Information security storage method

Abstract

The invention belongs to the field of information security, and particularly relates to an information security storage method, which comprises the following steps of: receiving uploaded original file data, and dynamically segmenting the original file data into a plurality of data fragments; adding a key to each data fragment in the encryption pool by using a random encryption algorithm to obtain an encrypted fragment; establishing a key group corresponding to each encryption fragment, and uploading a key field encrypted by the key group to a special key server; the file is dynamically segmented for fragmented storage, the file is stored in a multi-level encryption mode, when leakage occurs in any link, the other levels of encryption means can still prevent leakage of the file, and the reliability of file storage is ensured. An attacker permeates the system for a long time, fragments and keys are slowly collected, defense is expanded from a fragment dispersion space dimension to a key timeliness time dimension through dynamic rotation, fragment integrity and key timeliness need to be met at the same time during cracking, and file storage safety is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method for securely storing information. Background Art

[0002] Data is the most core asset. Storage systems, as data storage spaces, are the last line of defense for data protection. As storage systems evolve from local direct connections to networked and distributed systems, and are shared by numerous computers on the network, they become more vulnerable to attacks. Relatively static storage systems often become the primary target for attackers seeking to steal, tamper with, or destroy data. Storage security has become crucial, and secure storage primarily includes storage security technologies, data deduplication, data backup, and disaster recovery technologies.

[0003] Centralized encrypted storage is to encrypt the entire file using a single encryption algorithm and store it as a whole on a single server or cloud platform. Once an attacker cracks the master key or invades the storage node, they can obtain the complete file.

[0004] Distributed storage is a process in which files are divided into fragments of fixed size. The fragments are encrypted with the same algorithm and then stored in multiple nodes. If distributed storage uses a unified encryption algorithm, a single algorithm vulnerability will expose all fragments. Summary of the Invention

[0005] (1) Purpose of the invention

[0006] In order to solve the technical problems existing in the background technology, the present invention proposes an information security storage method with the characteristics of multi-level protection and dynamic rotation.

[0007] (2) Technical solution

[0008] To solve the above technical problems, the present invention provides a method for securely storing information, comprising the following steps:

[0009] S1. Receive the uploaded original file data and dynamically split the original file data into several data fragments;

[0010] S2. Using a random encryption algorithm in the encryption pool, add a key to each data fragment to obtain an encrypted fragment;

[0011] S3. Create a key group corresponding to each encrypted fragment, and upload the encrypted key field of the key group to a dedicated key server;

[0012] S4, randomly distribute the encrypted fragments to each storage location;

[0013] S5. Regularly update the key corresponding to the encrypted fragment, and then update the key field encrypted by the key group and store it in a dedicated key server.

[0014] Preferably, the uploaded original file data is received, the file format and size are identified, and a corresponding segmentation tool is adapted. The segmentation tool includes a text segmentation tool, a media segmentation tool, and a compressed package segmentation tool.

[0015] Preferably, when a number of data fragments are obtained after the original file is dynamically split, the original file F is randomly split into F1, F2, F3, F4...FN, where N≥2;

[0016] After the data fragments are marked, the marks are hidden in the data fragments, and all marks and mark sorting methods are stored in the mark library;

[0017] Identification includes: text identification, image identification, fingerprint identification and account identification.

[0018] The encryption pool includes an algorithm library, a random selector, a key generator, an encryption engine, and a hardware security module;

[0019] A random selector is set in the algorithm library to randomly select an encryption algorithm, and the selected encryption algorithm is called by the encryption engine;

[0020] The hardware security module distributes data fragments to the encryption engine in an isolated environment and generates encrypted fragments through the selected encryption algorithm and key generator;

[0021] The encryption algorithms in the algorithm library include: symmetric encryption algorithm, asymmetric encryption algorithm, national secret algorithm and post-quantum algorithm.

[0022] Preferably, each encrypted fragment generated after encryption of each data fragment has a corresponding key, and the keys of the encrypted fragments are unrelated. Each encrypted fragment corresponds to an independent key when it is generated, and each key uses a different encryption algorithm.

[0023] Preferably, each encrypted fragment corresponds to an independent key when it is generated. These keys are unrelated to each other, ensuring that the leakage of a single key does not affect global security. The keys of all encrypted fragments are integrated into a logical set called a key group, which includes the key value and metadata of the encryption algorithm type.

[0024] Preferably, the step of encrypting the key group includes: the key group includes the keys of each encryption fragment, and the key group is encrypted as a whole using a master key of a higher security level to generate corresponding key fields;

[0025] Set up a key server that specifically stores the key field. Set up a dedicated protocol channel for transmitting the key field to the key server, and upload the encrypted key field to the key server to prevent man-in-the-middle attacks.

[0026] The key server has the minimum permissions, which only authorizes specific administrators to access the key fields.

[0027] Preferably, the encrypted fragments are randomly distributed to each storage location to build a decentralized storage scheduling system;

[0028] The system includes: storage pool, sharding module, location index library and monitoring module;

[0029] Storage pool, including cloud storage, storage devices, private servers and other storage resources used for storage;

[0030] The sharding module dynamically selects storage resources and distributes encrypted fragments to each storage resource. The storage nodes of the selected storage resources are recorded in the sharding module.

[0031] The location index library records the storage location of encrypted fragments and is set separately from the key server;

[0032] The monitoring module monitors in real time whether the corresponding encrypted fragment is called in the storage resource, saves the call record when it is called and when it is called incorrectly, and issues an alarm when the incorrect call is frequent.

[0033] Preferably, in S5, a rotation period is set, including a preset fixed period triggered by a timer;

[0034] Set up event-triggered rotation, including security threat warnings for abnormal access to storage nodes or manual emergency rotation by the administrator;

[0035] When updating the key of a single encrypted fragment F1', the location index library decrypts and obtains the F1' storage node, retrieves F1' from the storage node through the encrypted channel, and uses the original key K1 to decrypt the plaintext fragment F1 in the hardware security module. The key generator creates a new key, randomly selects a new algorithm, and encrypts F1 with the new key to generate a new encrypted fragment. The new encrypted fragment is distributed to the original storage node.

[0036] Preferably, the key field encrypted by the key group is updated, the old key K1 is deleted from the key group, a new key is added to form a new key group, the new key group is re-encrypted with the master key, a new key field is generated, and the new key field is uploaded through a secure channel to overwrite the old version.

[0037] The above technical solution of the present invention has the following beneficial technical effects:

[0038] 1. Dynamically divide files for fragmented storage and store them through multi-level encryption. When a leak occurs at any link, the remaining encryption methods at all levels can still prevent the file from being leaked, thus ensuring the reliability of file storage.

[0039] 2. Attackers infiltrate the system over a long period of time, slowly collecting fragments and keys. Through dynamic rotation, the defense is extended from the spatial dimension of fragment dispersion to the temporal dimension of key timeliness. Cracking requires satisfying both fragment integrity and key timeliness, thereby improving the security of file storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 Schematic diagram of the information security storage method of the present invention. DETAILED DESCRIPTION

[0041] To make the objectives, technical solutions, and advantages of the present invention more clearly understood, the present invention will be further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present invention.

[0042] like Figure 1 As shown, the present invention proposes a method for secure information storage, comprising the following steps:

[0043] S1. Receive the uploaded original file data and dynamically split the original file data into several data fragments;

[0044] S2. Using a random encryption algorithm in the encryption pool, add a key to each data fragment to obtain an encrypted fragment;

[0045] S3. Create a key group corresponding to each encrypted fragment, and upload the encrypted key field of the key group to a dedicated key server;

[0046] S4, randomly distribute the encrypted fragments to each storage location;

[0047] S5. Regularly update the key corresponding to the encrypted fragment, and then update the key field encrypted by the key group and store it in a dedicated key server.

[0048] In S1, the uploaded original file data is received, the file format and size are identified, and the corresponding segmentation tools are adapted. The segmentation tools include text segmentation tools, media segmentation tools, and compressed package segmentation tools;

[0049] Take the text segmentation tool as an example: the same character strings in the previous and next texts are used as segmentation nodes to prevent truncation of multi-byte encodings, and the text is divided into several identical data fragments according to the number of characters;

[0050] When the segmented data fragments are combined, the two adjacent data fragments can be located by the same character strings associated at the beginning and end. Any segment of the same character strings of the two data fragments is retained, and the adjacent data fragments are quickly associated and restored. The same character strings are associated and located for all data fragments to restore the original text.

[0051] Instead, the original file data is dynamically divided into several data fragments. Different from the text segmentation by segmentation nodes, the original file is randomly segmented. The data fragments obtained after segmentation have different sizes. A unified data fragment size threshold is set. The data fragments that do not meet the size are filled with meaningless temporary bytes until they are close to the threshold. The processed data fragments are identified and labeled.

[0052] It can be understood that when the original file is dynamically split to obtain several data fragments, the original file F is randomly divided into (F1, F2, F3, F4...FN, N≥2). In order to perform subsequent reorganization and recovery of the data fragments, each data fragment is marked to facilitate the indication of the data fragment's corresponding position in the original file. The mark is hidden in the data fragment, and all marks and mark sorting methods are stored in the mark library.

[0053] Identification includes: text identification, image identification, fingerprint identification and account identification.

[0054] S2. Using a random encryption algorithm in the encryption pool, add a key to each data fragment to obtain an encrypted fragment;

[0055] The encryption pool includes an algorithm library, a random selector, a key generator, an encryption engine, and a hardware security module;

[0056] A random selector is set in the algorithm library to randomly select an encryption algorithm, and the selected encryption algorithm is called by the encryption engine;

[0057] The hardware security module distributes data fragments to the encryption engine in an isolated environment and generates encrypted fragments through the selected encryption algorithm and key generator;

[0058] The encryption algorithms in the algorithm library include: symmetric encryption algorithm, asymmetric encryption algorithm, national secret algorithm and post-quantum algorithm;

[0059] It can be understood that each encrypted fragment generated after the encryption of each data fragment has a corresponding key. The keys of each encrypted fragment are unrelated. Each encrypted fragment (such as F1, F2, F3, F4...FN) corresponds to an independent key (K1, K2, K3, K4...KN) when it is generated, and each key uses a different encryption algorithm.

[0060] The hardware security storage module is an isolated terminal in a memory isolation state, which inputs data fragments and outputs encrypted fragments. When any data fragment completes the conversion to an encrypted fragment, the initial data fragment is directly destroyed and only the encrypted fragment is retained.

[0061] S3. Create a key group corresponding to each encrypted fragment, and upload the encrypted key field of the key group to a dedicated key server;

[0062] Among them, each encrypted fragment corresponds to an independent key when it is generated. These keys are unrelated to each other, ensuring that the leakage of a single key does not affect global security. The keys of all encrypted fragments are integrated into a logical set called a key group, which includes the key value and metadata of the encryption algorithm type.

[0063] The encryption steps for the key group include: because the key group contains the keys of each encryption fragment, there is a risk of data leakage when it is leaked, so the key group is encrypted as a whole using a master key of a higher security level to generate the corresponding key field. The purpose is to require a higher security level verification before calling the key group, and to add a security verification step to protect the key group.

[0064] A key server is set up to store key fields. A dedicated protocol channel is set up to transmit the key fields to the key server. The encrypted key fields are uploaded to the key server to prevent man-in-the-middle attacks. The key server has the minimum permissions and only authorizes specific administrators to access the key fields.

[0065] In an optional embodiment, the key server is monitored and all key access and update logs are recorded. When abnormal behavior occurs, such as high-frequency access and incorrect verification, an alarm mechanism is triggered to provide a security reminder.

[0066] S4. Randomly distribute the encrypted fragments to various storage locations to build a decentralized storage scheduling system;

[0067] The system includes: storage pool, sharding module, location index library and monitoring module;

[0068] Storage pool, including cloud storage, storage devices, private servers and other storage resources used for storage;

[0069] The sharding module dynamically selects storage resources and distributes encrypted fragments to each storage resource. The storage nodes of the selected storage resources are recorded in the sharding module.

[0070] The location index library records the storage location of encrypted fragments and is set separately from the key server;

[0071] The monitoring module monitors in real time whether the corresponding encrypted fragment is called in the storage resource, saves the call record when it is called and when it is called incorrectly, and issues an alarm when the incorrect call is frequent.

[0072] As an example of the distribution of encrypted fragments:

[0073] All storage resource storage nodes must be registered in the storage pool through two-way TLS certificate authentication, and the storage node attributes must be tagged, including geographic location, storage type, and security level, to complete the storage node registration and authentication.

[0074] The sharding module customizes absolute random and weighted random sharding strategies, distributes encrypted fragments to corresponding storage nodes of different storage resources, and completes dynamic distribution of storage nodes;

[0075] Generate a location index in the location index library. The location record includes the shard ID and location key. The location information is encrypted and stored. The storage location key is kept separately by the sharding module and is not shared with the key server.

[0076] The encrypted fragments are transmitted to the storage node of the target storage resource through an encrypted channel. After receiving the encrypted fragments, the storage node returns a storage credential with a timestamp, enters the storage credential into the sharding module, and monitors each encrypted fragment using the isomorphic monitoring module. The monitoring content includes the current encrypted content and other encrypted content.

[0077] In this embodiment, the file is dynamically divided for fragmented storage, and the cut data fragments are encrypted using a random algorithm. Each encrypted fragment has an independent and unrelated key and performs primary encryption.

[0078] Integrate the independent keys into a key group, encrypt the generated key field with the master key, and upload the key field to the dedicated key server through a secure channel for secondary encryption;

[0079] Decentralized distributed storage randomly distributes encrypted fragments to certified storage nodes, and the location index library independently stores the encrypted fragment locations for three-level encryption;

[0080] Files are stored through multi-level encryption. When a leak occurs at any link, the encryption methods at other levels can still prevent the file from being leaked, ensuring the reliability of file storage.

[0081] As an example, when a certain encrypted fragment is stolen, the attacker obtains the encrypted fragment of a storage node such as F1'

[0082] This fragment is encrypted with an independent key K1, and K1 is not associated with other fragment keys. An attacker cannot use F1' to crack other fragments such as F2' and F3';

[0083] Each fragment has a different encryption algorithm. Even if F1' is cracked, the encryption method of other fragments cannot be deduced.

[0084] A single fragment does not contain complete information, such as text fragments lacking context and media fragments missing key frames;

[0085] The attacker obtains several fragments that cannot be decrypted and cannot restore the original file.

[0086] For example, if the key server is compromised and the key field is stolen, the attacker steals the key field in the key server, which is the key group encrypted by the master key. The key field itself is encrypted by the master key, and the master key must be cracked before the key group can be obtained. The master key is stored in the hardware security module, which is physically isolated and cannot be exported.

[0087] The key field only contains the key group and does not contain the fragment location information. The location index library is stored independently;

[0088] Even if the attacker obtains the decryption key group K1, K2…K n , and it is also impossible to locate the storage location of encrypted fragments;

[0089] Abnormal access to the key server will trigger an alarm, such as high-frequency requests, and the administrator can immediately revoke the master key;

[0090] The attacker obtains the encrypted key field, but lacks the master key and shard location and cannot actually use it.

[0091] As an example, the location index database is leaked, the fragment location information is stolen, and the attacker obtains the location index database data and knows that F1' is at node A and F2' is at node B;

[0092] The location information itself is stored encrypted with a location key, which requires additional cracking of the key;

[0093] The location key is kept separately by the sharding module and is physically isolated from the key server;

[0094] Even if located at the storage node, the encrypted fragments are still protected by the primary key, for example, F1' needs K1 to decrypt;

[0095] The attacker cannot obtain K1 because K1 is stored on the key server and is encrypted twice with the master key;

[0096] The attacker knows the fragment location but cannot decrypt the fragment content.

[0097] S5. Regularly update the key corresponding to the encrypted fragment, and then update the key field encrypted by the key group and store it in a dedicated key server.

[0098] Set rotation cycles, including preset fixed cycles triggered by timers, such as seven days;

[0099] Set up event-triggered rotation, including security threat warnings for abnormal access to storage nodes or manual emergency rotation by the administrator;

[0100] As an example of rotation in either scenario:

[0101] When updating the fragment key, taking a single encrypted fragment F1' as an example, the location index library decrypts and obtains the F1' storage node, retrieves F1' from the storage node through the encrypted channel, and uses the original key K1 to decrypt the plaintext fragment F1 in the hardware security module. The key generator creates a new key, randomly selects a new algorithm, and encrypts F1 with the new key to generate a new encrypted fragment. The new encrypted fragment is distributed to the original storage node.

[0102] It is understandable that when all fragment keys are updated, the same rotation operation process is used. Attackers use APT attacks to infiltrate the system for a long time and slowly collect fragments and keys. The defense effect of S5 is that the preset 7-day rotation cycle is less than the attacker's collection speed. Assuming that it takes 30 days to collect the old keys and rotate them to new keys, the stolen old keys will become invalid immediately, extending the defense from the spatial dimension of fragment dispersion to the time dimension of key timeliness. Cracking must meet both fragment integrity and key timeliness, thereby improving the security of file storage.

[0103] It should be added that as an example of updating the key field of key group encryption, the old key K1 is deleted from the key group, a new key is added to form a new key group, the new key group is re-encrypted with the master key, a new key field is generated, and the new key field is uploaded through a secure channel to overwrite the old version.

[0104] In one embodiment, a batch rotation is set to divide N groups of encrypted fragments into several groups, and one group is rotated every day to avoid centralized operations causing system overload.

[0105] When faced with a master key leak, attackers steal the master key, key fields, and location information. Through dynamic key rotation, the system regularly updates the fragment keys, and the old keys become invalid immediately. The attackers cannot collect keys and locations fast enough to keep up with the rotation frequency. Encrypted fragments are distributed across multiple nodes across regions and clouds. Stealing data from all nodes at the same time requires breaking through multiple heterogeneous defenses, which has an extremely low probability. Concentrated access to a large number of fragments will trigger an alarm in the monitoring module, and the system can initiate fragment migration. The attack cost is extremely high, and the rotation mechanism makes the stolen data quickly invalid.

[0106] It should be understood that the above-described specific embodiments of the present invention are merely illustrative or illustrative of the principles of the present invention and do not constitute limitations of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc. made without departing from the spirit and scope of the present invention should be included within the scope of protection of the present invention. In addition, the appended claims are intended to cover all variations and modifications that fall within the scope and metes and bounds of the appended claims, or equivalents thereof.

Claims

1. A method for secure information storage, characterized in that: The following steps are involved: S1. Receive the uploaded original file data and dynamically split the original file data into several data fragments; S2. Using a random encryption algorithm in the encryption pool, add a key to each data fragment to obtain an encrypted fragment; S3. Create a key group corresponding to each encrypted fragment, and upload the encrypted key field of the key group to a dedicated key server; S4, randomly distribute the encrypted fragments to each storage location; S5. Regularly update the key corresponding to the encrypted fragment, and then update the key field encrypted by the key group and store it in a dedicated key server.

2. The information security storage method according to claim 1, characterized in that: Receive the uploaded original file data, identify the file format and size, and adapt the corresponding segmentation tools, including text segmentation tools, media segmentation tools, and compressed package segmentation tools.

3. The information security storage method according to claim 1, characterized in that: When the original file is dynamically split to obtain several data fragments, the original file F is randomly split into F1, F2, F3, F4...FN, N ≥ 2; After the data fragments are marked, the marks are hidden in the data fragments, and all marks and mark sorting methods are stored in the mark library; Identification includes: text identification, image identification, fingerprint identification and account identification.

4. The information security storage method according to claim 1, characterized in that: The encryption pool includes an algorithm library, a random selector, a key generator, an encryption engine, and a hardware security module; A random selector is set in the algorithm library to randomly select an encryption algorithm, and the selected encryption algorithm is called by the encryption engine; The hardware security module distributes data fragments to the encryption engine in an isolated environment and generates encrypted fragments through the selected encryption algorithm and key generator; The encryption algorithms in the algorithm library include: symmetric encryption algorithm, asymmetric encryption algorithm, national secret algorithm and post-quantum algorithm.

5. The information security storage method according to claim 1, characterized in that: Each encrypted fragment generated after the encryption of each data fragment has a corresponding key. The keys of each encrypted fragment are unrelated. Each encrypted fragment corresponds to an independent key when it is generated, and each key uses a different encryption algorithm.

6. The information security storage method according to claim 1, characterized in that: Each encrypted fragment is generated with an independent key. These keys are unrelated to each other, ensuring that the leakage of a single key does not affect global security. The keys of all encrypted fragments are integrated into a logical set called a key group, which includes the key value and metadata of the encryption algorithm type.

7. The information security storage method according to claim 1, characterized in that: The steps of encrypting the key group include: the key group includes the keys of each encryption fragment, and the key group is encrypted as a whole using a master key of a higher security level to generate corresponding key fields; Set up a key server that specifically stores the key field. Set up a dedicated protocol channel for transmitting the key field to the key server, and upload the encrypted key field to the key server to prevent man-in-the-middle attacks. The key server has the minimum permissions, which only authorizes specific administrators to access the key fields.

8. The information security storage method according to claim 1, characterized in that: Encrypted fragments are randomly distributed to various storage locations to build a decentralized storage scheduling system; The system includes: storage pool, sharding module, location index library and monitoring module; Storage pool, including cloud storage, storage devices, private servers and other storage resources used for storage; The sharding module dynamically selects storage resources and distributes encrypted fragments to each storage resource. The storage nodes of the selected storage resources are recorded in the sharding module. The location index library records the storage location of encrypted fragments and is set separately from the key server; The monitoring module monitors in real time whether the corresponding encrypted fragment is called in the storage resource, saves the call record when it is called and when it is called incorrectly, and issues an alarm when the incorrect call is frequent.

9. The information security storage method according to claim 1, characterized in that: In S5, a rotation cycle is set, including a preset fixed cycle triggered by a timer; Set up event-triggered rotation, including security threat warnings for abnormal access to storage nodes or manual emergency rotation by the administrator; When updating the key of a single encrypted fragment F1', the location index library decrypts and obtains the F1' storage node, retrieves F1' from the storage node through the encrypted channel, and uses the original key K1 to decrypt the plaintext fragment F1 in the hardware security module. The key generator creates a new key, randomly selects a new algorithm, and encrypts F1 with the new key to generate a new encrypted fragment. The new encrypted fragment is distributed to the original storage node.

10. The information security storage method according to claim 1, characterized in that: The key field encrypted by the key group is updated. The old key K1 is deleted from the key group, and a new key is added to form a new key group. The new key group is re-encrypted with the master key to generate a new key field. The new key field is uploaded through the secure channel, overwriting the old version.

Images