and decryption server receives the user data and the first user ID; the encryption and decryption server obtains the corresponding first secret key from the storage service side according to the first user ID. If the first secret key does not exist, the encryption and decryption server generates a random string of set bits, generates a first secret key according to the first user ID and the random string, encrypts the user data by using the first secret key to obtain first encrypted data, and then sends the encrypted data to the business server, and sends the first secret key and the first user ID to the storage service side for storage; if the first secret key exists, the encryption and decryption server encrypts the user data by using the first secret key to obtain first encrypted data, and then sends the encrypted data to the business server; Step 4: The business service end stores the first encrypted data.

2. A method for secure cloud data storage according to claim 1, characterized in that: It also includes step 5, the client requests data from the business service end, the business service end obtains the second encrypted data corresponding to the client, and sends the second encrypted data and the second user ID corresponding to the client to the encryption and decryption server; the encryption and decryption server obtains the second key from the storage service end through the second user ID, decrypts the second encrypted data through the second key to obtain decrypted data, sends the decrypted data to the business service end, and the business service end forwards the decrypted data to the client.

3. A method for secure cloud data storage according to claim 1, characterized in that: The step 2 is specifically as follows: the business service end queries and obtains the corresponding first user ID according to the client, and the business service end sends the user data and the first user ID to the encryption and decryption service end.

4. A method for secure cloud data storage according to claim 1, characterized in that: The specific steps of step 3 are as follows: the encryption and decryption server receives user data and a first user ID; the encryption and decryption server obtains a corresponding first secret key from the storage service side according to the first user ID; if the first secret key does not exist, the encryption and decryption server generates a random character string of a set number of bits, generates a first secret key through a hash algorithm according to the first user ID and the random character string, encrypts the user data through an AES encryption algorithm through the first key to obtain first encrypted data, and then sends the encrypted data to the business server; if the first secret key exists, the encryption and decryption server encrypts the user data through the first key to obtain first encrypted data, and then sends the encrypted data to the business server; the encryption and decryption server deletes the first key and the first user ID.

5. A system for cloud data storage security, characterized in that: It includes a client, a business server, a storage service, and an encryption and decryption server. The business server, storage service, and encryption and decryption server are deployed on different servers and specifically include the following modules: Upload data module, the client uploads user data, and the business server receives user data; The data forwarding module sends the user data and the first user ID to the encryption and decryption server. The encryption data module, the encryption and decryption server receives the user data and the first user ID; the encryption and decryption server obtains the corresponding first secret key from the storage service side according to the first user ID. If the first secret key does not exist, the encryption and decryption server generates a random string of set bits, generates a first secret key according to the first user ID and the random string, encrypts the user data by the first secret key to obtain the first encrypted data, and then sends the encrypted data to the business service side, and sends the first secret key and the first user ID to the storage service side for storage; if the first secret key exists, the encryption and decryption server encrypts the user data by the first secret key to obtain the first encrypted data, and then sends the encrypted data to the business service side; The data storage module stores the first encrypted data.

6. A system for secure cloud data storage according to claim 5, characterized in that: It also includes a decryption data module, where the client requests data from the business service end, the business service end obtains the second encrypted data corresponding to the client, and sends the second encrypted data and the second user ID corresponding to the client to the encryption and decryption server end; the encryption and decryption server obtains the second key from the storage service end through the second user ID, decrypts the second encrypted data through the second key, obtains the decrypted data, sends the decrypted data to the business service end, and the business service end forwards the decrypted data to the client.

7. A system for secure cloud data storage according to claim 5, characterized in that: The data forwarding module is specifically as follows: the business server queries and obtains the corresponding first user ID according to the client, and the business server sends the user data and the first user ID to the encryption and decryption server.

8. The system for cloud data storage security according to claim 5, characterized in that: The encryption data module is specifically as follows: the encryption and decryption server receives user data and a first user ID; the encryption and decryption server obtains the corresponding first secret key from the storage service side according to the first user ID. If the first secret key does not exist, the encryption and decryption server generates a random character string of a set number of bits, generates a first secret key through a hash algorithm according to the first user ID and the random character string, encrypts the user data through an AES encryption algorithm through the first key to obtain first encrypted data, and then sends the encrypted data to the business server; if the first secret key exists, the encryption and decryption server encrypts the user data through the first key to obtain first encrypted data, and then sends the encrypted data to the business server; the encryption and decryption server deletes the first key and the first user ID.

Images