Secret splitting-based deniable encryption storage method and system

Abstract

The invention discloses a deniable encryption storage method and system based on secret splitting. The method comprises the following steps of: 1) generating a key S and a pseudo key P for a user by using a random number generator; wherein the Shamir secret splitting polynomial times for splitting the secret pseudo secret P are m, n and mlt respectively; n; the length of the keyS is m + 1, and the length of the keyP is n + 1; 2) performing secret splitting on the secret S and the pseudo secret P input by the user by using the keyS, the keyP and the Shamir secret splitting polynomial to obtain a ciphertext C; 3) when a key S input by a user is received, constructing a secret sharing point according to the key S, the Shamir secret splitting polynomial and the ciphertext C, and decrypting a secret S; and when a pseudo secret key keyP input by a user is received, constructing a pseudo secret sharing point according to the received pseudo secret key keyP, the Shamir secret splitting polynomial and the ciphertext C, and decrypting the pseudo secret P.

Description

Technical Field

[0001] The invention relates to a deniable encryption storage method and system based on secret splitting, belonging to the technical field of data encryption. Background Art

[0002] Data encryption plays a vital role in cybersecurity and is a core means of protecting data from unauthorized access. However, current encryption schemes have a significant vulnerability that is difficult to address with existing cryptographic techniques: the threat of user coercion. Attackers, or even legitimate authorities, may force users to disclose their encryption keys and thus access encrypted data. Traditional encryption schemes, whether symmetric (such as AES) or asymmetric (such as RSA or ECC), fail to provide effective protection against physical or social attacks, especially when users are forced to hand over their keys. In this case, the confidentiality of the encrypted data is immediately compromised. Therefore, researchers began to explore cryptographic solutions like deniable encryption, which aim to provide plausible deniability.

[0003] Deniable storage enables users to plausibly deny the existence of encrypted data even if they are forced to reveal the key. There are two main types of plausible deniability storage schemes: those based on deniable algorithms and those based on hidden volumes. Deniable algorithm-based schemes use deniable hidden data; hidden volume-based schemes are usually implemented in the file system or the flash translation layer of the storage device, using hidden volumes to store data. The disk is divided into two parts, the entire disk is marked as the public volume, and the remaining part is filled with random data. The hidden volume is encrypted and located at the end of the public volume, and the random data overwrites the hidden volume. If the user is compromised, they can give the password for the public volume without acknowledging the existence of the hidden volume. Since it is difficult to distinguish between random data and hidden data, attackers cannot discover the existence of the hidden data.

[0004] There are two main optimization directions for deniable encrypted storage: First, improve system availability by using a separate block allocation table, information dispersion algorithm, and maintaining an additional key directory to improve redundancy efficiency. Second, resist multiple snapshot attacks by using block allocation tables, randomly marking blocks, and maintaining pseudo-hidden files to prevent adversaries from identifying newly allocated blocks containing hidden data by comparing bitmaps.

[0005] However, these implementations still have the following problems: additional metadata needs to be maintained, and additional allocation bitmaps are required to manage the allocation and writing of encrypted file blocks; storage space utilization is low, and most solutions to deal with multiple snapshot attacks use redundant random writes or pseudo data blocks to mask changes to encrypted blocks; special disk layout is required, which not only attracts additional attention from the adversary, but also results in significant performance losses. Summary of the invention

[0006] To solve the above problems, the present invention proposes a deniable encryption storage method and system based on secret splitting.

[0007] The technical solution adopted by the present invention is: a deniable encryption method based on secret splitting, comprising the following steps:

[0008] Step 1: Setup() → (key S , key P ), generate a key key S and a pseudo-key key P using a random number generator;

[0009] Step 2: Encrypt(key S , key P , S, P) → C, perform secret splitting on the secret S and the pseudo-secret P respectively, and then output the ciphertext C;

[0010] Step 3: Decrypt S (key S , C) → S, Decrypt P (key P , C) → P, construct a secret sharing point and a pseudo-secret sharing point, and decrypt the secret S and the pseudo-secret P;

[0011] Step 4: Update the secret S and the pseudo-secret P.

[0012] In the above deniable encryption method based on secret splitting, in step 2, the degree of the Shamir secret splitting polynomial used for splitting the secret S is m, and the degree of the polynomial of the pseudo-secret P is n (m < n), where the length of key S is m + 1, the length of key P is n + 1, and the element size of key depends on the size of the finite field for polynomial operations.

[0013] In the above deniable encryption method based on secret splitting, the specific implementation of step 2 includes the following sub-steps:

[0014] Step 2.1: Split the secret S, let key S [0] be the x-coordinate of the secret point, and S be the y-coordinate of the secret point, to obtain the secret point (x S , S), and then select m secret sharing points {(key S [1], y 1 ), (key S [2], y 2 ), …, (key S [m], y m)}, where the value of the y coordinate y i , i∈{1,2,…,m} is randomly selected, and finally according to these secret sharing points and secret points (x S ,S) construct an m-degree polynomial f S (x), and calculate the y coordinate value y of the m+1th secret sharing point m+1 =f S (key S [m+1]);

[0015] Step 2.2: Split the pseudo-secret P.

[0016] Step 2.2.1: Set key P [0] is the x-coordinate of the pseudo-secret point, P is the y-coordinate of the pseudo-secret point, and the pseudo-secret point (x P ,P), and then select m+1 pseudo-secret sharing points {(key P [1],y 1 ),(key P [2],y 2 ),…,(key P [m+1],y m+1 )}, the y coordinates of these points are the same as the y coordinates of the secret sharing point (in order to further improve security, the correspondence between x and y can be rearranged, the coordinate relationship between x and y can be arbitrarily exchanged and the mapping relationship can be saved, for example {(key P [1],y random(1…m+1) ),(key P [2],y random(1…m+1) ),…,(key P [m+1],y random(1…m+1) )}).

[0017] Step 2.2.2: Randomly select the y coordinates of the remaining nm-1 pseudo-secret sharing points and obtain {(key P [m+2],y m+2 ),(key P [m+3],y m+3 ),…,(key P [n],y n )}, and finally use the first n pseudo-secret shared points and pseudo-secret points (x P ,P) Construct an n-degree polynomial f P (x), calculate the y coordinate value y of the n+1th pseudo-secret sharing point n+1 =f P (key P [n+1]);

[0018] Step 2.3: Calculate the ciphertext C = y 1||y 2 …||y n+1 , where || represents a connector.

[0019] The specific implementation of the above-mentioned deniable encryption method based on secret splitting includes the following sub-steps:

[0020] Step 3.1: Construct a secret sharing point {(key S [1],C[1]),(key S [2],C[2]),…,(key S [m+1],C[m+1])} and construct the m-degree polynomial f S (x), calculate S = f S (key S [0]);

[0021] Step 3.2: Construct a pseudo-secret shared point {(key P [1],C[1]),(key P [2],C[2]),…,(key P [n+1],C[n+1])} and construct the n-degree polynomial f P (x), calculate P = f P (key P [0]).

[0022] In the above deniable encryption method based on secret splitting, in step 4, when the ciphertext C=y 1 ||y 2 …||y n+1 When updating the secret S, the ciphertext C = y 1 ||y 2 …||y n+1 The secret S and the pseudo-secret P are saved at the same time, and cannot be updated directly, so as to avoid the ciphertext C being unable to recover the pseudo-secret P after the update. Therefore, the pseudo-secret P is reconstructed first, according to the key key S and pseudo key key P , the system reads each share and uses the pseudo key key P Reconstruct P with the provided information, and then repeat step 2. According to the recovered pseudo-secret P and the secret S that needs to be updated, calculate the new ciphertext C and write it to the relevant storage.

[0023] In the above deniable encryption method based on secret splitting, in step 4, if only step 2.2.2 is executed to update the pseudo-secret P, only part of the ciphertext C=y will be obtained. 1 ||y 2 …||y n+1will be updated (the calculation rules of the first m+1 pseudo-secret sharing points in step 2.2.1 are fixed, and the results will not change), which will increase the risk of being discovered by attackers (it is abnormal that only part of the ciphertext is updated each time instead of all of it), so a solution needs to be designed to update all ciphertexts C=y 1 ||y 2 …||y n+1 In GF(256), the XOR homomorphic property can help solve this problem. In GF(256), shares can be XORed directly, and the result will be reflected in the recovered secret. For example:

[0024] SecretA⊕SecretB=recover(ShareA 1 ⊕ShareB 1 ,

[0025] ShareA 2 ⊕ShareB 2 ,

[0026] …,

[0027] ShareA n ⊕ShareB n )

[0028] Since for any value x, x⊕0=x, we can prepare shares of a secret S, where S is 0. Each time P is updated, these shares are XORed with the corresponding random values. This operation does not change S, since S⊕0=S, but it does randomly change the shares. Therefore, when P is updated, the shares corresponding to all ciphertexts C will change.

[0029] When updating the pseudo-secret P, firstly XOR all the shares split when the pre-calculated S is 0 with all the shares in the corresponding ciphertext C, so that all the related shares are changed. Then execute steps 2.2.2 and 2.3.

[0030] The present invention also includes a deniable encryption storage system based on secret splitting, including a configuration phase and a storage phase:

[0031] In the configuration phase, the user authenticates with a password through the configuration partition and configures the system. After the configuration is completed, the storage phase begins, in which the configuration partition and storage partition are constructed through the media transfer protocol device and the USB attached SCSI protocol device.

[0032] The beneficial effects of the present invention are:

[0033] 1. The present invention proposes a deniable encryption method based on secret splitting, which uses a high-order polynomial secret sharing scheme to cover a low-order polynomial secret sharing scheme, thereby improving the security of confidential data and being able to effectively resist multi-snapshot attacks.

[0034] 2. The present invention proposes a deniable encrypted storage system based on secret splitting, which is implemented by hardware, does not require the maintenance of additional metadata, and achieves high storage utilization. User write operations directly correspond to disk write operations. The system can be flexibly connected to various back-end storage solutions, and uses a file-based configuration system, allowing users to write files directly to the standard file system for configuration without the need for additional software. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a schematic diagram of a system model provided by an embodiment of the present invention.

[0036] Figure 2 It is a flow chart of the method provided by an embodiment of the present invention.

[0037] Figure 3 It is a schematic diagram of the system architecture provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to more clearly understand the solution of the present invention, the technical solution in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0039] Figure 1 Schematic diagram of a model of a deniable encrypted storage method and system based on secret splitting provided by an embodiment of the present invention. Figure 1 As shown, the system includes: a configuration partition and a storage partition. When data is written to the configuration partition, the system checks the file and parses the configuration. According to the user's configuration, the storage partition can be a pseudo storage or a secret storage. After the data is written to the storage partition, it will be secretly split and then allocated to different storage backend systems, including local storage, remote storage, and file storage. Depending on the type of backend storage used, the communication between the system and these backend systems can be local communication or network communication.

[0040] Figure 2 FIG. 1 is a flowchart of a deniable encryption method based on secret splitting provided by an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0041] Step 1: Key generation;

[0042] In one embodiment, in step 1, let the degree of the Shamir secret sharing polynomial for splitting the secret S be m, and the degree of the polynomial of the pseudo-secret P be n (m < n). Use a random number generator to generate a key key S and a pseudo-key key P , where the length of key S is m + 1, and the length of key P is n + 1. The unit of key depends on the size of the finite field for polynomial operations. For example, when using a binary extension field of size 2 256 to the power of 2, the size of key S is m + 1 numbers of 2 256 .

[0043] Step 2: Encryption;

[0044] In one embodiment, the specific implementation of step 2 includes the following sub-steps:

[0045] 1) Split the secret S. Let key S [0] be the x-coordinate of the secret point, and S be the y-coordinate of the secret point, obtaining the secret point (x S , S). Then select m secret sharing points {(key S [1], y 1 ), (key S [2], y 2 ), …, (key S [m], y m )}, where the values of the y-coordinates y i , i ∈ {1, 2, …, m} are randomly selected. Finally, construct an m-degree polynomial f S (x) based on these secret sharing points and the secret point (x S ), and calculate the y-coordinate value y m+1 = f S (key S [m + 1]);

[0046] 2) Split the pseudo-secret P. Let key P [0] be the x-coordinate of the pseudo-secret point, and P be the y-coordinate of the pseudo-secret point, obtaining the pseudo-secret point (x P , P). Then select m + 1 pseudo-secret sharing points {(key P [1], y 1 ), (key P [2], y 2 ), …, (key P [m + 1], y m+1)}, the y coordinates of these pseudo-secret sharing points are the same as the y coordinates of the secret sharing points (in order to further improve security, the correspondence between x and y can be rearranged, such as {(key P [1],y random(1…m+1) ),(key P [2],y random(1…m+1) ),…,(key P [m+1],y random(1…m+1) )}). Then randomly select the y coordinates of the remaining nm-1 pseudo-secret sharing points to obtain {(key P [m+2],y m+2 ),(key P [m+3],y m+3 ),…,(key P [n],y n )}, and finally use the first n pseudo-secret shared points and pseudo-secret points (x P ,P) Construct an n-degree polynomial f P (x), calculate the y coordinate value y of the n+1th point n+1 =f P (key P [n+1]).

[0047] 3) Calculate the ciphertext C = y 1 ||y 2 …||y n+1 , where || represents a connector.

[0048] Step 3: Decryption;

[0049] In one implementation, the specific implementation of step 3 includes the following sub-steps:

[0050] 1) Build a secret sharing point {(key S [1],C[1]),(key S [2],C[2]),…,(key S [m+1],C[m+1])} and construct the m-degree polynomial f S (x), calculate S = f S (key S [0]);

[0051] 2) Construct a pseudo-secret shared point {(key P [1],C[1]),(key P [2],C[2]),…,(key P [n+1],C[n+1])} and construct the n-degree polynomial f P (x), calculate P = f P (key P[0]).

[0052] Step 4: Update;

[0053] In one implementation, the specific implementation of step 4 includes the following sub-steps:

[0054] 1) When updating the secret S, first reconstruct the pseudo-secret P and provide the key key S and pseudo key key P , the system reads each share and reconstructs P based on the information provided by the pseudo-key, and then, similar to the encryption process, calculates the ciphertext C and writes it to the relevant storage;

[0055] 2) When updating the pseudo-secret P, since for any value x, x⊕0=x, we first prepare the shares of S, where S is 0, and then use the XOR homomorphic property of the binary extension field to directly XOR the shares, and the result is reflected in the recovered secret, that is, SecretA⊕SecretB=recover(ShareA 1 ⊕ShareB 1 ,ShareA 2 ⊕ShareB 2 ,…,ShareA n ⊕ShareB n ), and finally randomly XOR these shares with the corresponding shares to change all related shares. Then execute step 2.2.

[0056] The security of this method depends on the size of the binary extension field and the choice of m and n dimensions for secret splitting. x In the case of , the degree of the Shamir secret sharing polynomial for secret S is m, and the degree of the polynomial for pseudo-secret P is n. Therefore, the adversary's exhaustive search space is It can be seen that the main source of computational complexity is 2 x , and the increase of x can significantly improve the security of the scheme. Table 1 is the exhaustive search space table.

[0057] Table 1 Exhaustive search space table

[0058]

[0059] Figure 3 Schematic diagram of the architecture of a deniable encrypted storage method and system based on secret splitting provided by an embodiment of the present invention. Figure 3 As shown, the operation of the system is divided into two stages: configuration and storage. The user needs to authenticate with a password and configure the system by configuring the partition before using the storage partition.

[0060] 1) Configuration phase: Using a file-based configuration method, when the system is connected to the user's computer, a dedicated configuration partition will be automatically displayed. The user can complete most of the configuration work by placing the file containing the necessary configuration information into the configuration partition. The configuration file contains the configuration storage password and other basic information of the settings. Once the configuration file is saved, the system will read and apply these settings, including starting the secret sharing engine, establishing a network connection, and connecting to the iSCSI server. After the configuration is completed, the system will unmount the configuration partition and enter the storage phase.

[0061] In the case where the user is compromised, they can choose not to authenticate and only expose the configuration partition to the adversary. If the adversary knows the storage partition, the user can enter a fake key to only show the fake storage and hide the secret storage.

[0062] 2) Storage phase: The system mounts the storage partition according to the password in the configuration file, allowing file read and write operations. Unlike traditional steganographic file systems, this system does not rely on a specific software system, but acts as a SCSI command agent. The system receives SCSI read and write commands from the user's computer via USB, and uses a secret sharing engine to share and recover these commands in real time, distributing data to different storage backends. Users can specify any storage device that can be installed on a Linux system as a storage backend.

[0063] For example, the system's own eMMC storage device is divided into multiple partitions, each partition stores a share, thus creating a system similar to a traditional encrypted storage system. These shares can be stored on different back-end devices as needed, such as partitions on the system's own eMMC, local or remote files, or even remote storage services such as iSCSI. After receiving the SCSI command, the system will parse the command and perform corresponding processing and send it to the back-end device, including:

[0064] Read command: The system generates multiple new SCSI commands and sends them to the relevant backend storage devices. After receiving responses from all targets, the secret sharing engine extracts the data segments and reconstructs the original data, which is then returned to the user.

[0065] Write command: The system will also generate multiple new SCSI commands. The original SCSI command header will be copied, the data segment will be split by the secret sharing engine and embedded in the new command, and then sent to the corresponding back-end storage device.

[0066] Status query command: The system will generate and return relevant status information based on its current status and connection with the backend storage.

[0067] Control instructions: Typically, the system passes these instructions directly because they are not data-dependent.

[0068] To ensure compatibility with various back-end storage systems, the system integrates a variety of back-end interface modules. These modules facilitate communication and interaction with different storage devices, including:

[0069] Local storage devices: The system can directly forward new SCSI commands to manage local data storage (such as eMMC).

[0070] iSCSI devices: The system can convert new SCSI commands into iSCSI commands and transmit them to the corresponding iSCSI server through the network, thereby utilizing remote storage resources to expand storage capacity and flexibility.

[0071] File storage system: The system converts new SCSI commands into file I / O operations and stores the data on a file server (such as NFS, SMB, or object storage service).

[0072] Specifically, the implementation of the system is divided into two main parts: media transfer protocol equipment and USB attached SCSI protocol equipment.

[0073] 1) Media Transfer Protocol Device: Since the Media Transfer Protocol protocol is more convenient for tracking changes in the file system, the Media Transfer Protocol device is used to build the configuration partition. The Media Transfer Protocol device is based on the uMTP-Responder framework and is configured as a service that starts automatically at startup. After the device is powered on, the system's OTG USB port will register as a Media Transfer Protocol device and actively monitor the user's read and write operations on the Media Transfer Protocol partition. In order to improve security and reduce potential attack surfaces, the system is designed to reject all file write requests that are not related to configuration. When a valid configuration file is detected and written, the system will parse the relevant request and store the configuration data in the relevant database. After processing is completed, the Media Transfer Protocol device will be uninstalled. Subsequently, the USB attached SCSI protocol device will be started.

[0074] 2) USB attached SCSI protocol device: USB attached SCSI protocol device is used to establish storage partitions and simulate the OTG USB port as a SCSI device. Table 2 shows the detailed processing process of each SCSI instruction by the system.

[0075] Table 2 SCSI command processing table

[0076]

[0077] For read / write commands, the system utilizes a secret sharing engine to share or recover data in the SCSI command and then transfers it to the backend storage device for processing.

[0078] For status instructions, the system summarizes and reports the status of the backend storage systems. For example, it reports online only when all backend storage systems are online; otherwise, it reports offline.

[0079] For control instructions including state setting and cache operations, the system will directly forward them to the backend storage system.

[0080] The above-mentioned embodiments only express the implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. A deniable encrypted storage method based on secret splitting, the steps comprising: 1) Use a random number generator to generate a key for the user S and pseudo key key P ; Wherein, the degree of Shamir secret splitting polynomial used for secret splitting is m, and the degree of Shamir secret splitting polynomial used for pseudo-secret P splitting is n, m <n;key S The length of key is m+1. P The length of is n+1; 2) Using the key S , pseudo key key P Use Shamir's secret splitting polynomial to split the secret S and pseudo-secret P input by the user to obtain the ciphertext C; 3) When receiving the key entered by the user S When the key is received S , Shamir secret split polynomial and ciphertext C construct secret sharing point, decrypt the secret S; when receiving the pseudo key key input by the user P When the pseudo key key is received P , Shamir secret splitting polynomial and ciphertext C construct a pseudo-secret shared point, and decrypt the pseudo-secret P.

2. The method according to claim 1, characterized in that The method to split the secret S is: let key S [0] is the x-coordinate of the secret point, and the secret S is the y-coordinate of the secret point. S ,S), and then select m secret sharing points {(key S [1],y1),(key S [2],y2),…,(key S [m],y m )}, where the value of the y coordinate y i is randomly selected, i∈{1,2,…,m}, and finally according to the secret sharing points and secret points (x S ,S) construct an m-degree polynomial f S (x), and calculate the y coordinate value y of the m+1th secret sharing point m+1 =f S (key S [m+1]).

3. The method according to claim 2, characterized in that The method to split the pseudo-secret P is: let key P [0] is the x-coordinate of the pseudo-secret point, and the pseudo-secret P is the y-coordinate of the pseudo-secret point. P ,P), and then select m+1 pseudo-secret sharing points {(key P [1],y1),(key P [2],y2),…,(key P [m+1],y m+1 )}, the y coordinates of the m+1 pseudo-secret sharing points correspond to the y coordinates of each secret sharing point or satisfy the set mapping relationship, and then the y coordinates of the remaining nm-1 pseudo-secret sharing points are randomly selected to obtain {(key P [m+2],y m+2 ),(key P [m+3],y m+3 ),…,(key P [n],y n )}, and finally use the first n pseudo-secret shared points and pseudo-secret points (x P ,P) Construct an n-degree polynomial f P (x), calculate the y coordinate value y of the n+1th pseudo-secret sharing point n+1 =f P (key P [n+1]); the ciphertext C = y1||y2...||y n+1 , where || represents a connector.

4. The method according to claim 3, characterized in that The method to decrypt the secret S is: construct a secret sharing point {(key S [1],C[1]),(key S [2],C[2]),…,(key S [m+1],C[m+1])} and construct the m-degree polynomial f S (x), calculate the secret S = f S (key S [0]); the method to decrypt the pseudo-secret P is: construct a pseudo-secret sharing point {(key P [1],C[1]),(key P [2],C[2]),…,(key P [n+1],C[n+1])} and construct the n-degree polynomial f P (x), calculate the pseudo-secret P = f P (key P [0]).

5. The method according to claim 1, 2 or 3, characterized in that: According to the decryption result of step 3), the secret S and the pseudo-secret P are updated; when the secret S is updated, the pseudo-secret P is first rebuilt according to the key key S and pseudo key key P , the system reads each share and uses the pseudo key key P The pseudo-secret P is restored and reconstructed with the provided information, and then a new ciphertext C is calculated based on the restored pseudo-secret P and the secret S that needs to be updated; when updating the pseudo-secret P, first pre-calculate the shares to be split when the secret S is 0, and then use the XOR homomorphic property of the binary extension field to randomly XOR each share with the corresponding share, and then randomly select the y coordinates of the remaining nm-1 pseudo-secret sharing points to obtain {(key P [m+2],y m+2 ),(key P [m+3],y m+3 ),…,(key P [n],y n )}, and then use the first n pseudo-secret shared points and pseudo-secret points (x P ,P) Construct an n-degree polynomial f P (x), calculate the y coordinate value y of the n+1th pseudo-secret sharing point n+1 =f P (key P [n+1]); then calculate the ciphertext C = y1||y2…||y n+1 .

6. The method according to claim 1, 2 or 3, characterized in that: In the configuration phase, when the system is connected to the user end, a configuration partition is automatically displayed for receiving the configuration file uploaded by the user; then the secret sharing engine is started according to the configuration file, a network connection is established and the iSCSI server is connected. After the configuration is completed, the configuration partition is uninstalled and then the storage phase is entered; in the storage phase, the system mounts the corresponding storage partition according to the password in the configuration file, and receives SCSI read and write instructions from the user end as a SCSI instruction agent, and uses the secret sharing engine to share and restore related instructions in real time, and distributes data to the storage backend specified by the user.

7. The method according to claim 6, characterized in that The system comprises a media transfer protocol device and a USB attached SCSI protocol device; the media transfer protocol device is used to construct the configuration partition; the USB attached SCSI protocol device is used to establish the storage partition; the storage partition comprises a pseudo storage area and a secret storage area for receiving a pseudo key key P Only the data in the pseudo storage area is displayed, and the data in the secret storage area is hidden.

8. A deniable encrypted storage system based on secret splitting, characterized in that: Including random number generator, ciphertext generation module and decryption module; The random number generator is used to generate the user's key S and pseudo key key P ; Among them, the degree of Shamir secret splitting polynomial used for secret splitting is m, and the degree of Shamir secret splitting polynomial used for pseudo-secret P splitting is n, m <n;key S The length of key is m+1. P The length of is n+1; The ciphertext generation module is used to use the key key S , pseudo key key P Use Shamir's secret splitting polynomial to split the secret S and pseudo-secret P input by the user to obtain the ciphertext C; The decryption module is used to receive the key key input by the user S When the key is received S , Shamir secret split polynomial and ciphertext C construct secret sharing point, decrypt the secret S; when receiving the pseudo key key input by the user P When the pseudo key key is received P , Shamir secret splitting polynomial and ciphertext C construct a pseudo-secret shared point, and decrypt the pseudo-secret P.

9. The system according to claim 8, characterized in that The system also includes an updating module for updating the secret S and the pseudo-secret P according to the decryption result of the decryption module; wherein, when the secret S is updated, the pseudo-secret P is first rebuilt, and the pseudo-secret P is rebuilt according to the key key. S and pseudo key key P , the system reads each share and uses the pseudo key key P The pseudo-secret P is restored and reconstructed based on the provided information, and then a new ciphertext C is calculated based on the restored pseudo-secret P and the secret S that needs to be updated; when updating the pseudo-secret P, first pre-calculate the shares to be split when the secret S is 0, and then use the XOR homomorphic property of the binary expansion field to randomly XOR each share with the corresponding share, and then randomly select the y coordinates of the remaining nm-1 pseudo-secret sharing points to obtain {(key P [m+2],y m+2 ),(key P [m+3],y m+3 ),…,(key P [n],y n )}, and then use the first n pseudo-secret shared points and pseudo-secret points (x P ,P) Construct an n-degree polynomial f P (x), calculate the y coordinate value y of the n+1th pseudo-secret sharing point n+1 =f P (key P [n+1]); then calculate the ciphertext C = y1||y2…||y n+1 .

10. The system according to claim 8, characterized in that The invention comprises a configuration stage and a storage stage; wherein, in the configuration stage, when the system is connected to the user end, a configuration partition is automatically displayed for receiving the configuration file uploaded by the user; then the secret sharing engine is started according to the configuration file, a network connection is established and the iSCSI server is connected, and after the configuration is completed, the configuration partition is uninstalled, and then the storage stage is entered; in the storage stage, the system mounts the corresponding storage partition according to the password in the configuration file, and receives the SCSI read and write instructions from the user end as a SCSI instruction agent, and uses the secret sharing engine to share and restore the relevant instructions in real time, and distributes the data to the storage backend specified by the user; the storage partition comprises a pseudo storage area and a secret storage area, which is used to receive the pseudo key key P Only the data in the pseudo storage area is displayed, and the data in the secret storage area is hidden.

Images