Encryption protection method for network data backup and recovery

Abstract

The invention discloses an encryption protection method for network data backup and recovery, which relates to the technical field of data protection, and comprises the following steps: respectively implementing differential backup strategies by adopting a local, cloud and remote three-terminal collaborative backup architecture; and performing local data backup by a combined scheme of complete backup and incremental backup to generate a chained hash value sequence. Three-terminal key isolation and dynamic derivation are adopted to guarantee data security, an independent key system is adopted locally, cloud and remotely, a chain type key is generated locally based on a hash chain, version independent keys are generated at the cloud and remotely, and data security of other terminals is not affected by key leakage of any storage terminal. The recovery priority is automatically switched from local to cloud to remote, the local decrypts incremental data layer by layer through a hash chain, the cloud directly calls an independent key of a target version and uses a synthetic backup complete copy in remote, and the disaster recovery efficiency is improved through layered recovery and synthetic backup.

Description

Technical Field

[0001] The present invention relates to the technical field of data protection, and in particular to an encryption protection method for network data backup and recovery. Background Art

[0002] Network data backup and recovery refers to the process of copying critical data from its original storage location to other media or areas through systematic technical means, and restoring the data quickly and completely when the data is lost, damaged or tampered with.

[0003] With the acceleration of digitalization, data has become a core asset for businesses and individuals. Encryption of network data uses cryptographic techniques to ensure the confidentiality, integrity, and availability of data during storage, transmission, and processing, while also defending against malicious attacks and unauthorized access. This has become a crucial means of safeguarding data assets. However, risks such as data leaks, hardware failures, and cyberattacks pose significant challenges to data security. Traditional backup solutions often rely on static encryption keys or a single storage location, which carries drawbacks such as the risk of key reuse, low recovery efficiency, and weak disaster resilience. Summary of the Invention

[0004] The purpose of the present invention is to provide an encryption protection method for network data backup and recovery to solve the problems raised by the above background technology.

[0005] To achieve the above-mentioned object, the present invention provides the following technical solutions: an encryption protection method for network data backup and recovery, comprising: adopting a local, cloud, and remote three-end collaborative backup architecture, and implementing differentiated backup strategies respectively;

[0006] Perform local data backup using a combination of full and incremental backups to generate a chained hash value sequence.

[0007] Back up cloud data using a combination of full and differential backups to generate an independent hash value sequence.

[0008] Perform off-site data backup using a combination of full backup and synthetic backup to generate an independent hash value sequence;

[0009] The initial key is derived from the full backup hash value, the dynamic chain key is derived from the incremental backup hash value, and the dynamic independent key is derived from the differential backup and synthetic backup hash values respectively.

[0010] Preferably, the local storage backup strategy includes:

[0011] Regular full backup generates a baseline hash value H 0-Full ;

[0012] Generate an incremental hash value sequence H each time the data is changed1-Incr →H n-Incr ;

[0013] The hash value sequence forms a one-way chain structure, and tampering with any hash value will cause the subsequent keys to become invalid.

[0014] Preferably, the cloud storage backup strategy includes:

[0015] Full backup is synchronized with local storage to generate H 0-Full ;

[0016] Differential backup generates an independent hash value sequence H 1-Diff →H n-Diff ;

[0017] A differential backup records only the data that has changed since the most recent full backup.

[0018] Preferably, the off-site storage backup strategy includes:

[0019] A synthetic backup combines an incremental or differential backup with a full backup to generate an independent hash value sequence H. 1-Syn →H n-Syn ;

[0020] The synthetic backup is decrypted with an independent key and is decoupled from the original backup chain.

[0021] Preferably, the dynamic key derivation mechanism includes:

[0022] Combine the full backup hash value with the incremental backup chain hash value sequence, the differential backup independent hash value sequence, and the synthetic backup independent hash value sequence, input the key derivation function, set the high-intensity iteration number and salt value, and generate a dynamic key;

[0023] Derive the initial key K0 based on the full backup hash value;

[0024] The dynamic chain key K is derived based on the combination of the full backup hash value and the incremental backup chain hash value sequence. 1-Incr →K n-Incr ;

[0025] Derive the dynamic chain key K based on the full backup hash value and the differential backup chain hash value sequence 1-Diff →K n-Diff ;

[0026] The dynamic chain key K is derived based on the combination of the full backup hash value and the synthetic backup chain hash value sequence. 1-Syn →K n-Syn .

[0027] Preferably, the initial key K0 is stored separately from the full backup data in the local disk, the dynamic key is uploaded to the cloud after transmission encryption and stored separately from the differential backup data, the secondary dynamic key is re-derived after the local backup data or the cloud backup data is tampered with, and the secondary dynamic key is stored separately from the synthetic backup data in an off-site disk after transmission encryption.

[0028] Preferably, the three-end backup architecture adopts a zero-trust network architecture for security protection during the data transmission process, and performs strict identity authentication and authorization on each data transmission request to ensure that only authorized users and devices can perform data backup and recovery operations.

[0029] Preferably, an encryption protection system is used, and the system architecture includes: a client control module, a cloud gateway module, an off-site storage module, a hardware acceleration module, and a security management module;

[0030] The client control module integrates hash generation, key derivation, and encryption engines;

[0031] The cloud gateway module implements TLS encrypted transmission and storage interface;

[0032] The offsite storage module is equipped with a synthetic backup engine and key isolation controller;

[0033] The hardware acceleration module is used to optimize key derivation and encryption operations;

[0034] The security management module is used to implement the key vault and record audit logs.

[0035] Preferably, an automatic cleanup mechanism for backup data is provided to automatically clean up expired full backup, incremental backup, differential backup and synthetic backup data according to a preset time period and storage capacity threshold, and to clean up the hash values and keys associated therewith accordingly to optimize the use of storage space.

[0036] Preferably, a temporary session key is used for each data transmission, and leakage of historical keys does not affect the security of subsequent communications;

[0037] Local, cloud, and remote keys are stored in independent physical security areas. Attacking a single area does not affect the security of keys in other areas.

[0038] When hash value tampering is detected, key update is automatically triggered and subsequent hash chains are rebuilt.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] 1. This invention uses three-end key isolation and dynamic derivation to ensure data security. Independent key systems are used locally, in the cloud, and remotely. The local system generates chain keys based on hash chains, while the cloud and remote systems generate version-independent keys. Leakage of the key at any storage end does not affect the data security of other ends. Recovery priority automatically switches from local to cloud to remote. The local system decrypts incremental data layer by layer through the hash chain, while the cloud directly calls the target version's independent key. Remote systems use synthetic backups for complete copies. Layered recovery and synthetic backups improve disaster recovery efficiency.

[0041] 2. In this invention, when performing local backup and recovery, the one-way hash chain structure detects data tampering in real time. Any change in the hash value triggers the invalidation of subsequent keys, preventing the spread of attacks. The forward secrecy mechanism ensures that the leakage of historical session keys does not affect the security of current communications, improving the storage security of local data.

[0042] 3. In the present invention, if cloud backup and recovery is performed, when a specific version needs to be restored, the corresponding hash value can be directly verified and the independent key can be extracted without relying on other version data or keys. The cloud hash sequence is independent of the local chain structure. Even if a local version of data is tampered with, the hash value verification of other versions in the cloud remains independent, which increases the scope of relief for cloud recovery relative to local recovery.

[0043] 4. In this invention, the off-site synthetic backup key is independently stored on an off-site disk, completely decoupled from the local and cloud key systems. When local or cloud data is damaged, the corresponding synthetic backup version can be directly restored using the off-site key, providing additional data recovery options.

[0044] 5. In this invention, the key for each backup version is independently derived and decoupled from the data. The local incremental key is generated based on a chained hash, and the cloud differential key is generated based on an independent hash. Keys between versions are uncorrelated, and leaking a single version's key does not affect data in other versions, reducing the risk of key reuse. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A logical diagram of a data backup strategy in an encryption protection method for network data backup and recovery according to the present invention;

[0046] Figure 2 A logical diagram of a data recovery strategy in an encryption protection method for network data backup and recovery according to the present invention;

[0047] Figure 3 A simplified diagram of a backup storage location in an encryption protection method for network data backup and recovery according to the present invention;

[0048] Figure 4 This is a simplified diagram of different data recovery methods based on local backup and cloud backup in an encryption protection method for network data backup and recovery of the present invention. DETAILED DESCRIPTION

[0049] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the implementation regulations described are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0050] Example 1: Reference Figure 1-4 As shown, a method for network data backup and recovery encryption protection, the data backup method and its encryption protection method are: adopting a local, cloud, and remote three-end collaborative backup architecture, respectively implementing differentiated backup strategies;

[0051] The local data is backed up by a combination of full backup and incremental backup to generate a chain hash value sequence, where the regular full backup generates a benchmark hash value H 0-Full , after each data change, an incremental hash value sequence H is generated 1-Incr →H n-Incr , the hash value sequence forms a one-way chain structure, and any tampering of the hash value will cause the subsequent key to become invalid.

[0052] The cloud data is backed up by a combination of full backup and differential backup to generate an independent hash value sequence. The full backup is synchronized with the local storage to generate H 0-Full , differential backup generates an independent hash value sequence H 1-Diff →H n-Diff , differential backups only record all changed data since the most recent full backup.

[0053] The off-site data backup is performed by combining full backup and synthetic backup to generate an independent hash value sequence. Synthetic backup merges incremental or differential backup with full backup to generate an independent hash value sequence H 1-Syn →H n-Syn ,The synthetic backup is decrypted with an independent key and decoupled from the original backup chain.

[0054] The initial key is derived based on the full backup hash value, the dynamic chain key is derived based on the incremental backup hash value, and the dynamic independent key is derived based on the differential backup and synthetic backup hash values respectively. The derived keys correspond one-to-one to the corresponding versions.

[0055] Dynamic key derivation mechanisms include:

[0056] Combine the full backup hash value with the incremental backup chain hash value sequence, the differential backup independent hash value sequence, and the synthetic backup independent hash value sequence, input the key derivation function, set the high-intensity iteration number and salt value, and generate a dynamic key;

[0057] Derive the initial key K0 based on the full backup hash value;

[0058] The dynamic chain key K is derived based on the combination of the full backup hash value and the incremental backup chain hash value sequence. 1-Incr →K n-Incr ;

[0059] Derive the dynamic chain key K based on the full backup hash value and the differential backup chain hash value sequence 1-Diff →K n-Diff ;

[0060] The dynamic chain key K is derived based on the combination of the full backup hash value and the synthetic backup chain hash value sequence. 1-Syn →K n-Syn .

[0061] In this embodiment, network data is backed up in local storage, remote storage and cloud storage respectively.

[0062] Among them, local data backup consists of database backup to local disk, including regular full backup (such as full backup once a week or once a month) and incremental backup after a single data update. The storage of local data is encrypted using a key derivation function (such as PBKDF2, Scrypt or HKDF) from the hash value H 0-Full and H 1-Incr →H n-Incr The secure derived key has a chain effect because the hash value generated by the incremental backup has a one-way chain. The derived key is used to encrypt and protect local data when it is stored on the local disk.

[0063] Cloud data backup consists of database backup to cloud space, including regular full backup and differential backup after a single data update. Cloud data transmission encryption uses TLS1.3+AES-256-GCM communication technology, generating a unique key for each communication to ensure the uniqueness and security of each communication. Cloud data storage encryption uses a key derivation function to generate a unique key from the hash value H 0-Full and H 1-Diff →H n-Diff The secure derived key is generated independently based on the backup version due to the non-chain nature of the hash value generated by the differential backup. The derived key is used for encryption protection of cloud data when it is stored in the cloud space.

[0064] Offsite data backup consists of database backup to offsite disk, including regular full backup and synthetic backup after single data update. Offsite data transmission also uses TLS1.3+AES-256-GCM communication technology. Offsite data storage is encrypted, and a key derivation function is used to derive the hash value H from the hash value H. 0-Fulland H 1-Syn →H n-Syn The derived key is used for encryption protection of off-site data when it is stored on off-site disks. In the data backup stored on the three terminals, there is a full backup data and it is used for the initial key K0.

[0065] The dynamic key derivation mechanism is as follows:

[0066] 1) Input data structure definition

[0067]

[0068] 2) Key derivation function implementation

[0069]

[0070]

[0071] Where N is the memory cost parameter, r is the block size, p is the degree of parallelism, key_len is the key length, and salt is a 16-byte random salt value.

[0072] Example 2: Reference Figure 4 As shown, the data recovery method and its encryption protection method are: integrity verification of the baseline backup; local recovery for incremental backup chain decryption data recovery; cloud recovery for differential backup independent decryption data recovery; off-site recovery directly accesses the complete copy of the synthetic backup; anomaly detection triggers key update and hash chain self-healing.

[0073] In this embodiment, when data loss, damage or version rollback requirements are detected, the three-end collaborative recovery mechanism is activated. Recovery is attempted in the order of local → cloud → remote, with the full backup hash value H of the most recent timestamp being used first. 0-Full .

[0074] Local recovery: Decrypt the baseline backup using the initial key K0 and verify H 0-Full Integrity; verify H in order of incremental hash chain 1-Incr →H n-Inc , synchronously obtain the previously derived dynamic chain key from the cloud space, and enter the chain key K in sequence according to the data version to be restored 1-Incr →K n-Incr .

[0075] Cloud recovery: Use H 0-Full Derive the initial key K0 to decrypt the baseline backup, and directly verify the corresponding hash value H according to the data version to be restored n-Diff , extract the independent key K from the key separation storage location in the cloud space n-Diff .

[0076] Remote recovery: Use H 0-Full Derived initial key K0 decrypts the baseline backup, according to the synthetic hash sequence H 1-Syn →H n-Syn Verify the integrity of the synthetic backup data and extract the corresponding independent key K from the separate storage space of the off-site disk n-Syn Decrypt the corresponding version of the synthetic data.

[0077] Data synthesis is performed as follows: local recovery: the baseline backup is sequentially merged with the incremental data to generate the complete data; cloud recovery: the baseline backup is merged with the independent differential data to generate the complete data; remote recovery: the baseline backup and the synthesized data (with the incremental and differential data merged) are used directly. Data is restored using a TLS1.3+AES-256-GCM encrypted channel.

[0078] The restored data needs to have its hash value recalculated and compared with the original and backup chain hash values to ensure data integrity.

[0079] In response to tampering with a certain version of backup data, a corresponding key expiration mechanism is set up. By utilizing the chain key feature of the local incremental backup, if any incremental version data is changed, the corresponding hash value verification fails, thereby terminating the data recovery of subsequent versions and triggering an alarm to prevent the use of the tampered key to decrypt subsequent versions of the data backup. At this time, the local data recovery program is abandoned and the cloud data recovery program is entered.

[0080] By utilizing the independent key feature of cloud-based differential backups, even if the version data of any incremental backup is tampered with, the version data of other differential backups can still be read, and the verification of its hash value is also independent of the version data of other differential backups, improving the redundancy of cloud-based differential backup recovery capabilities.

[0081] Please refer to the attached Figure 4 If the data of the second information backup is lost, leaked, damaged, tampered with, etc., a new key K is generated in the local backup. 2-Incr ' and K 3-Incr ', the new key is stored in a remote disk. If the user needs to restore to the first information backup version, he can directly use K 1-Incr Restore network information. If the user needs to restore to a subsequent information backup version, transfer it from the cloud space to K 3-diff , extract the unleaked backup version from the cloud space, and perform communication transmission to transfer the network data to the local area.

[0082] If the version backup data is severely damaged and cannot be restored through the local disk or cloud, the baseline backup and synthetic data can be directly extracted and used. The off-site backup data is completely separated from the logical structure, key system and dependency relationship of the local backup and cloud backup. Anomaly detection triggers key update. The independent key for off-site data recovery is stored in the off-site disk, which is separated from the local backup and cloud backup keys. After obtaining the updated key from the off-site disk, the user can extract the subsequently protected backup version network information in the local backup in sequence.

[0083] Example 3: The encryption protection system framework for data backup and recovery is: client control module, cloud gateway module, off-site storage module, hardware acceleration module and security management module; the client control module integrates hash generation, key derivation and encryption engine; the cloud gateway module implements TLS encryption transmission and storage interface; the off-site storage module is equipped with a synthetic backup engine and a key isolation controller; the hardware acceleration module is used to optimize key derivation and encryption operations; the security management module is used to implement a key vault and record audit logs.

[0084] In this embodiment, a hash generation algorithm is integrated through the client control module to calculate the chain hash value sequence of data changes in real time, a key derivation function is used in combination with three-end hash data to generate a dynamic encryption key, and the encryption engine is called to implement full and incremental backup encryption of local data; the cloud gateway module establishes an end-to-end encryption channel based on the TLS protocol, encrypts and transmits the differential backup data to the cloud storage through the storage interface, and generates an independent hash sequence for integrity verification; the off-site storage module merges the incremental and differential data with the baseline backup into a decoupled independent hash chain through the synthetic backup engine, and uses the key isolation controller to realize the independent derivation and secure storage of off-site keys; the hardware acceleration module uses a dedicated circuit or coprocessor to optimize the high concurrent computing performance of the key derivation function and reduce latency; the security management module implements the full life cycle management of the key through the key vault, and combines the audit log system to record all key operations and data transmission behaviors to ensure system security and traceability.

[0085] The working principle of the present invention is to realize data encryption protection through a three-end collaborative backup architecture of local, cloud and remote. The core principles are as follows: a one-way chain hash sequence is generated locally by combining full backup and incremental backup, and chain keys are dynamically derived and encrypted based on hash values for storage; the local full backup is synchronized with the cloud and an independent differential hash sequence is generated, which is transmitted through TLS encryption and version-independent keys are derived; the incremental / differential backup and the full backup are merged into a synthetic backup remotely, a decoupled hash sequence is generated and independent keys are stored. During recovery, the hash integrity is verified according to the priority of local → cloud → remote. The local data is decrypted layer by layer through the chain key, the cloud directly calls the target version independent key, and the remote data uses a complete copy of the synthetic backup. The system optimizes the efficiency of key derivation through hardware acceleration, and combines key isolation storage, forward secrecy and hash chain self-healing mechanism to ensure security.

[0086] Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for encryption protection of network data backup and recovery, characterized in that: include: Adopt a local, cloud, and remote three-end collaborative backup architecture, and implement differentiated storage backup strategies respectively; Perform local data backup using a combination of full and incremental backups to generate a chained hash value sequence. Back up cloud data using a combination of full and differential backups to generate an independent hash value sequence. Perform off-site data backup using a combination of full backup and synthetic backup to generate an independent hash value sequence; The initial key is derived from the full backup hash value, the dynamic chain key is derived from the incremental backup hash value, and the dynamic independent key is derived from the differential backup and synthetic backup hash values respectively.

2. The encryption protection method for network data backup and recovery according to claim 1, characterized in that: Local storage backup strategies include: Regular full backup generates a baseline hash value H 0-Full ; Generate an incremental hash value sequence H each time the data is changed 1-Incr →H n-Incr ; The hash value sequence forms a one-way chain structure, and tampering with any hash value will cause the subsequent keys to become invalid.

3. The encryption protection method for network data backup and recovery according to claim 1, characterized in that: Cloud storage backup strategies include: Full backup is synchronized with local storage to generate H 0-Full ; Differential backup generates an independent hash value sequence H 1-Diff →H n-Diff ; A differential backup records only the data that has changed since the most recent full backup.

4. The encryption protection method for network data backup and recovery according to claim 1, characterized in that: Offsite storage backup strategies include: A synthetic backup combines an incremental or differential backup with a full backup to generate an independent hash value sequence H. 1-Syn →H n-Syn ; The synthetic backup is decrypted with an independent key and is decoupled from the original backup chain.

5. The encryption protection method for network data backup and recovery according to any one of claims 2 to 4, characterized in that: Dynamic key derivation mechanisms include: Combine the full backup hash value with the incremental backup chain hash value sequence, the differential backup independent hash value sequence, and the synthetic backup independent hash value sequence, input the key derivation function, set the high-intensity iteration number and salt value, and generate a dynamic key; Derive the initial key K0 based on the full backup hash value; The dynamic chain key K is derived based on the combination of the full backup hash value and the incremental backup chain hash value sequence. 1-Incr →K n-Incr ; Derive the dynamic chain key K based on the full backup hash value and the differential backup chain hash value sequence 1-Diff →K n-Diff ; The dynamic chain key K is derived based on the combination of the full backup hash value and the synthetic backup chain hash value sequence. 1-Syn →K n-Syn .

6. The encryption protection method for network data backup and recovery according to claim 5, characterized in that: The initial key K0 is stored separately from the full backup data on the local disk. The dynamic key is uploaded to the cloud after transmission encryption and stored separately from the differential backup data. After the local backup data or cloud backup data is tampered with, the secondary dynamic key is re-derived. The secondary dynamic key is stored separately from the synthetic backup data on the off-site disk after transmission encryption.

7. The encryption protection method for network data backup and recovery according to claim 1, characterized in that: During the data transmission process, the three-end backup architecture adopts a zero-trust network architecture for security protection, and performs strict identity authentication and authorization on each data transmission request.

8. The encryption protection method for network data backup and recovery according to claim 1, characterized in that: An encryption protection system is used, and the system architecture includes: client control module, cloud gateway module, remote storage module, hardware acceleration module and security management module; The client control module integrates hash generation, key derivation, and encryption engines; The cloud gateway module implements TLS encrypted transmission and storage interface; The offsite storage module is equipped with a synthetic backup engine and key isolation controller; The hardware acceleration module is used to optimize key derivation and encryption operations; The security management module is used to implement the key vault and record audit logs.

9. The encryption protection method for network data backup and recovery according to claim 1, characterized in that: An automatic cleanup mechanism for backup data is set up to automatically clean up expired full backup, incremental backup, differential backup and synthetic backup data according to the preset time period and storage capacity threshold, and clean up the associated hash values and keys accordingly.

10. The encryption protection method for network data backup and recovery according to claim 1, characterized in that: A temporary session key is used for each data transmission. Local, cloud, and remote keys are stored in independent physical security areas. When hash value tampering is detected, the key update is automatically triggered and the subsequent hash chain is rebuilt.

Images