Cloud security data storage method supporting dynamic encryption

Abstract

The invention relates to the technical field of cloud storage, and discloses a cloud security data storage method supporting dynamic encryption, which comprises the following steps: storing access data, unlocking a database by a user B, independently extracting and storing data in the database, initializing a system, and storing the data in the database. The user B ensures that only visible data in the database is encrypted and locked, restores an operating system to an initial state, authorizes the access user, authorizes the user A to access the information of the user B, determines that only the user B has visible data and unlocks the access data, and the user B accesses the information of the user A; the user A unlocks the data which are only visible to the user B through the secret key of the user B, the user A independently stores the data which are visible to the user B and encrypts and locks the data, the user A exits the system after dynamic encryption is completed, and the user A exits the operating system. According to the method and the system, the data are encrypted and protected layer by layer, so that the safety of data storage is improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud storage technology, and in particular to a cloud security data storage method supporting dynamic encryption. Background Art

[0002] A cloud security data storage method that supports dynamic encryption is a technical solution to ensure data security and privacy protection in a cloud environment. With the popularization of cloud computing, data security has become a key issue of concern to users, especially how to protect data from being leaked or tampered with during data storage and transmission. Dynamic encryption (or dynamic encryption mechanism) refers to the use of flexible encryption methods during data storage and access, and real-time encryption and decryption of data as needed to ensure data security.

[0003] According to a secure data storage method and system proposed in Chinese patent CN104392188B, the generation and access of plaintext secure data objects are controlled through the ARMTrustZone trusted execution environment to prevent them from being read or tampered with by untrusted programs; the encryption and decryption process and the keys used therein are isolated in the trusted execution environment and cannot be obtained by the untrusted execution environment; the encrypted secure data objects are passed to the eMMCRPMB driver in the untrusted execution environment through shared memory, and the eMMCRPMB driver completes the access and storage of the eMMCRPMB partition, thereby ensuring the security of the data objects.

[0004] In the prior art, the process of encrypting and decrypting secure data is generally carried out in an untrusted ordinary operating system environment. The calculation process is easily intercepted by hackers. The keys used for encryption and decryption, or the plaintext data used for calculations, may be read and replaced, which makes the encryption process risky and affects the security of data storage. To this end, we propose a cloud secure data storage method that supports dynamic encryption. Summary of the invention

[0005] The purpose of the present invention is to provide a cloud security data storage method supporting dynamic encryption, which solves the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: a cloud security data storage method supporting dynamic encryption, comprising the following steps:

[0007] Usage scenario: User A and User B, User A is the accessing user, User B is the accessed user. User B opens the operating system and sets up a database of his own in the operating system. The data in the database is divided into two parts: visible to everyone and visible only to himself. If User B does not authorize others to access the data visible only to himself, others cannot access the database. If others need to access User B's encrypted data, they need to unlock it with User B's key before accessing it. User B dynamically encrypts and locks the data visible only to himself, so that others cannot view it.

[0008] S1. User B unlocks the database, and extracts and stores the data in the database separately;

[0009] S2. User B wants to ensure that the data in the database is encrypted and locked so that users who are not authorized by User B cannot view the data in the database. User A applies to User B for access rights.

[0010] S3. User B confirms the identity information of user A and authorizes user A. After user A is authorized by user B, he enters the password provided by user B to unlock the data in the database.

[0011] The data in the database can then be viewed and copied, but cannot be changed;

[0012] S4. User A copies the viewed data and stores it separately and performs dynamic encryption, so that the separately stored data can be edited and modified by user A.

[0013] Preferably, when user B authorizes user A, user B will send a verification code to user A, and the verification code is used to confirm the user's identity and whether it is the user authorized by user B.

[0014] Preferably, when the data processing output is in the accessible list, user A selects the data to be granted permission according to needs.

[0015] Preferably, the verification code is a combination of numbers and letters, and the verification code has a certain time limit, and the verification effect of the verification code is effective within a certain period of time.

[0016] Preferably, the combination of numbers and letters in the verification code has a certain degree of security and is not easily accessed by other users by randomly inputting it.

[0017] Preferably, in S4, when user A dynamically encrypts the separately stored data, the data is locked by setting a picture password.

[0018] Preferably, the picture password includes a picture specified by user A, and unlocking is performed by clicking a specified position in the picture to prevent other users from viewing user A's data.

[0019] Preferably, the picture set in the picture password remains unchanged after being set by user A.

[0020] Preferably, the storing access data further comprises the following steps:

[0021] SS1, divide the target data into several data blocks, encrypt the data blocks by block using the SM4 encryption algorithm to obtain encrypted data blocks, and the encryption algorithm is configured with an encryption key;

[0022] SS2: Randomly scramble the encrypted data block using a preset scrambling algorithm, where the scrambling algorithm is configured with a scrambling key;

[0023] SS3, upload the scrambled encrypted data blocks to different cloud hosts for fractional storage, and create a storage index on the local host;

[0024] SS4, according to the storage index, downloads the encrypted data block corresponding to the target file from the cloud host, performs inverse scrambling according to the scrambling key, decrypts according to the encryption key, and reconstructs the target file.

[0025] Preferably, the random scrambling is performed using a preset scrambling algorithm, and the scrambling algorithm is configured with a scrambling key, including: using the scrambling key to generate a random number to perform random scrambling on the encrypted data block.

[0026] Preferably, the encrypted data blocks corresponding to the target files are downloaded from the cloud host and reversely scrambled according to the scrambling key, including: downloading the corresponding encrypted data blocks to the local host according to the storage index, generating random numbers according to the scrambling key, reversely scrambling the encrypted data blocks, and restoring the original block order.

[0027] The present invention provides a cloud security data storage method supporting dynamic encryption. The cloud security data storage method supporting dynamic encryption has the following beneficial effects:

[0028] (1) The cloud secure data storage method supporting dynamic encryption supports block encryption and random scrambling of target files, and transmits them to multiple different cloud hosts for distributed storage in the cloud. Authorized users can open the system and download the encrypted data blocks corresponding to the target files from the cloud host, which supports users to browse and use files without obstacles, and can effectively avoid data leakage during transmission;

[0029] (2) The cloud secure data storage method supporting dynamic encryption encrypts the original file to be encrypted locally in blocks and performs random scrambling, which can effectively avoid data leakage during transmission. The encrypted data blocks are randomly and disorderly distributed in the cloud and stored in multiple cloud hosts, which can prevent attackers from obtaining all the encrypted data of the original file. Even if the attacker obtains part of the encrypted data block, it is difficult to determine the corresponding original file because the data blocks are of the same size, which can effectively avoid big data analysis attacks.

[0030] (3) The cloud security data storage method that supports dynamic encryption effectively avoids the possibility of data being intercepted by hackers by performing layer-by-layer encryption protection on the data, thereby improving the security of data storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a flowchart of the operation process of the present invention;

[0032] Figure 2 It is a detailed step schematic diagram of the present invention;

[0033] Figure 3 It is a schematic diagram of the steps of storing access data in the present invention. DETAILED DESCRIPTION

[0034] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described with reference to the accompanying drawings.

[0035] A preferred embodiment of a cloud security data storage method supporting dynamic encryption provided by the present invention is as follows: Figures 1 to 3 A cloud secure data storage method supporting dynamic encryption is shown, comprising the following steps:

[0036] Usage scenario: User A and User B, User A is the accessing user, User B is the accessed user. User B opens the operating system and sets up a database of his own in the operating system. The data in the database is divided into two parts: visible to everyone and visible only to himself. If User B does not authorize others to access the data visible only to himself, others cannot access the database. If others need to access User B's encrypted data, they need to unlock it with User B's key before accessing it. User B dynamically encrypts and locks the data visible only to himself, so that others cannot view it.

[0037] S1. User B unlocks the database, and extracts and stores the data in the database separately;

[0038] S2. User B wants to ensure that the data in the database is encrypted and locked so that users who are not authorized by User B cannot view the data in the database. User A applies to User B for access rights.

[0039] S3. User B confirms the identity information of user A and authorizes user A. After user A is authorized by user B, he enters the password provided by user B to unlock the data in the database.

[0040] The data in the database can then be viewed and copied, but cannot be changed;

[0041] S4. User A copies the viewed data and stores it separately and performs dynamic encryption, so that the separately stored data can be edited and modified by user A.

[0042] Furthermore, when user B authorizes user A, user B will send a verification code to user A. The verification code is used to confirm the user's identity and whether it is the user authorized by user B.

[0043] Furthermore, the verification code is a combination of numbers and letters, and the verification code has a certain time limit, and the verification effect of the verification code is valid within a certain period of time.

[0044] Furthermore, the combination of numbers and letters in the verification code has a certain degree of security and is not easily accessed by other users by randomly entering it.

[0045] Furthermore, in S4, when user A dynamically encrypts the separately stored data, the data is locked by setting a picture password.

[0046] Furthermore, the picture password includes a picture specified by user A, and clicks on a specified position in the picture to unlock it, thereby preventing other users from viewing user A's data.

[0047] Furthermore, the picture set in the picture password remains unchanged after being set by user A.

[0048] Furthermore, storing access data further includes the following steps:

[0049] SS1, divide the target data into several data blocks, encrypt the data blocks by block using the SM4 encryption algorithm to obtain encrypted data blocks, and the encryption algorithm is configured with an encryption key;

[0050] SS2: Randomly scramble the encrypted data block using a preset scrambling algorithm, where the scrambling algorithm is configured with a scrambling key;

[0051] SS3, upload the scrambled encrypted data blocks to different cloud hosts for fractional storage, and create a storage index on the local host;

[0052] SS4, according to the storage index, downloads the encrypted data block corresponding to the target file from the cloud host, performs inverse scrambling according to the scrambling key, decrypts according to the encryption key, and reconstructs the target file.

[0053] Furthermore, a preset scrambling algorithm is used to perform random scrambling, and the scrambling algorithm is configured with a scrambling key, including: using the scrambling key to generate a random number to perform random scrambling on the encrypted data block.

[0054] In addition, the encrypted data block corresponding to the target file is downloaded from the cloud host and reversely scrambled according to the scrambling key, including: downloading the corresponding encrypted data block to the local host according to the storage index, generating a random number according to the scrambling key, reversely scrambling the encrypted data block, and restoring the original block order.

[0055] Working principle:

[0056] S1, system initialization, used to restore the operating system to its initial state and determine user A and user B;

[0057] S2. Authorize access to users, which is used for user B to authorize user A to access user B's data. During the process of authorizing access to users, after the user data is input into the data processing, the data processing will output a result that is in the accessible list or not in the accessible list. When the data processing output is in the accessible list, user A selects the data to be granted permission according to the demand. When the data processing output is not in the accessible list, the data access process will end directly and restore to the initial state.

[0058] S3, determine access data, for user A to determine the data of user B that needs to be accessed;

[0059] S4, unlocking access data, used for user A to unlock access data using the key of user B, unlocking access data includes user A unlocking access data using the key granted by user B, after the key is input, it will be subjected to cryptographic processing for cryptographic analysis, and the cryptographic processing will output any result of correct password input or incorrect password input after the cryptographic analysis, and when the cryptographic processing outputs that the password input is correct, it will output the data that user A needs to access, and when the cryptographic processing outputs that the password input is incorrect, the data access process will end directly and restore to the initial state;

[0060] S5, storage access data, used for user A to extract and store the unlocked data separately, storage access data includes dividing the target data into several data blocks, encrypting the data blocks by blocks using the SM4 encryption algorithm to obtain encrypted data blocks, the encryption algorithm is configured with an encryption key, using a preset scrambling algorithm to randomly scramble the encrypted data blocks, the scrambling algorithm is configured with a scrambling key, uploading the scrambled encrypted data blocks to different cloud hosts for fractional storage, and establishing a storage index on the local host, according to the storage index, downloading the encrypted data blocks corresponding to the target file from the cloud host, performing inverse scrambling according to the scrambling key, decrypting them respectively according to the encryption key, and reorganizing the target file;

[0061] S6. Dynamically encrypt the stored data, so that user A can encrypt and lock the stored data;

[0062] S7. After the dynamic encryption is completed, the system is exited, which is used for user A to exit the operating system.

[0063] The present invention encompasses any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention. In order to make the public have a thorough understanding of the present invention, specific details are described in detail in the above preferred embodiments of the present invention, and those skilled in the art can fully understand the present invention without the description of these details.

[0064] The above description is only an illustrative specific implementation mode of the present invention and is not intended to limit the scope of the present invention. Any equivalent changes and modifications made by any technician in the field without departing from the concept and principle of the present invention should fall within the scope of protection of the present invention. It should also be noted that the various components of the present invention are not limited to the above-mentioned overall application. The various technical features described in the specification of the present invention can be selected one by one or multiple ones can be selected and used in combination according to actual needs. Therefore, the present invention should naturally cover other combinations and specific applications related to this case.

Claims

1. A cloud secure data storage method supporting dynamic encryption, characterized in that: The following steps are involved: S1. User B unlocks the database, and extracts and stores the data in the database separately; S2. User B wants to ensure that the data in the database is encrypted and locked so that users who are not authorized by User B cannot view the data in the database. User A applies to User B for access rights. S3. User B confirms the identity information of user A and authorizes user A. After user A is authorized by user B, he enters the password provided by user B to unlock the data in the database. The data in the database can then be viewed and copied, but cannot be changed; S4. User A copies the viewed data and stores it separately and performs dynamic encryption, so that the separately stored data can be edited and modified by user A.

2. A cloud secure data storage method supporting dynamic encryption according to claim 1, characterized in that: When user B authorizes user A, user B will send a verification code to user A. The verification code is used to confirm the user's identity and whether it is the user authorized by user B.

3. A cloud secure data storage method supporting dynamic encryption according to claim 2, characterized in that: The verification code is a combination of numbers and letters, and the verification code has a certain time limit. The verification code verification effect is valid within a certain period of time.

4. A cloud secure data storage method supporting dynamic encryption according to claim 2, characterized in that: The combination of numbers and letters in the verification code has a certain degree of security and is not easily accessed by other users by randomly inputting it.

5. The cloud secure data storage method supporting dynamic encryption according to claim 1, characterized in that: In S4, when user A dynamically encrypts the separately stored data, the data is locked by setting a picture password.

6. A cloud secure data storage method supporting dynamic encryption according to claim 5, characterized in that: The picture password includes a picture specified by user A, and clicks on a specified position in the picture to unlock it, preventing other users from viewing user A's data.

7. A cloud secure data storage method supporting dynamic encryption according to claim 5, characterized in that: The picture set in the picture password remains unchanged after being set by user A.

8. A cloud secure data storage method supporting dynamic encryption according to claim 1, characterized in that: The storing access data further comprises the following steps: SS1, divide the target data into several data blocks, encrypt the data blocks by block using the SM4 encryption algorithm to obtain encrypted data blocks, and the encryption algorithm is configured with an encryption key; SS2: Randomly scramble the encrypted data block using a preset scrambling algorithm, where the scrambling algorithm is configured with a scrambling key; SS3, upload the scrambled encrypted data blocks to different cloud hosts for fractional storage, and create a storage index on the local host; SS4, according to the storage index, downloads the encrypted data block corresponding to the target file from the cloud host, performs inverse scrambling according to the scrambling key, decrypts according to the encryption key, and reconstructs the target file.

9. A cloud secure data storage method supporting dynamic encryption according to claim 8, characterized in that: The scrambling is performed using a preset scrambling algorithm, wherein the scrambling algorithm is configured with a scrambling key, including: using the scrambling key to generate a random number to randomly scramble the encrypted data block.

10. A cloud secure data storage method supporting dynamic encryption according to claim 8, characterized in that: Download the encrypted data block corresponding to the target file from the cloud host, and perform reverse scrambling according to the scrambling key, including: downloading the corresponding encrypted data block to the local host according to the storage index, generating a random number according to the scrambling key, reverse scrambling the encrypted data block, and restoring the original block order.

Images