Multi-level data encryption storage and access control method based on cloud computing

Abstract

The invention is applied to the technical field of data storage, and particularly discloses a multilevel data encryption storage and access control method based on cloud computing, which comprises the following steps of: 1, data classification and multilevel encryption; step 2, constructing a layered secret key; step 3, data access control; and 4, constructing and dynamically updating the data access authority. According to the multi-level data encryption storage and access control method based on cloud computing, encryption grade division is performed on data according to the data confidentiality degree, and algorithm encryption with different intensities is performed on the data according to different encryption grades, so that encryption can be performed for different types of data, and compared with traditional single algorithm encryption, the encryption efficiency is improved. According to the technical scheme, the adaptability of data encryption can be improved, meanwhile, three levels of key structures are arranged to be matched with one another, the main key protects the middle key, the middle key isolates direct association of the main key, the working key and the data, and the exposure risk of the main key is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of data storage, and specifically to a multi-level data encryption storage and access control method based on cloud computing. Background Technique

[0002] Data storage refers to the process of recording data in a certain format on computer storage devices or media for long-term preservation and subsequent access and use. Data storage is a key link in computer systems and information technology, aiming to ensure the security, integrity, and availability of data. Cloud computing provides powerful computing capabilities, flexible resource allocation, and efficient data management platforms for data storage, while data storage is the foundation for cloud computing to implement various services and applications, providing data support for the development of cloud computing. To ensure data security, it is necessary to encrypt data during the storage process.

[0003] Traditional encryption methods usually use a single encryption algorithm to encrypt data. This method has certain limitations in the cloud computing environment. A single encryption algorithm may not be able to meet the encryption requirements of different types of data, and once the encryption key is leaked, the entire data will face the risk of being cracked, thus affecting data security. Summary of the Invention

[0004] The purpose of the present invention is to provide a multi-level data encryption storage and access control method based on cloud computing to solve the problem that data encrypted using a single algorithm in the above background technique cannot meet the encryption requirements of different data.

[0005] To achieve the above purpose, the present invention provides the following technical solution: A multi-level data encryption storage and access control method based on cloud computing, including the following steps: Step 1: Data classification and multi-level encryption; classify the encryption levels of data according to the confidentiality level of the data, and use different algorithms to encrypt data at different levels; Step 2: Hierarchical key construction; construct multi-level key encryption according to the encryption level classification of the data; Step 3: Data access control; jointly judge the abnormal degree of the behavior of the accessing user from multiple parameters, and normal users determine their access degree to the data based on the access rights. Step 4: Construction and dynamic update of data access rights; construct access right levels based on the data encryption levels, and dynamically update the rights according to the users. Preferably, Step 4: Construction and dynamic update of data access rights; construct access right levels based on the data encryption levels, and dynamically update the rights according to the users.

[0006] With the above technical solution, the encrypted storage and access control of data can be realized by using multi-level encryption of data and dynamic update of access rights.

[0007] Preferably, in the process of constructing the hierarchical secret key in step two, a three-level secret key structure is included. The three-level secret key structure includes a master secret key, an intermediate secret key, and a working secret key. The master secret key encrypts the intermediate secret key, and the intermediate secret key encrypts the working secret key. The master secret key ensures the confidentiality and integrity of the intermediate secret key during storage and transmission. The intermediate secret key is used to isolate the master secret key and the working secret key, and the intermediate secret key is used to isolate the direct association between the master secret key and the data, thereby reducing the risk of exposure of the master secret key. The working secret key is used to encrypt and decrypt data, and the working secret key includes encryption algorithms with first-level strength encryption, second-level strength encryption, third-level strength encryption, and fourth-level strength encryption.

[0008] With the above technical solution, the three-level secret key structure in the construction of the hierarchical secret key can increase the encryption strength of data and ensure the security of data.

[0009] Preferably, in the process of data access control in step three, the data access process of the access user is as follows: The access user conducts a primary verification, and the primary verification process collects the basic verification information of the access user through the cloud computing platform for data storage; The cloud computing platform for data storage conducts a primary verification on the access user; Subsequent operations are carried out according to the result of the primary verification. If the primary verification passes, subsequent secondary verification is carried out. If the primary verification fails, additional verification is carried out; According to the result of the additional verification, if the additional verification passes, the access user conducts a primary verification again. If the additional verification fails, the cloud computing platform outputs an alarm for abnormal login of the access user; The access user who passes the primary verification conducts a secondary verification again. The access user who passes the secondary verification accesses the data on the cloud computing platform for data storage. If the secondary verification fails, additional verification is carried out; According to the result of the additional verification, if the additional verification passes, the access user conducts a secondary verification again. If the additional verification fails, the cloud computing platform outputs an alarm for abnormal login of the access user; The primary verification includes basic information verification, and the basic information verification includes username verification, password verification, and digital certificate verification. The secondary verification includes user behavior verification, and the user behavior verification includes access time verification, access frequency verification, and access location verification. The additional verification includes identity information verification, and the identity information verification is a short message verification code and fingerprint recognition.

[0010] Adopting the above technical solution, by using multiple verifications in the data access control process, the security of the access process during the storage of encrypted data can be increased.

[0011] Preferably, during the construction and dynamic update of the data access permission in step four, multi-level permission control is set. The multi-level permission control includes first-level permission, second-level permission, third-level permission, and fourth-level permission. The permission scope increases in the order of first-level permission, second-level permission, third-level permission, and fourth-level permission. The first-level permission is used to access public data. The second-level permission adds the access scope of first-level encrypted data on the basis of the first-level permission. The third-level permission adds the access scope of second-level encrypted data on the basis of the second-level permission. The fourth-level permission adds the access scope of core encrypted data on the basis of the third-level permission.

[0012] Adopting the above technical solution, different levels of access permissions can be set for encrypted data of different strengths by using multi-level permission control.

[0013] Preferably, the multi-level permission control dynamically generates corresponding encryption keys according to the change of the user's permission, and matches the access permission of the accessing user according to the encryption key. The encryption key is dynamically updated, so as to update the permission of the accessing user in a timely manner.

[0014] Adopting the above technical solution, the access permission of the accessing user can be dynamically updated by using the dynamically generated encryption key.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: The multi-level data encryption storage and access control method based on cloud computing: 1. In the present invention, the encryption levels of data are divided according to the data confidentiality level, and different strengths of algorithm encryption are performed on the data according to different encryption levels, so that different types of data can be encrypted. Compared with the traditional single-algorithm encryption, the adaptability of data encryption can be improved. At the same time, a three-level key structure is set to cooperate with each other. The master key protects the intermediate key, and the intermediate key isolates the direct association between the master key and the working key and the data, reducing the risk of master key exposure. Even if a certain level of key is leaked, the data security can be protected to the greatest extent, comprehensively improving the security of data during storage and transmission; Furthermore, by setting multi-level permission control, the user access permissions are accurately allocated according to the data encryption level, avoiding the abuse of permissions. At the same time, encryption keys are dynamically generated and updated according to the change of the user's permission, and the user access permissions are timely matched, so that the access permissions of the accessing users can be adjusted quickly, improving the flexibility of data access, and at the same time ensuring the security and privacy of the data; 2. In the user access process with multiple verifications set in the present invention, the user identity is initially confirmed through the verification of the username, password, and digital certificate in the first verification. The access time, frequency, location, etc. of the user are verified through the second verification. If there are abnormalities in the accessing user during the first verification and the second verification, the identity of the accessing user is verified through identity information such as SMS verification code and fingerprint recognition in the additional verification. The accessing user who passes the verification can access the data, while the user who fails the verification will output an abnormal login of the accessing user. Through the mutual cooperation among multiple verifications, the accuracy and security of user identity authentication are improved, and the risk of data leakage is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a schematic structural diagram of the process of the present invention; Figure 2 It is a schematic structural diagram of the data hierarchical encryption of the present invention; Figure 3 It is a schematic structural diagram of the user access data process of the present invention; Figure 4 It is a schematic structural diagram of the permission hierarchy of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0017] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0018] Please refer to Figures 1-4 , the present invention provides a technical solution: a multi-level data encryption storage and access control method based on cloud computing.

[0019] In the process of data classification and multi-level encryption in Step 1, the data is divided into four levels, including public data, first-level encrypted data, second-level encrypted data, and core encrypted data. The data encryption levels increase in sequence according to the order of public data, first-level encrypted data, second-level encrypted data, and core encrypted data. The public data is encrypted with first-level strength, the first-level encrypted data is encrypted with second-level strength, the second-level encrypted data is encrypted with third-level strength, and the core encrypted data is encrypted with fourth-level strength. The first-level strength encryption uses the RC4 encryption algorithm to encrypt the data, the second-level strength encryption uses the 3DES encryption algorithm to encrypt the data, the third-level strength encryption uses the AES encryption algorithm to encrypt the data, and the fourth-level strength encryption uses the ECC encryption algorithm to encrypt the data; Such as Figure 1 and Figure 2As shown, the data stored in the cloud computing platform is carefully classified according to the degree of confidentiality, so that the data is divided into four levels in sequence according to the degree of confidentiality of the data: public data, first-level encrypted data, second-level encrypted data, and core encrypted data. The encryption levels increase in sequence. The simple and efficient RC4 algorithm is used to encrypt the public data, which is suitable for encrypting public data with relatively low security requirements. The 3DES with higher security is used to encrypt the first-level encrypted data to ensure the security of the first-level encrypted data and meet the security requirements of the first-level encrypted data. The AES encryption algorithm is used to encrypt the second-level encrypted data. The AES algorithm has high security and is used to encrypt the second-level encrypted data. Since the core encrypted data has a high degree of confidentiality, the ECC encryption algorithm is used for encryption. The ECC algorithm has significant advantages in terms of security and key length and is suitable for protecting the core encrypted data.

[0020] In the process of constructing the hierarchical secret key in Step 2, a three-level secret key structure is included. The three-level secret key structure includes a master secret key, an intermediate secret key, and a working secret key. The master secret key encrypts the intermediate secret key, and the intermediate secret key encrypts the working secret key. The master secret key ensures the confidentiality and integrity of the intermediate secret key during storage and transmission. The intermediate secret key is used to isolate the master secret key and the working secret key, and the intermediate secret key is used to isolate the direct association between the master key and the data, thereby reducing the risk of exposure of the master key. The working secret key is used for encryption and decryption operations on the data. The working secret key includes encryption algorithms of first-level strength encryption, second-level strength encryption, third-level strength encryption, and fourth-level strength encryption; As Figure 1 and Figure 2 shown, in the process of encrypting the data, a three-level secret key structure including a master secret key, an intermediate secret key, and a working secret key is constructed. The master secret key is the most critical and core key, which encrypts and protects the intermediate secret key to ensure the confidentiality and integrity of the intermediate secret key during storage and transmission, preventing the intermediate secret key from being accessed and tampered with without authorization. The master secret key generates the intermediate secret key through a specific key generation algorithm, receives the encryption protection of the master key, and at the same time manages and protects the working secret key. The intermediate secret key encrypts the working secret key, and at the same time isolates the master secret key and the working secret key, thereby reducing the risk of exposure of the master key. The working secret key is used for actual data encryption and decryption operations.

[0021] In the data access control process of Step 3, the data access process of the accessing user is as follows: The accessing user conducts a primary verification. During the primary verification process, the basic verification information of the accessing user is collected through the cloud computing platform for data storage; the cloud computing platform for data storage conducts a primary verification on the accessing user; subsequent operations are performed based on the result of the primary verification. If the primary verification passes, a subsequent secondary verification is carried out. If the primary verification fails, additional verification is conducted; based on the result of the additional verification, if the additional verification passes, the accessing user conducts a primary verification again. If the additional verification fails, the cloud computing platform outputs an alarm for abnormal login of the accessing user; the accessing user who has passed the primary verification conducts a secondary verification again. The accessing user who has passed the secondary verification accesses data on the cloud computing platform for data storage. If the secondary verification fails, additional verification is conducted; based on the result of the additional verification, if the additional verification passes, the accessing user conducts a secondary verification again. If the additional verification fails, the cloud computing platform outputs an alarm for abnormal login of the accessing user; the primary verification includes basic information verification, and the basic information verification includes username verification, password verification, and digital certificate verification. The secondary verification includes user behavior verification, and the user behavior verification includes access time verification, access frequency verification, and access location verification. The additional verification includes identity information verification, and the identity information verification is a SMS verification code and fingerprint recognition; As Figure 3 shown, when the accessing user is in the process of accessing data, the accessing user first conducts a primary verification. During the primary verification, the cloud computing platform collects basic verification information such as the username, password, and digital certificate of the accessing user and verifies the information. If the primary verification passes, it enters the secondary verification. If the primary verification fails, additional verification is conducted. Identity information verification methods such as SMS verification codes and fingerprint recognition are used to verify the identity of the accessing user. If the additional verification passes, the user conducts a primary verification again. During the secondary verification, the access behavior of the accessing user is verified, including aspects such as access time, access frequency, and access location. If there is abnormal access data, such as frequent access from multiple different locations within a short period of time, it is judged that the verification fails and another additional verification is conducted. If the additional verification passes, the user conducts a secondary verification again. After the secondary verification passes, the accessing user accesses the data. If the additional verification fails, the cloud computing platform outputs an alarm message for abnormal login of the accessing user.

[0022] In the process of constructing and dynamically updating data access permissions in Step 4, multi-level permission control is set. The multi-level permission control includes first-level permission, second-level permission, third-level permission, and fourth-level permission. The permission scope increases in the order of first-level permission, second-level permission, third-level permission, and fourth-level permission. The first-level permission is used to access public data. The second-level permission adds the access scope of first-level encrypted data on the basis of the first-level permission. The third-level permission adds the access scope of second-level encrypted data on the basis of the second-level permission. The fourth-level permission adds the access scope of core encrypted data on the basis of the third-level permission. The multi-level permission control dynamically generates corresponding encryption keys according to the changes in user permissions, matches the access permissions of accessing users according to the encryption keys, and the encryption keys are dynamically updated, so as to update the permissions of accessing users in a timely manner; As Figure 4 shown, by setting the multi-level permission control, the permission scopes of the first-level permission, second-level permission, third-level permission, and fourth-level permission increase in sequence. The data access scope of the user is controlled according to the permission level of the accessing user. When the user's permission changes, the system will dynamically generate the corresponding encryption key, and match and update the access permission of the accessing user according to the encryption key, ensuring that the access permission of the user always matches the actual requirements and the data encryption level.

[0023] Working principle: Classify the data encryption levels according to the confidentiality degree of the data. Different levels of data are encrypted using different algorithms. And according to the classification of the data encryption levels, construct multi-layer secret key encryption. During the process of the user accessing the data, jointly judge the abnormal degree of the accessing user's behavior from multiple parameters, and determine the access scope of the accessing user to the data based on the access permission. Construct the access permission level according to the data encryption level, and dynamically update the permission according to the user, ensuring the security of the encrypted data during the process of the accessing user accessing the data.

[0024] Although the embodiments of the present invention have been shown and described, it will be understood by those of ordinary skill in the art that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention.

Claims

1. A multi-level data encryption storage and access control method based on cloud computing, characterized in that: It includes the following steps: Step 1: Data classification and multi-level encryption; classify the encryption levels of data according to the confidentiality level of the data, and use different algorithms to encrypt data at different levels; Step 2: Hierarchical key construction; construct multi-level key encryption according to the encryption level classification of the data; Step 3: Data access control; jointly judge the behavior abnormality degree of the accessing user from multiple parameters, and the normal user determines its access degree to the data based on the access permission; Step 4: Data access permission construction and dynamic update; construct the access permission level based on the data encryption level, and perform dynamic update of the permission according to the user.

2. The multi-level data encryption storage and access control method based on cloud computing according to claim 1, characterized in that: During the process of data classification and multi-level encryption in Step 1, the data is divided into four levels, including public data, first-level encrypted data, second-level encrypted data, and core encrypted data. The data encryption levels increase in sequence according to the order of public data, first-level encrypted data, second-level encrypted data, and core encrypted data. The public data uses first-level strength encryption, the first-level encrypted data uses second-level strength encryption, the second-level encrypted data uses third-level strength encryption, and the core encrypted data uses fourth-level strength encryption. The first-level strength encryption uses the RC4 encryption algorithm to encrypt the data, the second-level strength encryption uses the 3DES encryption algorithm to encrypt the data, the third-level strength encryption uses the AES encryption algorithm to encrypt the data, and the fourth-level strength encryption uses the ECC encryption algorithm to encrypt the data.

3. The multi-level data encryption storage and access control method based on cloud computing according to claim 1, characterized in that: During the process of hierarchical key construction in Step 2, it includes a three-level key structure, which includes a master key, an intermediate key, and a working key. The master key encrypts the intermediate key, and the intermediate key encrypts the working key. The master key ensures the confidentiality and integrity of the intermediate key during storage and transmission. The intermediate key is used to isolate the master key and the working key, and the intermediate key is used to isolate the direct association between the master key and the data, thereby reducing the risk of exposure of the master key. The working key is used to encrypt and decrypt the data, and the working key includes encryption algorithms of first-level strength encryption, second-level strength encryption, third-level strength encryption, and fourth-level strength encryption.

4. The multi-level data encryption storage and access control method based on cloud computing according to claim 1, characterized in that: During the process of data access control in Step 3, the data access process of the accessing user is as follows: The accessing user conducts a primary verification, and the primary verification process collects the basic verification information of the accessing user through the cloud computing platform for data storage; The cloud computing platform for data storage conducts a primary verification on the accessing user; Perform subsequent operations according to the result of the primary verification. If the primary verification passes, conduct subsequent secondary verification. If the primary verification fails, conduct additional verification; According to the result of the additional verification, if the additional verification passes, the accessing user conducts a primary verification again. If the additional verification fails, the cloud computing platform outputs an alarm for abnormal login of the accessing user; The accessing user who passes the primary verification conducts a secondary verification again. The accessing user who passes the secondary verification accesses the data on the cloud computing platform for data storage. If the secondary verification fails, conduct additional verification; According to the results of additional verification, if the additional verification passes, the accessing user will perform secondary verification again. If the additional verification fails, the cloud computing platform will output an alarm for abnormal login of the accessing user. The primary verification includes basic information verification, which includes username verification, password verification, and digital certificate verification. The secondary verification includes user behavior verification, which includes access time verification, access frequency verification, and access location verification. The additional verification includes identity information verification, which is SMS verification code and fingerprint recognition.

5. The multi-level data encryption storage and access control method based on cloud computing according to claim 1, characterized in that: During the process of constructing and dynamically updating data access permissions in Step 4, multi-level permission control is set. The multi-level permission control includes first-level permission, second-level permission, third-level permission, and fourth-level permission. The scope of permissions increases in the order of first-level permission, second-level permission, third-level permission, and fourth-level permission. The first-level permission allows access to public data. The second-level permission adds the access scope of first-level encrypted data on the basis of the first-level permission. The third-level permission adds the access scope of second-level encrypted data on the basis of the second-level permission. The fourth-level permission adds the access scope of core encrypted data on the basis of the third-level permission.

6. The multi-level data encryption storage and access control method based on cloud computing according to claim 5, characterized in that: The multi-level permission control dynamically generates corresponding encryption keys according to the changes in user permissions, and matches the access permissions of the accessing user according to the encryption keys. The encryption keys are dynamically updated, so as to update the permissions of the accessing user in a timely manner.

Images