ICloud data decryption and extraction system and method

Abstract

The invention discloses an iCloud data decryption and extraction system and method, and relates to the technical field of data security. Compliance authorization verification and decryption end environment initialization are carried out on a user; acquiring a root key of the user based on the temporary access token and an iCloud account compliance authorization certificate of the user, and performing session key derivation based on the root key of the user and the iCloud data storage structure information to acquire temporary session keys of various types of data; performing parallel multi-thread scheduling on the to-be-extracted data; performing decryption algorithm matching on the various types of data downloaded to the decryption end, and executing data decryption operation based on the temporary session key; data downloading integrity verification and data decryption integrity verification are carried out, when the data downloading integrity verification and the data decryption integrity verification are passed, data recombination operation and recombination integrity verification are carried out, and data output and safe destruction are carried out on the completely extracted type data. And the data extraction efficiency and the data decryption compatibility and integrity are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of data security technology, specifically to an iCloud data decryption and extraction system and method. Background Technology

[0002] With the rapid development of mobile internet and cloud computing technologies, Apple's iCloud service, as one of the mainstream cloud storage services, has become an important carrier for hundreds of millions of users worldwide to store personal and corporate data. iCloud service employs a multi-layered encryption system to ensure data security. Its encryption mechanism mainly includes: the transport layer uses the TLS (Transport Layer Security) protocol for encryption to ensure the security of data during transmission between the user's terminal and the iCloud server; the storage layer uses the AES (Advanced Encryption Standard)-256 encryption algorithm to encrypt and store data, and the encryption key is derived by Apple based on the user's Apple ID information, device hardware identifiers (such as UDID, ECID), and a random key generated by the Secure Enclave chip, forming a complex key chain system.

[0003] However, in legitimate scenarios such as judicial evidence collection and data recovery, the need for decrypting and extracting iCloud data is becoming increasingly urgent, but existing technologies have many shortcomings: Key acquisition is difficult: Existing methods mostly rely on users actively providing their Apple ID account password or two-factor authentication code. If users forget their account information or the device is locked (such as when Activation Lock is enabled), the core key required for decryption cannot be obtained, causing data extraction to stall. Furthermore, Apple's management of iCloud keys adopts a hybrid mode of "end-to-end" encryption of some data (such as Notes and Photo Stream) and "server-side encryption" of some data (such as Contacts and Calendars). The key derivation logic of different encryption modes is very different, and existing methods are difficult to be compatible with key acquisition for both modes.

[0004] Poor data decryption compatibility: iCloud has a variety of data types, and different data types (such as HEIC format for photos, MOV format for videos, and encrypted document format for notes) use different encryption sub-algorithms and data fragmentation storage strategies (such as photo data being divided into metadata blocks, image data blocks, and thumbnail data blocks for separate encryption storage). Existing methods are mostly designed for decryption logic for a single data type and cannot adapt to the decryption needs of multiple data types, resulting in incomplete extracted data or data that cannot be parsed normally.

[0005] Low data extraction efficiency: Existing methods for acquiring iCloud encrypted data mostly adopt a serial processing approach of downloading and decrypting file by file. They are not optimized for the distributed storage architecture of iCloud data (iCloud data is distributed and stored in multiple data centers around the world by Apple, and different data blocks have different storage nodes), resulting in high data download latency. At the same time, no hardware acceleration technology is introduced in the decryption process. When dealing with large amounts of data (such as tens of gigabytes of photo and video data), the decryption time is too long, which cannot meet the needs of efficient data extraction.

[0006] Data integrity and security cannot be guaranteed: Existing methods lack a mechanism to verify the integrity of data transmission during the decryption and extraction process, making the extracted data susceptible to corruption due to network interruptions and data packet loss. Furthermore, some methods use "cracking" techniques that bypass Apple's official security verification mechanism to reduce the difficulty of decryption, which may trigger security risks such as iCloud account lockout and remote data erasure. At the same time, they violate Apple's service agreement and raise legal compliance issues.

[0007] Therefore, there is an urgent need for a method that can overcome existing technological bottlenecks and achieve legal, compatible, efficient, and secure decryption and extraction of iCloud data. Summary of the Invention

[0008] To address the aforementioned technical problems, the present invention aims to provide a method for decrypting and extracting iCloud data, comprising the following steps: Step 1: Perform compliance authorization verification for the user and initialize the decryption terminal environment to obtain temporary access tokens and iCloud data storage structure information; Step 2: Obtain the user's root key based on the temporary access token and the user's iCloud account compliance authorization credentials. Based on the user's root key and iCloud data storage structure information, deduce the session key and obtain temporary session keys for various types of data. Step 3: Perform parallel multi-threaded scheduling on the data to be extracted, set the number of parallel download threads corresponding to the storage nodes of each type of data, and then execute the data download operation; Step 4: Match the decryption algorithms for each type of data downloaded to the decryption terminal, and perform data decryption based on the temporary session key; Step 5: Perform data download integrity verification and data decryption integrity verification. When the data download integrity verification and data decryption integrity verification pass, perform data reconstruction operation and reconstruction integrity verification, and output and securely destroy the extracted complete type data.

[0009] Furthermore, the process of conducting compliance authorization verification includes: Obtain the iCloud account compliance authorization credentials provided by the user, verify the account through the iCloud verification server based on the iCloud account compliance authorization credentials, and obtain a temporary access token issued by the iCloud verification server.

[0010] Furthermore, the process of initializing the decryption environment includes: The system obtains the user's iCloud data storage structure information based on the temporary access token. The iCloud data storage structure information includes a list of data types, data fragment information, and metadata information (including the time the photo was taken, its geographical location, device information, the creation time of notes, encryption identifiers, etc.). A local decryption and extraction environment is constructed, which includes a decryption algorithm library containing decryption algorithms corresponding to different iCloud data encryption protocols. A communication link is constructed between the local decryption and extraction environment and the storage nodes of each type of data based on the data type list. A temporary isolation layer is constructed in the local decryption and extraction environment to store the complete file. After the data output is completed, the complete file in the temporary isolation layer is destroyed.

[0011] Furthermore, the process of obtaining the user's root key based on the temporary access token and the user's iCloud account compliance authorization credentials includes: The root key of the iCloud data encryption protocol is obtained based on metadata information. Multi-dimensional key factors related to iCloud encryption are extracted from the iCloud account compliance authorization certificate. Based on the iCloud data encryption protocol, the multi-dimensional key factors are fused with the temporary access token to generate a key seed, and the key seed is encrypted to generate the root key. Furthermore, the process of deriving session keys based on the user's root key and iCloud data storage structure information to obtain temporary session keys for various types of data includes: The system obtains the iCloud data encryption protocol for each type of data based on metadata information. It also obtains the decryption public key and decryption private key for each type of data based on the iCloud data encryption protocol and the root key. The system binds the decryption public key and the root key for each type of data and sends them to the iCloud verification server. The iCloud verification server verifies the root key. After successful verification, the system generates a server-side intermediate shared value for each type of data based on the iCloud verification server, the decryption public key, and the preset server-side private key. The system also generates a temporary session key for each type of data based on the iCloud verification server, the iCloud data encryption protocol, and the server-side intermediate shared value for each type of data. The iCloud verification server then encrypts the data fragments of each type of data that need to be transmitted to the decryption end based on the temporary session key. The decryption terminal generates an intermediate shared value for each type of data based on its private key and a preset server public key. It then performs a consistency match between the intermediate shared value and the corresponding server intermediate shared value. If they match, a temporary session key for the data type is generated using the decryption terminal, the iCloud data encryption protocol, and the intermediate shared value.

[0012] Furthermore, the process of parallel multi-threaded scheduling of the data to be extracted, and setting the number of parallel download threads corresponding to the storage nodes of each type of data, includes: Probe packets are sent to all storage nodes through the communication link to obtain the response latency and packet loss rate of each storage node. The user specifies the priority of each type of data, and the download size of each type of data fragment is obtained according to the data fragment information. The priority of each type of data, the download size of the data fragment, and the response latency and packet loss rate of the storage node to which each type of data belongs are used as evaluation indicators. The indicator weights of the evaluation indicators are set, and the membership matrix of each storage node to the preset load level is obtained through fuzzy comprehensive evaluation. The load level of each storage node is obtained based on the membership matrix and indicator weights. The number of parallel download threads corresponding to different load levels is preset. The number of parallel download threads corresponding to each storage node is set in the local decryption and extraction environment according to the load level of each storage node.

[0013] Furthermore, the process of matching decryption algorithms for various types of data downloaded to the decryption terminal and performing data decryption operations based on the temporary session key includes: When the data fragments of type data are downloaded to the temporary isolation layer, the metadata information of the data fragments is read, the corresponding iCloud data encryption protocol is obtained, the iCloud data encryption protocol is input into the decryption algorithm library for automatic matching, the corresponding decryption algorithm is obtained, the data fragments of type data and the temporary session key are input into the corresponding decryption algorithm, the data decryption operation is performed, and decrypted data fragments are generated.

[0014] Furthermore, data download integrity verification and data decryption integrity verification are performed. If both verifications pass, the data reassembly operation and reassembly integrity verification process includes: Whenever a data fragment of a type of data is downloaded to the temporary isolation layer, the hash value of the data fragment is obtained, and the fragment hash value of the data fragment is extracted from the metadata information in the iCloud data storage structure information returned by the iCloud verification server. The hash value of the data fragment is compared with the fragment hash value extracted from the metadata information. If they are inconsistent, the data fragment of that type of data is downloaded again. Whenever a decrypted data fragment of type data is generated, the authentication tag corresponding to the decrypted data fragment is obtained, and the decrypted data fragment is verified by the authentication tag. If the verification fails, the session key is determined to be abnormal, and the temporary session key of type data is obtained again to decrypt the data fragment until the verification is successful. Based on the data fragmentation information, all decrypted data fragments of the type data that have been decrypted are reassembled to obtain the complete file of the type data. The hash value of the complete file is obtained, and the total hash value of the type data file is extracted from the metadata information in the iCloud data storage structure information returned by the iCloud verification server. The hash value of the complete file is compared with the total hash value of the file. If they match, the type data is determined to be completely extracted. If they do not match, the process jumps to step 3, and the cumulative number of integrity verifications is counted. A maximum number of verifications is preset. When the cumulative number of integrity verifications exceeds the maximum number of verifications, the data extraction is determined to be incomplete.

[0015] Furthermore, the process of extracting complete type data and outputting and securely destroying it includes: When the type data is completely extracted, the complete file of type data stored in the temporary isolation layer is output according to the output format obtained by the user. After the complete file of type data is output, the complete file of type data stored in the temporary isolation layer is destroyed.

[0016] An iCloud data decryption and extraction system includes a cloud platform, and the cloud communication connection includes a preprocessing module, a key derivation module, a download scheduling module, a decryption module, and a data verification and output module; The preprocessing module is used to perform compliance authorization verification for users and initialize the decryption terminal environment, and obtain temporary access tokens and iCloud data storage structure information; The key derivation module is used to obtain the user's root key based on the temporary access token and the user's iCloud account compliance authorization credentials, and to derive the session key based on the user's root key and iCloud data storage structure information to obtain temporary session keys for various types of data. The download scheduling module is used to perform parallel multi-threaded scheduling of the data to be extracted, setting the number of parallel download threads corresponding to the storage nodes to which each type of data belongs, and then executing the data download operation. The decryption module is used to match decryption algorithms for various types of data downloaded to the decryption terminal and perform data decryption operations based on the temporary session key; The data verification and output module is used to perform data download integrity verification and data decryption integrity verification. When the data download integrity verification and data decryption integrity verification pass, the data reconstruction operation and reconstruction integrity verification are performed. The extracted complete data is then output and securely destroyed.

[0017] Compared with the prior art, the beneficial effects of the present invention are: 1. Strong legality and compatibility of key acquisition: Through multi-factor authorization adaptation, it supports three legal authorization methods: user self-authorization, associated device-assisted authorization, and compliant authorization, breaking through the limitation of existing methods that rely on a single account password.

[0018] 2. High data decryption compatibility and integrity: It integrates multiple encryption algorithms and automatically matches data types with algorithms to achieve adaptive decryption of various data types such as photos, videos, contacts, memos, and application backup data.

[0019] 3. Significantly improved data extraction efficiency: Parallel multi-threaded scheduling is implemented for the data to be extracted, and the number of parallel download threads corresponding to the storage nodes of each type of data is set, which significantly improves data download efficiency.

[0020] 4. Data security and compliance are guaranteed: The entire process adopts a secure isolation environment, encrypted storage, and integrity verification mechanism to prevent data leakage and tampering; all operations are based on compliant authorization, avoiding account locking and legal risks caused by "cracking" methods. Attached Figure Description

[0021] Figure 1 This is a schematic diagram illustrating a method for decrypting and extracting iCloud data according to an embodiment of this application. Figure 2 This is a schematic diagram of an iCloud data decryption and extraction system according to an embodiment of this application. Detailed Implementation

[0022] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] like Figure 1 As shown, a method for decrypting and extracting iCloud data includes the following steps: Step 1: Perform compliance authorization verification for the user and initialize the decryption terminal environment to obtain temporary access tokens and iCloud data storage structure information; Step 2: Obtain the user's root key based on the temporary access token and the user's iCloud account compliance authorization credentials. Based on the user's root key and iCloud data storage structure information, deduce the session key and obtain temporary session keys for various types of data. Step 3: Perform parallel multi-threaded scheduling on the data to be extracted, set the number of parallel download threads corresponding to the storage nodes of each type of data, and then execute the data download operation; Step 4: Match the decryption algorithms for each type of data downloaded to the decryption terminal, and perform data decryption based on the temporary session key; Step 5: Perform data download integrity verification and data decryption integrity verification. When the data download integrity verification and data decryption integrity verification pass, perform data reconstruction operation and reconstruction integrity verification, and output and securely destroy the extracted complete type data.

[0024] It should be further explained that, in the specific implementation process, the compliance authorization verification process includes: Obtain iCloud account compliance authorization credentials provided by the user (including iCloud account ownership certificate, data extraction authorization letter, two-factor authentication verification code, authorized device, etc.), verify the account through the iCloud verification server based on the iCloud account compliance authorization credentials, and obtain a temporary access token issued by the iCloud verification server.

[0025] The specific process of verifying an account through the iCloud verification server based on iCloud account compliance authorization credentials includes: If the user can provide a two-factor authentication code, step 1 will directly complete the account authentication through the iCloud verification server and obtain a temporary access token issued by the iCloud verification server. The token is valid for 30 minutes and only "data read" permissions are authorized, while "data modification / deletion" operations are prohibited. If the user cannot provide a two-factor authentication verification code, but can provide a linked device (such as an iPhone or iPad that has been logged into the target iCloud account), step 1 establishes a local communication link with the linked device through the device's hardware interface (such as a Lightning interface or a USB-C interface) (using an encrypted serial port protocol, and the communication data is encrypted using a temporary session key generated by the device's SecureEnclave chip), reads the iCloud trust credentials stored in the device (including device certificate and session key cache), and sends the trust credentials to the iCloud verification server to complete the identity verification and obtain a temporary access token; If the target iCloud account has an activation lock and the associated device cannot be obtained, step 1 is to apply for "restricted access" from the iCloud verification server through proof of iCloud account ownership or data extraction authorization to obtain a temporary access token for the account.

[0026] It should be further explained that the temporary access token obtained through step 1 can only achieve "surface data access" and has a bottleneck: iCloud sensitive data (such as device backups and advanced data protection content) adopts a two-layer mechanism of "device-generated key + server-side encryption". The temporary access token can only verify the account identity and cannot obtain the device's authentication key (AuthenticationKey) and data encryption key (DEK), resulting in more than 70% of encrypted data (such as deleted photos and application cache) being unable to be decrypted.

[0027] It should be further explained that, in the specific implementation process, the initialization process of the decryption end environment includes: The system obtains the user's iCloud data storage structure information based on the temporary access token. This information includes a list of data types (all data types stored by the target account, such as photos, videos, contacts, notes, SMS messages, WeChat / QQ application backup data, etc., and the storage node address corresponding to each data type, such as the IP address of the iCloud data center), data sharding information (the data sharding strategy for each data type, such as photo data divided into daily data blocks based on shooting time, with each block size ranging from 100 to 500 MB; video data divided into shards based on file size, with each shard size ranging from 1 to 2 GB, and the unique identifier (FileID), encryption status (end-to-end encryption / server-side encryption), and encryption algorithm identifier (such as AES-256-GCM, ChaCha20-Poly1305) for each data shard), and metadata information (including the shooting time, geographical location, and device information for photos, and the creation time and encryption identifier for notes). A local decryption and extraction environment is constructed, including a decryption algorithm library containing algorithms corresponding to different iCloud data encryption protocols. Communication links are established between the local decryption and extraction environment and the storage nodes for each data type, based on a data type list. For example, SMS data is stored in a data center in California, USA (IP: 17.xxx.xxx.xxx), WeChat backup data is stored in a data center in Shanghai, China (IP: 101.xxx.xxx.xxx), and photo data is stored in a data center in Tokyo, Japan (IP: 203.xxx.xxx.xxx). The hardware layer of the local decryption and extraction environment is configured, for example, by configuring an Intel Xeon Platinum 8480+ processor to support AES-NI hardware encryption acceleration; configuring an NVIDIA A100 GPU for parallel decryption computation; configuring a 100Gbps high-speed network card to reduce data transmission latency; and constructing a temporary isolation layer within the local decryption and extraction environment to store complete files, which are then destroyed after data output is complete.

[0028] It should be further explained that, in the specific implementation process, the process of obtaining the user's root key based on the temporary access token and the user's iCloud account compliance authorization credentials includes: The iCloud data encryption protocol, which obtains the root key based on metadata information, extracts multi-dimensional key factors related to iCloud encryption from the iCloud account's compliant authorization credentials. These key factors include the hardware signature of the "historically authorized device" bound to the iCloud account, the biometric information (Face ID, Touch ID) bound to the iCloud account, and the hash value of the security question. Based on the iCloud data encryption protocol, these multi-dimensional key factors are fused with the temporary access token to generate a key seed, which is then encrypted to generate the root key. For example, let the hardware signature of the "historically authorized device" bound to the iCloud account be K1, i... The biometric information (FaceID, TouchID) bound to the Cloud account is K2, the hash value of the security question is K3, the temporary access token is K4, and the root key is K. The iCloud data encryption protocol corresponding to the root key includes the HMAC-SHA256 algorithm and the preset weights W1, W2, W3, and W4 corresponding to K1, K2, K3, and K4. Then K = (K1×W1 + K2×W2 + K3×W3 + K4×W4) mod 2^256, where (K1×W1 + K2×W2 + K3×W3 + K4×W4) represents the key seed, and mod 2^256 represents the modulo operation with 2^256 as the modulus.

[0029] It should be further explained that, in the specific implementation process, the process of deriving session keys based on the user's root key and iCloud data storage structure information to obtain temporary session keys for various types of data includes: Based on metadata information, the iCloud data encryption protocol for each type of data is obtained. Based on the iCloud data encryption protocol and the root key, the decryption public key and decryption private key for each type of data are obtained. The decryption public key and the root key are bound together and sent to the iCloud verification server. The iCloud verification server verifies the root key (after receiving the decryption public key, the iCloud verification server uses its built-in parsing module to extract the root key K bound to the decryption public key, verifies K, and determines whether K matches the K pre-stored in the iCloud verification server; if they match, the verification is successful). After successful verification, the server-side intermediate shared value for each type of data is generated using the iCloud verification server, the decryption public key, and the preset server-side private key. A temporary session key for each type of data is generated using the iCloud verification server, the iCloud data encryption protocol, and the server-side intermediate shared value (for example, encrypting the server-side intermediate shared value using the AES-256-GCM algorithm to generate a temporary session key). The iCloud verification server encrypts the data fragments of each type of data that need to be transmitted to the decryption end using the temporary session key. The decryption terminal generates an intermediate shared value for each type of data based on its private key and a preset server public key. It then performs a consistency match between the intermediate shared value and the corresponding server intermediate shared value. If they match, a temporary session key for the data type is generated using the decryption terminal, the iCloud data encryption protocol, and the intermediate shared value.

[0030] The calculation process for the intermediate shared value on the server side and the intermediate shared value on the decryption side includes: Assume that the iCloud data encryption protocol for typed data is the ECDH algorithm, and ECDH uses an elliptic curve with parameters (G, p) (where G is the base point of the elliptic curve and p is a prime number in a finite field): The decryption end's private key is SK_private (held only by the decryption end), and the decryption end's public key is SK_public = SK_private × G (generated by elliptic curve multiplication of the private key and the base point G, and can be made public). The server's private key is Server_private (held only by the server), and the server's public key is Server_public = Server_private × G (generated similarly and can be made public). Calculation of the intermediate shared value at the decryption end: SK_Shared_secret = SK_private × Server_public = SK_private × (Server_private × G), where SK_Shared_secret represents the intermediate shared value at the decryption end; The calculation of the intermediate shared value on the server side is: Server_Shared_secret = Server_private × SK_public = Server_private × (SK_private × G), where Server_Shared_secret represents the intermediate shared value on the server side.

[0031] It should be further explained that, in the specific implementation process, the process of parallel multi-threaded scheduling of the data to be extracted and setting the number of parallel download threads corresponding to the storage nodes of each type of data includes: Probe packets are sent to all storage nodes through the communication link to obtain the response latency and packet loss rate of each storage node. The user specifies the priority of each type of data, and the download size of each type of data fragment is obtained according to the data fragment information. The priority of each type of data, the download size of the data fragment, and the response latency and packet loss rate of the storage node to which each type of data belongs are used as evaluation indicators. The indicator weights of the evaluation indicators are set, and the membership matrix of each storage node to the preset load level is obtained through fuzzy comprehensive evaluation. The load level of each storage node is obtained based on the membership matrix and indicator weights. The number of parallel download threads corresponding to different load levels is preset (the higher the load level, the more parallel download threads). The number of parallel download threads corresponding to each storage node is set in the local decryption and extraction environment according to the load level of each storage node.

[0032] It should be further explained that, in the specific implementation process, the process of obtaining the load level of each storage node based on the membership matrix and indicator weights includes: The evaluation index weights and membership matrix of the evaluation index are fused by formula to obtain the fuzzy comprehensive evaluation matrix of the evaluation index. The membership degree of each storage node to different load levels is obtained according to the fuzzy comprehensive evaluation matrix. The load level with the highest membership degree for each storage node is selected and the load level with the highest membership degree for each storage node is taken as the load level of each storage node. The formula is: ; in, The fuzzy comprehensive evaluation matrix for the evaluation indicators. To evaluate the indicator weights, For the membership matrix, "This indicates that the elements at corresponding positions in the weight matrix and membership matrix of the evaluation index are multiplied together." The weighting parameter is used to balance the weight matrix and membership matrix in the fuzzy comprehensive evaluation matrix used to control the evaluation index.

[0033] It should be further explained that, in the specific implementation process, the process of matching decryption algorithms for various types of data downloaded to the decryption terminal and performing data decryption operations based on the temporary session key includes: When data fragments of typed data are downloaded to the temporary isolation layer, the metadata information of the data fragments is read, the corresponding iCloud data encryption protocol is obtained, the iCloud data encryption protocol is input into the decryption algorithm library for automatic matching, the corresponding decryption algorithm is obtained, the data fragments of typed data and the temporary session key are input into the corresponding decryption algorithm, and the data decryption operation is performed. For example, for the AES-256-GCM algorithm: first, the 12-byte IV (Initialization Vector) and the 16-byte authentication tag (Tag) are extracted from the data fragment, and then the temporary session key and the IV are used to decrypt the data body; for the ChaCha20-Poly1305 algorithm: the 12-byte IV and the 16-byte Poly1305 tag are extracted from the data fragment, the session key and the IV are used to decrypt the data body; and a decrypted data fragment is generated.

[0034] It should be further explained that, in the specific implementation process, data download integrity verification and data decryption integrity verification are performed. When the data download integrity verification and data decryption integrity verification pass, the data reconstruction operation and reconstruction integrity verification process includes: Whenever a data fragment of a type of data is downloaded to the temporary isolation layer, the hash value of the data fragment is obtained, and the fragment hash value of the data fragment is extracted from the metadata information in the iCloud data storage structure information returned by the iCloud verification server. The hash value of the data fragment is compared with the fragment hash value extracted from the metadata information. If they are inconsistent, the data fragment of that type of data is downloaded again. Whenever a decrypted data fragment of type data is generated, the authentication tag corresponding to the decrypted data fragment is obtained (for example, the GHASH (Galois hash) function built into the AES-256-GCM algorithm performs a hash calculation on "IV processing result + data fragment before decryption + data length information", and performs an XOR operation on the 128-bit hash result output by the GHASH function and "the first key stream block generated by the counter block encryption", finally obtaining a 16-byte AES-256-GCM authentication tag, which is bound to the decrypted data fragment). The decrypted data fragment is verified through the authentication tag (the decrypted data fragment is encrypted, the data fragment before decryption to be verified is obtained, the GHASH function logic of the encryption stage is used, and a "new authentication tag" is recalculated based on "current session key + extracted IV + data fragment before decryption + data length information", and the recalculated "new authentication tag" is compared byte by byte with the original authentication tag). If the verification fails, the session key is determined to be abnormal, and the temporary session key of type data is obtained again to decrypt the data fragment until the verification is successful. Based on the data fragment information, reassemble all decrypted data fragments of the type data that have been decrypted to obtain the complete file of the type data. Obtain the hash value of the complete file. Extract the total hash value of the type data file from the metadata information in the iCloud data storage structure information returned by the iCloud verification server. Compare the hash value of the complete file with the total hash value of the file. If they match, the type data is considered to be extracted completely. If they do not match, proceed to step 3 and re-download all data fragments of the type data. Then, execute step 4 to perform data decryption on all data fragments. Then, perform data download integrity verification and data decryption integrity verification. When the data download integrity verification and data decryption integrity verification pass, perform data reassembly and reassembly integrity verification. Compare the hash value of the complete file with the total hash value of the file. If they match, the type data is considered to be extracted completely. If they do not match, continue to step 3 and count the cumulative number of reassembly integrity verifications. A preset upper limit for the number of verifications is set (e.g., 3 times). When the cumulative number of integrity verifications exceeds the upper limit, the data extraction is considered incomplete.

[0035] It should be further explained that, in the specific implementation process, the process of extracting complete type data, outputting the data, and securely destroying it includes: When the type data is determined to be complete, the complete file of the type data stored in the temporary isolation layer is output according to the user's output format. For example, if the output format is local storage, the complete file of the type data is stored on a local secure storage device (such as an encrypted USB flash drive or hardware encrypted hard drive, using the AES-256-XTS encryption algorithm). The storage directory is organized in the structure of "data type / timestamp" (such as "photos / 20250827" "SMS / 20250827") for easy user retrieval. If the output format is remote transmission, and the user needs to retrieve the data remotely, the data is transmitted to the specified remote server via the SFTP (SSH File Transfer Protocol). During the transmission, the TLS 1.3 protocol is used for encryption, and the SHA-256 hash value of the data is calculated before and after transmission to ensure transmission integrity. After the complete file of the type data is output, the complete file of the type data stored in the temporary isolation layer is destroyed.

[0036] like Figure 2 As shown, an iCloud data decryption and extraction system includes a cloud platform, and the cloud communication connection includes a preprocessing module, a key derivation module, a download scheduling module, a decryption module, and a data verification and output module. The preprocessing module is used to perform compliance authorization verification for users and initialize the decryption terminal environment, and obtain temporary access tokens and iCloud data storage structure information; The key derivation module is used to obtain the user's root key based on the temporary access token and the user's iCloud account compliance authorization credentials, and to derive the session key based on the user's root key and iCloud data storage structure information to obtain temporary session keys for various types of data. The download scheduling module is used to perform parallel multi-threaded scheduling of the data to be extracted, setting the number of parallel download threads corresponding to the storage nodes to which each type of data belongs, and then executing the data download operation. The decryption module is used to match decryption algorithms for various types of data downloaded to the decryption terminal and perform data decryption operations based on the temporary session key; The data verification and output module is used to perform data download integrity verification and data decryption integrity verification. When the data download integrity verification and data decryption integrity verification pass, the data reconstruction operation and reconstruction integrity verification are performed. The extracted complete data is then output and securely destroyed.

[0037] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A method for decrypting and extracting iCloud data, characterized in that, Includes the following steps: Step 1: Perform compliance authorization verification for the user and initialize the decryption terminal environment to obtain temporary access tokens and iCloud data storage structure information; Step 2: Obtain the user's root key based on the temporary access token and the user's iCloud account compliance authorization credentials. Based on the user's root key and iCloud data storage structure information, deduce the session key and obtain temporary session keys for various types of data. Step 3: Perform parallel multi-threaded scheduling on the data to be extracted, set the number of parallel download threads corresponding to the storage nodes of each type of data, and then execute the data download operation; Step 4: Match the decryption algorithms for each type of data downloaded to the decryption terminal, and perform data decryption based on the temporary session key; Step 5: Perform data download integrity verification and data decryption integrity verification. When the data download integrity verification and data decryption integrity verification pass, perform data reconstruction operation and reconstruction integrity verification, and output and securely destroy the extracted complete type data.

2. The iCloud data decryption and extraction method according to claim 1, characterized in that, The process of conducting compliance authorization verification includes: Obtain the iCloud account compliance authorization credentials provided by the user, verify the account through the iCloud verification server based on the iCloud account compliance authorization credentials, and obtain a temporary access token issued by the iCloud verification server.

3. The iCloud data decryption and extraction method according to claim 2, characterized in that, The initialization process of the decryption environment includes: The user's iCloud data storage structure information is obtained based on the temporary access token. The iCloud data storage structure information includes a list of data types, data fragment information, and metadata information. A local decryption and extraction environment is constructed, which includes a decryption algorithm library containing decryption algorithms corresponding to different iCloud data encryption protocols. A communication link is constructed between the local decryption and extraction environment and the storage nodes of each type of data based on the data type list. A temporary isolation layer is constructed in the local decryption and extraction environment to store the complete file. After the data output is completed, the complete file in the temporary isolation layer is destroyed.

4. The iCloud data decryption and extraction method according to claim 3, characterized in that, The process of obtaining a user's root key based on a temporary access token and the user's iCloud account compliance authorization credentials includes: The iCloud data encryption protocol obtains the root key based on metadata information, extracts multi-dimensional key factors from the iCloud account compliance authorization certificate, merges the multi-dimensional key factors with the temporary access token based on the iCloud data encryption protocol to generate a key seed, and encrypts the key seed to generate the root key.

5. The iCloud data decryption and extraction method according to claim 4, characterized in that, The process of deriving session keys based on the user's root key and iCloud data storage structure information, and obtaining temporary session keys for various types of data, includes: The system obtains the iCloud data encryption protocol for each type of data based on metadata information. It also obtains the decryption public key and decryption private key for each type of data based on the iCloud data encryption protocol and the root key. The system binds the decryption public key and the root key for each type of data and sends them to the iCloud verification server. The iCloud verification server verifies the root key. After successful verification, the system generates a server-side intermediate shared value for each type of data using the iCloud verification server, the decryption public key, and the preset server-side private key. Finally, the system generates a temporary session key for each type of data using the iCloud verification server, the iCloud data encryption protocol, and the server-side intermediate shared value for each type of data. The iCloud verification server then encrypts the data fragments for each type of data based on the temporary session key. The decryption terminal generates an intermediate shared value for each type of data based on its private key and a preset server public key. It then performs a consistency match between the intermediate shared value and the corresponding server intermediate shared value. If they match, a temporary session key for the data type is generated using the decryption terminal, the iCloud data encryption protocol, and the intermediate shared value.

6. The iCloud data decryption and extraction method according to claim 5, characterized in that, The process of performing parallel multi-threaded scheduling of the data to be extracted, and setting the number of parallel download threads corresponding to the storage nodes of each type of data, includes: Probe packets are sent to all storage nodes through the communication link to obtain the response latency and packet loss rate of each storage node. The user specifies the priority of each type of data, and the download size of each type of data fragment is obtained according to the data fragment information. The priority of each type of data, the download size of the data fragment, and the response latency and packet loss rate of the storage node to which each type of data belongs are used as evaluation indicators. The indicator weights of the evaluation indicators are set, and the membership matrix of each storage node to the preset load level is obtained through fuzzy comprehensive evaluation. The load level of each storage node is obtained based on the membership matrix and indicator weights. The number of parallel download threads corresponding to different load levels is preset. The number of parallel download threads corresponding to each storage node is set in the local decryption and extraction environment according to the load level of each storage node.

7. The iCloud data decryption and extraction method according to claim 6, characterized in that, The process of matching decryption algorithms for various types of data downloaded to the decryption terminal and performing data decryption operations based on the temporary session key includes: When the data fragments of type data are downloaded to the temporary isolation layer, the metadata information of the data fragments is read, the corresponding iCloud data encryption protocol is obtained, the iCloud data encryption protocol is input into the decryption algorithm library for automatic matching, the corresponding decryption algorithm is obtained, the data fragments of type data and the temporary session key are input into the corresponding decryption algorithm, the data decryption operation is performed, and decrypted data fragments are generated.

8. The iCloud data decryption and extraction method according to claim 7, characterized in that, The process of performing data download integrity verification and data decryption integrity verification, and then performing data reconstruction and integrity verification when the data download integrity verification and data decryption integrity verification pass, includes: Whenever a data fragment of a type of data is downloaded to the temporary isolation layer, the hash value of the data fragment is obtained, and the fragment hash value of the data fragment is extracted from the metadata information. The hash value of the data fragment is compared with the fragment hash value extracted from the metadata information. If they are inconsistent, the data fragment of that type of data is downloaded again. Whenever a decrypted data fragment of type data is generated, the authentication tag corresponding to the decrypted data fragment is obtained, and the decrypted data fragment is verified by the authentication tag. If the verification fails, the temporary session key of type data is obtained again to decrypt the data fragment until the verification is successful. Based on the data fragmentation information, all decrypted data fragments of the type data that have been decrypted are reassembled to obtain the complete file of the type data. The hash value of the complete file is obtained, and the total hash value of the type data file is extracted from the metadata information. The hash value of the complete file is compared with the total hash value of the file. If they match, the type data is determined to be completely extracted. If they do not match, the process jumps to step 3, and the cumulative number of integrity verifications is counted. A maximum number of verifications is preset. When the cumulative number of integrity verifications exceeds the maximum number of verifications, the data extraction is determined to be incomplete.

9. A method for decrypting and extracting iCloud data according to claim 8, characterized in that, The process of extracting complete type data, outputting the data, and securely destroying it includes: When the type data is completely extracted, the complete file of type data stored in the temporary isolation layer is output according to the output format obtained by the user. After the complete file of type data is output, the complete file of type data stored in the temporary isolation layer is destroyed.

10. An iCloud data decryption and extraction system, specifically applied to the iCloud data decryption and extraction method according to any one of claims 1 to 9, characterized in that, Including the cloud, the cloud communication connection includes a preprocessing module, a key derivation module, a download scheduling module, a decryption module, and a data verification and output module; The preprocessing module is used to perform compliance authorization verification for users and initialize the decryption terminal environment, and obtain temporary access tokens and iCloud data storage structure information; The key derivation module is used to obtain the user's root key based on the temporary access token and the user's iCloud account compliance authorization credentials, and to derive the session key based on the user's root key and iCloud data storage structure information to obtain temporary session keys for various types of data. The download scheduling module is used to perform parallel multi-threaded scheduling of the data to be extracted, setting the number of parallel download threads corresponding to the storage nodes to which each type of data belongs, and then executing the data download operation. The decryption module is used to match decryption algorithms for various types of data downloaded to the decryption terminal and perform data decryption operations based on the temporary session key; The data verification and output module is used to perform data download integrity verification and data decryption integrity verification. When the data download integrity verification and data decryption integrity verification pass, the data reconstruction operation and reconstruction integrity verification are performed. The extracted complete data is then output and securely destroyed.

Images