System and method for constructing trusted secure digital storage space

Abstract

The invention discloses a system and method for constructing a trusted secure digital storage space, and relates to the technical field of secure data storage, and the method comprises the following steps: carrying out dynamic fragmentation mapping on original data, and generating an initial dynamic distribution key; performing secondary encryption on the initial time dynamic distribution key to obtain a re-encrypted time dynamic distribution key; performing authority control on the data access behavior according to the user role and the dynamically generated temporary key; performing hierarchical verification on the encrypted data fragments, and calculating and storing an authentication code; a dynamic redundancy storage strategy is carried out according to the data sensitive category of the original data, and the secondary encryption processing calculation process is accelerated. By systematically integrating dynamic fragmentation, hierarchical encryption, dynamic access control, hierarchical verification and a self-healing disaster recovery technology, a comprehensive data security protection framework is constructed, and a set of complete and operable methodology and technology implementation giving consideration to security and efficiency is provided.

Description

Technical Field

[0001] This invention relates to the technical field of secure data storage, and in particular to a system and method for constructing a trusted and secure digital storage space. Background Technology

[0002] Traditional centralized storage solutions, such as cloud storage, face serious security risks such as single points of failure, data leakage, and malicious tampering. While distributed storage technology has solved the single point of failure problem, ensuring data confidentiality, integrity, and availability among untrusted distributed nodes, as well as implementing flexible access control, remains a key research focus and challenge.

[0003] Currently, Chinese invention patent application number CN202410544273.6 discloses a secure data management system based on spatiotemporal encryption. The method includes: constructing a three-dimensional virtual storage space; acquiring streaming data in real time, dividing the streaming data into multiple data packets to be stored, and constructing a streaming data storage time series; constructing a space allocation storage function, generating a random number sequence based on the streaming data storage time series, dividing the three-dimensional virtual storage space into multiple storage units, and generating a storage unit usage sequence list based on the random number sequence; storing each data packet to be stored according to the streaming data storage time series and the storage unit usage sequence list, and constructing and storing a storage space information table. This invention determines the data storage location based on the space allocation storage function. During physical data storage, the stored data in the virtual space is mapped to the physical storage space, and the data is scrambled, ensuring data security and improving data storage speed. However, existing technologies often focus on solving single-level problems, lacking a comprehensive solution that systematically integrates data fragmentation, multi-layer encryption, dynamic access control, integrity verification, and disaster recovery. Especially for multi-source, heterogeneous, and highly sensitive data such as educational archives, meteorological observation data, and power grid monitoring data, existing methods struggle to achieve an ideal balance between security, efficiency, and flexibility. Furthermore, existing technologies cannot dynamically adapt to different data characteristics and cannot simultaneously provide end-to-end security while balancing storage efficiency and system performance. Summary of the Invention

[0004] The technical problem addressed by this invention is that existing technologies often focus on solving single-level problems, lacking a comprehensive solution that systematically integrates data fragmentation, multi-layer encryption, dynamic access control, integrity verification, and disaster recovery. Especially for multi-source, heterogeneous, and highly sensitive data such as educational archives, meteorological observation data, and power grid monitoring data, existing methods struggle to achieve an ideal balance between security, efficiency, and flexibility. Furthermore, existing technologies cannot dynamically adapt to different data characteristics and cannot simultaneously provide end-to-end security while balancing storage efficiency and system performance.

[0005] To address the aforementioned technical problems, this invention provides the following technical solution: a method for constructing a trusted and secure digital storage space, comprising the following steps: Step S1: Extract the raw data input by the user, perform dynamic fragmentation mapping on the raw data to obtain the standard time fragmentation mapping, and generate the initial dynamic allocation key based on the standard time fragmentation mapping; Step S2: Perform secondary encryption on the initial time-dynamically allocated key to obtain the re-encrypted time-dynamically allocated key; Step S3: Based on user roles and dynamically generated temporary keys, implement access control for data access behavior; Step S4: Perform layered verification on the encrypted data fragments, and store them in the distributed storage nodes after successful verification, and calculate the storage authentication code; Step S5: Implement a dynamic redundancy storage strategy based on the data sensitivity category of the original data, and accelerate the secondary encryption processing calculation process in Step S2 by leveraging the parallel computing capabilities of the graphics processing unit (GPU).

[0006] Preferably, step S1 includes: The raw data includes generation time, geographical location, and sensitive categories. The sensitive categories are divided into a first sensitive dataset, a second sensitive dataset, and a third sensitive dataset. The first sensitive dataset includes user identity and privacy information, authentication and control information, and core business information. The second sensitive dataset includes internal business and process data, user operation logs, device IDs without specific identity information, and employee IDs and positions of internal employees. The third sensitive dataset includes public information. The process of calculating the spatiotemporal partitioning intervals of the original data includes: The original data is labeled with data items, timestamps, and spatial coordinates. The spatial coordinates include the address storage space size of the original data and the pointer coordinates of the original data. The time and space of the original data are dynamically segmented and mapped.

[0007] Preferably, the dynamic fragmentation mapping includes: Subtract the time slice of the data corresponding to the longest time period in the original data from the time slice of the data corresponding to the shortest time period in the original data to obtain the first time slice. Subtract the time slice of the original data from the time slice of the smallest unit of data corresponding to the storage address of the current original data to obtain the second time slice. Compare the first time slice with the second time slice to obtain the standard time slice mapping. The standard time-slice mapping is stored at an address, and the stored address is used as a data key. The data key is then mapped using a pseudo-random function to generate a unique subkey. The unique subkeys are distributed to the original data of the corresponding time slices to obtain the initial time-dynamic allocation key of the original data.

[0008] Preferably, step S2 includes: Secondary encryption specifically includes: The original data is sorted according to the timestamp order, and the initial time dynamic allocation key corresponding to the original data is extracted and stored in the sequential queue. The head node of the current sequential queue is initialized to the value of the next node multiplied by the current preset random number minus one, plus the cosine function and the remainder after dividing by 1. The independent variable of the cosine function is the result of 4 multiplied by the inverse cosine function, and the independent variable of the inverse cosine function is the value of the current head node. The initial time-dynamically allocated key is based on a sequential queue, and iterative encryption operations are performed using the calculation steps of the head node to obtain the re-encryption time-dynamically allocated key.

[0009] Preferably, step S2 further includes generating an encryption header, the generation process of which includes: The re-encryption time-dynamically allocated key sequence is quantized. The quantization process includes converting the re-encryption time-dynamically allocated key into binary to obtain a re-encryption binary ciphertext sequence, performing a bitwise XOR operation on the re-encryption binary ciphertext sequence, and storing the initial time-dynamically allocated key sequence value and the number of iterations in the head node of the sequential queue to form an encryption header. The encryption header is used to regenerate the binary key sequence corresponding to the original data during decryption.

[0010] Preferably, step S3 includes: Each user is mapped to a pre-input user role set through a first pseudo-random function. When a user who needs to access data makes a request, a temporary key is dynamically generated for each user. The permission set derived from the user role in the user role set corresponding to each user is bound to the temporary key point-to-point through a second pseudo-random function. The binding result is encapsulated into the original data and encrypted in the access token after digital signature. Users perform data decryption and access operations using temporary keys bound to their permissions; The user presents an access token to the original data node. After verifying the token's signature, the original data node extracts the permission information bound to the verification token and confirms that the user's requested operation is within the scope of permissions. After successful verification, the user decrypts and accesses the data using a temporary key.

[0011] Preferably, step S4 includes: Identify the identity data and process data in the original data respectively. The identity data includes user certificates, user IDs, user roles and user permissions, while the process data includes transaction records, key exchange records, access logs, approval records and transfer records. Digital signatures for identity data are generated using the national cryptographic SM2 algorithm and encapsulated in Extensible Markup Language (Extreme Markup Language) format for verification. Calculate the hash value of the standard time-slice mapping of the process data, construct a Merkle hash tree from the hash value, and use the root hash value of the Merkle hash tree as the verification basis to verify the original data.

[0012] Preferably, when storing the original data, a storage authentication code is calculated on the original data. The calculation process includes: The re-encryption time-dynamic allocation key is XORed with a preset first operation parameter to calculate a hash value, resulting in a first hash storage authentication code. The re-encryption time-dynamic allocation key is XORed with a preset second operation parameter to calculate a hash value, resulting in a second hash storage authentication code. The first hash storage authentication code, the second hash storage authentication code, and the data content after secondary encryption are concatenated to obtain a third hash storage authentication code. The third hash storage authentication code is then subjected to a duplicate check. If the third hash storage authentication code already exists, storage is rejected.

[0013] Preferably, step S5 includes: Based on the sensitivity category of the original data, a dynamic redundancy storage strategy is applied to the data fragments after secondary encryption. The dynamic redundancy storage strategy specifically includes: When the standard time-slice mapping of the original data corresponds to the first sensitive dataset, a multi-replica combined erasure coding storage mechanism is automatically triggered. The storage mechanism includes: copying the data after secondary encryption to generate a first replica, a second replica, and a third replica, and distributing the first replica, the second replica, and the third replica in several physically or logically isolated storage addresses; performing erasure coding algorithm calculations on the original plaintext of the standard time-slice mapping in parallel to generate several redundant check fragments; and storing the redundant check fragments in storage addresses different from those of the first replica, the second replica, and the third replica. When the standard time-slice mapping of the original data corresponds to the third sensitive dataset, a storage mechanism combining single replica and cross-region synchronization is triggered. The storage mechanism includes: copying the data after secondary encryption to obtain a fourth replica, writing the fourth replica into the highest priority response execution queue, and copying the changes of the fourth replica to several standby areas with different addresses in a near real-time manner by executing the cross-region synchronization process. The specific implementation process of accelerating the secondary encryption processing calculation in step S2 by utilizing the parallel computing capabilities of the graphics processing unit (GPU) includes: Step S51: Combine several initial time-dynamically allocated keys to be encrypted into a dataset to be encrypted, and transfer the dataset to be encrypted as a whole from the main memory RAM controlled by the central processing unit (CPU) to the global video memory VRAM dedicated to the graphics processing unit (GPU) via a high-speed bus. Step S52: The central processing unit (CPU) sends an instruction to the graphics processing unit (GPU) to perform secondary encryption processing on the initial time dynamically allocated key in the dataset to be encrypted for the second time in step S2. Step S53: After receiving the instruction, the streaming multiprocessor of the graphics processing unit (GPU) creates several threads for parallel execution. Each thread is independently assigned to process an initial time dynamically allocated key in the dataset. All threads utilize the GPU's Single Instruction Multithreaded (SIMT) architecture to synchronously and in parallel execute each step of the secondary encryption operation. Step S54: After all threads have completed the preset number of iterations, a result dataset including all re-encryption time-dynamic allocation keys is obtained. The result dataset of the re-encryption time-dynamic allocation keys is transferred from the GPU's video memory to the CPU's main memory. After receiving these results, the CPU continues to execute subsequent quantization processing and file encryption steps.

[0014] A system for constructing a trusted and secure digital storage space, the system being used to execute a method for constructing a trusted and secure digital storage space, including a spatiotemporal sharding module, a secondary encryption module, an access control module, a storage authentication module, and an optimization module: The spatiotemporal sharding module includes extracting the raw data input by the user, performing dynamic sharding mapping on the raw data to obtain a standard time sharding mapping, and generating an initial dynamic allocation key based on the standard time sharding mapping; The secondary encryption module includes performing secondary encryption on the initial time-dynamically allocated key to obtain the re-encrypted time-dynamically allocated key; The access control module includes access control for data access behavior based on user roles and dynamically generated temporary keys; The storage authentication module includes performing layered verification on encrypted data fragments, storing them in distributed storage nodes after successful verification, and calculating storage authentication codes. The optimization module includes a dynamic redundancy storage strategy based on the data sensitivity categories of the original data, and accelerates the secondary encryption processing calculation process by leveraging the parallel computing capabilities of the graphics processing unit (GPU).

[0015] The beneficial effects of this invention are as follows: The entire security strategy of this application is not static and fixed, but dynamic. From data sharding, key generation, access control to redundant storage, each step is dynamically related to the spatiotemporal attributes and sensitivity of the data itself. Compared with traditional storage systems, it can provide appropriate protection for data of different values, achieving optimal allocation of security resources. This avoids resource waste caused by over-protection of non-sensitive data while ensuring the highest level of security for core data. It innovatively uses the spatiotemporal metadata of the data as the seed of the initial key, achieving one key per number. Then, the initial key is further encrypted through spatiotemporal transformation mapping to generate the final key. This design makes the key both context-dependent and possesses extremely high complexity and randomness, constructing a double security barrier. While designing a computationally intensive strong encryption algorithm (secondary encryption), it proactively introduces GPU parallel computing to solve its performance bottleneck. This reflects a profound understanding of the practicality of the technical solution. Instead of sacrificing availability in pursuit of theoretically absolute security, it successfully combines ultimate security with high processing performance through heterogeneous computing (CPU+GPU), enabling the solution to handle large-scale, high-concurrency real-world application scenarios. By protecting data security from different dimensions, it constructs a defense-in-depth system. Even if a single layer of defense is breached, other layers can still provide protection, greatly improving the overall robustness of the system. Attached Figure Description

[0016] Figure 1 This is a basic flowchart illustrating a method for constructing a trusted and secure digital storage space, as provided in one embodiment of the present invention. Detailed Implementation

[0017] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0018] Reference Figure 1 As an embodiment of the present invention, a method for constructing a trusted and secure digital storage space is provided, comprising the following steps: Step S1: Extract the raw data input by the user, perform dynamic fragmentation mapping on the raw data to obtain the standard time fragmentation mapping, and generate the initial dynamic allocation key based on the standard time fragmentation mapping; Step S2: Perform secondary encryption on the initial time-dynamically allocated key to obtain the re-encrypted time-dynamically allocated key; Step S3: Based on user roles and dynamically generated temporary keys, implement access control for data access behavior; Step S4: Perform layered verification on the encrypted data fragments, and store them in the distributed storage nodes after successful verification, and calculate the storage authentication code; Step S5: Implement a dynamic redundancy storage strategy based on the data sensitivity category of the original data, and accelerate the secondary encryption processing calculation process in Step S2 by leveraging the parallel computing capabilities of the graphics processing unit (GPU).

[0019] This method systematically integrates dynamic sharding, layered encryption, dynamic access control, layered verification, and self-healing disaster recovery technologies to construct a comprehensive data security protection framework. This method is systematic, integrated, and dynamic, providing a complete, operable methodology and technical implementation that balances security and efficiency. It seamlessly connects data awareness, dynamic encryption, fine-grained permissions, efficient verification, and intelligent disaster recovery, ultimately constructing a trusted and secure digital storage space that can proactively adapt to data characteristics and security needs.

[0020] Step S1 includes: The raw data includes the generation time, geographical location, and sensitive categories. The sensitive categories are divided into three sensitive datasets: the first sensitive dataset, the second sensitive dataset, and the third sensitive dataset. The first sensitive dataset includes user identity and privacy information, authentication and control information, and core business information. The second sensitive dataset includes internal business and process data, user operation logs, device IDs without specific identity information, and employee IDs and positions of internal employees. The third sensitive dataset includes publicly available information. The process of calculating the spatiotemporal partitioning intervals of the original data includes: The original data is labeled with data items, timestamps, and spatial coordinates. The spatial coordinates include the address storage space size of the original data and the pointer coordinates of the original data. The time and space of the original data are dynamically segmented and mapped.

[0021] Internal business and process data includes educational records, medical data, power grid data, and meteorological data; Educational records include students' regular grades, class attendance records, and teachers' internal teaching evaluations; Medical data includes ordinary medical records (not involving highly sensitive diseases), hospital internal scheduling information, and drug inventory data; Power grid data includes routine power grid load data, general equipment operation logs, and maintenance plans for non-critical areas; Meteorological data includes intermediate calculations from ongoing, unverified meteorological models and internal research reports.

[0022] Dynamic sharding is used to optimize security and storage efficiency based on the temporal, spatial, and sensitivity attributes of the data.

[0023] It achieves refined and contextualized data management. By pre-classifying and tagging data with attributes, it provides a basis for subsequent dynamic security strategies (such as dynamic encryption and dynamic redundant storage). It transforms abstract data into objects with clear identities (sensitivity, spatiotemporal attributes), enabling the system to treat data differently based on these identities, which is the foundation for achieving adaptive security.

[0024] Dynamic sharding mapping includes: Subtract the time slice of the data corresponding to the longest time period in the original data from the time slice of the data corresponding to the shortest time period in the original data to obtain the first time slice. Subtract the time slice of the original data from the time slice of the smallest unit of data corresponding to the storage address of the current original data to obtain the second time slice. Compare the first time slice with the second time slice to obtain the standard time slice mapping. The standard time-slice mapping is stored at an address, and the stored address is used as a data key. The data key is then mapped using a pseudo-random function to generate a unique subkey. The unique subkeys are distributed to the original data of the corresponding time slices to obtain the initial time-dynamic allocation key of the original data.

[0025] It avoids storage redundancy or security risks caused by traditional fixed-block storage and is adaptable to multi-source heterogeneous data, such as educational records, meteorological data, and power grid monitoring data.

[0026] A strong binding relationship was established between the spatiotemporal characteristics of the data and the initial key. This means that the key is no longer a random string unrelated to the data content, but is derived from the data's own time and storage attributes. This method makes key generation deterministic and traceable, while the dynamic sharding avoids the security vulnerabilities of traditional fixed-block sharding (such as the vulnerability of fixed data block sizes to analysis attacks), thus improving security and storage efficiency.

[0027] Step S2 includes: Secondary encryption specifically includes: Sort the original data according to the timestamp order, extract the initial time dynamic allocation key corresponding to the original data and store it in the sequential queue. Initialize the head node of the current sequential queue to the value of the next node multiplied by the current preset random number minus one, add the cosine function and take the remainder when divided by 1. The independent variable of the cosine function is 4 multiplied by the inverse cosine function. The independent variable of the inverse cosine function is the value of the current head node. The initial time-dynamically allocated key is based on a sequential queue, and iterative encryption operations are performed using the calculation steps of the head node to obtain the re-encryption time-dynamically allocated key.

[0028] This significantly enhances the complexity and unpredictability of the key. Although the initial key is related to the data attributes, it may also exhibit certain patterns, introducing nonlinearity and pseudo-randomness. This makes it virtually impossible to deduce the final re-encryption key from the initial key or the data, effectively resisting cryptanalysis and statistical attacks, and significantly improving encryption strength.

[0029] Step S2 also includes generating an encryption header, the process of which includes: The re-encryption time-dynamically allocated key sequence is quantized. The quantization process includes converting the re-encryption time-dynamically allocated key into binary to obtain the re-encryption binary ciphertext sequence, performing a bit-by-bit XOR operation on the re-encryption binary ciphertext sequence, and storing the initial time-dynamically allocated key sequence value and the number of iterations in the head node of the sequential queue to form the encryption header. The encryption header is used to regenerate the binary key sequence corresponding to the original data during decryption.

[0030] The encryption header itself also needs to be stored or transmitted in a secure manner (such as by encrypting it using the data recipient's public key) so that it can be used in the subsequent data decryption process.

[0031] Even if the inner homomorphic encryption is cracked, attackers still need to crack the re-encryption to obtain the original plaintext data. This effectively resists attempts to crack the data through statistical analysis and conventional attack methods. The computational process of chaotic mapping is highly efficient, and combined with the parallel computing capabilities of graphics processing units, it can guarantee the data processing throughput during the data encryption process, meeting the efficiency requirements of practical applications.

[0032] The decryption steps are as follows: Step S21: When an authorized user needs to access data, first obtain the corresponding encryption header; Step S22: Based on the information contained in the encryption header, regenerate the same binary key sequence as in the encryption process using the same calculation method; Step S23: Using the newly generated chaotic binary key sequence, perform an XOR operation with the final ciphertext to restore the homomorphically encrypted ciphertext; Step S24: Use the corresponding Paillier private key to decrypt the restored homomorphic encrypted ciphertext to obtain the original data fragments; Step S25: Divide all the decrypted original data into fragments, reassemble them in the original order of the data fragments, and place the reassembled data in the correct position according to the metadata information of the data fragments, so as to finally recover the complete original data.

[0033] In this way, data storage decisions are dynamically combined with the data encryption process and the data's own attributes to achieve storage optimization and security. Further encryption enhances data security and computational compatibility.

[0034] It supports encrypted computation (homogeneous properties), is suitable for cloud computing environments, enhances randomness through re-encryption, resists statistical analysis attacks, and improves encryption throughput through parallel computing and GPU acceleration.

[0035] This provides an efficient, self-contained decryption mechanism that separates key management from data storage. The encryption header is essentially an instruction manual for decrypting this complex lock (data after double encryption). It does not contain the final key itself, but only the initial parameters for generating the final key and the number of iterations. This allows the system to complete decryption securely and efficiently by simply transmitting the small encryption header, without needing to store and transmit a large and highly sensitive final key sequence.

[0036] Step S3 includes: Each user is mapped to a pre-input user role set through a first pseudo-random function. When a user who needs to access data makes a request, a temporary key is dynamically generated for each user. The permission set derived from the user role in the user role set corresponding to each user is bound to the temporary key point-to-point through a second pseudo-random function. The binding result is encapsulated into the original data and encrypted in the access token after digital signature. Users perform data decryption and access operations using temporary keys bound to their permissions; The user presents an access token to the original data node. After verifying the token's signature, the original data node extracts the permission information bound to the verification token and confirms that the user's requested operation is within the scope of permissions. After successful verification, the user decrypts and accesses the data using a temporary key.

[0037] The output of the first pseudo-random function deterministically maps a user to a specified role in a preset set of user roles. The temporary key is unique and has an expiration time. The binding operation performed by the second pseudo-random function is functionally equivalent to the inverse function mapping, that is, it creates a security association that can only unlock the corresponding permissions by using the specific temporary key. This mechanism avoids security risks caused by static permission configuration or static key leakage by strongly binding permissions to dynamic, one-time keys, and supports secure collaboration between distributed nodes.

[0038] It achieves dynamic, one-time, and granular access control. This permission-temporary key strong binding mechanism abandons traditional static passwords or long-term valid API keys. Each access uses a time-limited key generated for a specific operation. Even if the temporary key is leaked, its impact scope and time are extremely limited, greatly reducing the security risks caused by credential leakage, which is very much in line with the idea of ​​zero-trust security architecture.

[0039] Step S4 includes: Identify the identity data and process data in the original data separately. Identity data includes user certificates, user IDs, user roles, and user permissions, while process data includes transaction records, key exchange records, access logs, approval records, and workflow records. Digital signatures for identity data are generated using the national cryptographic SM2 algorithm and encapsulated in Extensible Markup Language (Extreme Markup Language) format for verification. Calculate the hash value of the standard time-slice mapping of the process data, construct a Merkle hash tree from the hash value, and use the root hash value of the Merkle hash tree as the verification basis to verify the original data.

[0040] Data integrity and uniqueness are ensured through multiple verification mechanisms. The dual verification mechanism (Merkle tree + XML signature) enhances data integrity, and the anti-replay mechanism avoids storage redundancy and malicious data injection.

[0041] When storing raw data, a storage authentication code is calculated on the raw data. The calculation process includes: The re-encryption time-dynamic allocation key is XORed with the preset first operation parameter to calculate the hash value, resulting in the first hash storage authentication code. The re-encryption time-dynamic allocation key is XORed with the preset second operation parameter to calculate the hash value, resulting in the second hash storage authentication code. The first hash storage authentication code, the second hash storage authentication code, and the data content after secondary encryption are concatenated to obtain the third hash storage authentication code. The third hash storage authentication code is checked for duplicates. If the third hash storage authentication code already exists, storage is rejected.

[0042] This ensures the uniqueness of stored data, effectively preventing replay attacks and data redundancy. By generating a unique fingerprint (storage authentication code) for each encrypted data block, the system can quickly determine whether the data already exists before writing it. If it exists, storage is rejected. This not only saves storage space, but more importantly, it prevents attackers from consuming system resources or achieving malicious purposes by repeatedly sending legitimate data packets (replay attacks).

[0043] Step S5 includes: Based on the sensitivity category of the original data, a dynamic redundancy storage strategy is applied to the data fragments after secondary encryption. The dynamic redundancy storage strategy specifically includes: When the standard time-slice mapping of the original data corresponds to the first sensitive dataset, a multi-replica combined erasure coding storage mechanism is automatically triggered. The storage mechanism includes: copying the data after secondary encryption to generate a first replica, a second replica, and a third replica, and distributing the first replica, the second replica, and the third replica in several physically or logically isolated storage addresses; performing erasure coding algorithm calculations on the original plaintext of the standard time-slice mapping in parallel to generate several redundant check fragments; and storing the redundant check fragments in storage addresses different from the first replica, the second replica, and the third replica. The purpose is that when multiple data replicas are lost or damaged at the same time, the complete original data can be calculated and recovered from the remaining replicas and check fragments. When the standard time-sharded mapping of the original data corresponds to the third sensitive dataset, a storage mechanism combining single replica and cross-region synchronization is triggered. The storage mechanism includes: copying the data after secondary encryption to obtain a fourth replica, writing the fourth replica into the highest priority response execution queue, and copying the changes of the fourth replica to several standby areas with different addresses in near real-time by executing the cross-region synchronization process. This mechanism ensures that in the event of a catastrophic failure in the primary area, it can quickly switch to the standby area, thereby achieving disaster recovery backup of the data while ensuring low latency. The specific implementation process of accelerating the secondary encryption processing calculation in step S2 by utilizing the parallel computing capabilities of the graphics processing unit (GPU) includes: Step S51: Combine several initial time-dynamically allocated keys to be encrypted into a dataset to be encrypted, and transfer the dataset to be encrypted as a whole from the main memory RAM controlled by the central processing unit (CPU) to the global video memory VRAM dedicated to the graphics processing unit (GPU) via a high-speed bus. Step S52: The central processing unit (CPU) sends an instruction to the graphics processing unit (GPU) to perform secondary encryption processing on the initial time dynamically allocated key in the dataset to be encrypted for the second time in step S2. Step S53: After receiving the instruction, the streaming multiprocessor of the graphics processing unit (GPU) creates several threads to execute in parallel. Each thread is independently assigned to process an initial time dynamically allocated key in the dataset. All threads utilize the GPU's Single Instruction Multithreaded (SIMT) architecture to synchronously and in parallel execute each step of the secondary encryption operation. This means that within one clock cycle, the same step of mathematical calculation for a massive number of keys can be completed simultaneously, thereby greatly shortening the overall encryption time. Step S54: After all threads have completed the preset number of iterations, a result dataset including all re-encryption time-dynamically allocated keys is obtained. This result dataset is transferred from the GPU's video memory back to the CPU's main memory. Upon receiving these results, the CPU continues with subsequent quantization and file encryption steps. Through this process, the computationally intensive encryption task, which originally required sequential execution, is efficiently parallelized, significantly improving the overall system's data processing throughput.

[0044] High availability and high performance are achieved through dynamic redundancy and parallel processing. Adaptive redundancy reduces storage overhead, while parallel computing and retrieval improve system response speed.

[0045] A balance between high availability, high performance, and cost-effectiveness is achieved. The most sensitive data employs the highest level of disaster recovery using multiple replicas and erasure coding, while publicly available data utilizes a lower-cost single replica and cross-regional synchronization. This enables on-demand resource allocation, avoiding resource waste or insufficient protection caused by a one-size-fits-all approach. The computationally intensive secondary encryption task is offloaded from the CPU to GPUs with thousands of cores for parallel processing, transforming the originally time-consuming serial computation into efficient parallel computation. This significantly improves the system's encryption throughput, resolves the performance bottleneck caused by strong encryption, and makes the entire solution feasible for practical applications.

[0046] A system for constructing a trusted and secure digital storage space, the system being used to execute a method for constructing a trusted and secure digital storage space, including a spatiotemporal sharding module, a secondary encryption module, an access control module, a storage authentication module, and an optimization module: The spatiotemporal sharding module includes extracting the raw data input by the user, performing dynamic sharding mapping on the raw data to obtain a standard time sharding mapping, and generating an initial dynamic allocation key based on the standard time sharding mapping; The secondary encryption module includes performing secondary encryption on the initial time-dynamically allocated key to obtain the re-encrypted time-dynamically allocated key; The access control module includes access control for data access behavior based on user roles and dynamically generated temporary keys; The storage authentication module includes performing layered verification on encrypted data fragments, storing them in distributed storage nodes after successful verification, and calculating storage authentication codes. The optimization module includes a dynamic redundancy storage strategy based on the data sensitivity categories of the original data, and accelerates the secondary encryption processing calculation process by leveraging the parallel computing capabilities of the graphics processing unit (GPU).

[0047] The security strategy presented in this application is not static and fixed, but rather dynamic. From data sharding, key generation, access control to redundant storage, each step is dynamically linked to the spatiotemporal attributes and sensitivity of the data itself. Compared to traditional storage systems, it can provide appropriate protection for data of different values, achieving optimal allocation of security resources. This avoids resource waste caused by over-protection of non-sensitive data while ensuring the highest level of security for core data. It innovatively uses the spatiotemporal metadata of the data as the seed for the initial key, achieving one key per number. Then, the initial key is further encrypted through spatiotemporal transformation mapping to generate the final key. This design makes the key both context-dependent and possesses extremely high complexity and randomness, constructing a double security barrier. While designing a computationally intensive strong encryption algorithm (secondary encryption), it proactively introduces GPU parallel computing to address its performance bottleneck. This demonstrates a profound understanding of the practicality of the technical solution. Instead of sacrificing availability in pursuit of theoretically absolute security, it successfully combines ultimate security with high processing performance through heterogeneous computing (CPU+GPU), enabling the solution to handle large-scale, high-concurrency real-world application scenarios. By protecting data security from different dimensions, it constructs a defense-in-depth system. Even if a single layer of defense is breached, other layers can still provide protection, greatly improving the overall robustness of the system.

[0048] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0049] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for constructing a trusted and secure digital storage space, characterized in that, Includes the following steps: Step S1: Extract the raw data input by the user, perform dynamic fragmentation mapping on the raw data to obtain the standard time fragmentation mapping, and generate the initial dynamic allocation key based on the standard time fragmentation mapping; Step S2: Perform secondary encryption on the initial time-dynamically allocated key to obtain the re-encrypted time-dynamically allocated key; Step S3: Based on user roles and dynamically generated temporary keys, implement access control for data access behavior; Step S4: Perform layered verification on the encrypted data fragments, and store them in the distributed storage nodes after successful verification, and calculate the storage authentication code; Step S5: Implement a dynamic redundancy storage strategy based on the data sensitivity category of the original data, and accelerate the secondary encryption processing calculation process in Step S2 by leveraging the parallel computing capabilities of the graphics processing unit (GPU).

2. The method for constructing a trusted and secure digital storage space as described in claim 1, characterized in that, Step S1 includes: The raw data includes generation time, geographical location, and sensitive categories. The sensitive categories are divided into a first sensitive dataset, a second sensitive dataset, and a third sensitive dataset. The first sensitive dataset includes user identity and privacy information, authentication and control information, and core business information. The second sensitive dataset includes internal business and process data, user operation logs, device IDs without specific identity information, and employee IDs and positions of internal employees. The third sensitive dataset includes public information. The process of calculating the spatiotemporal partitioning intervals of the original data includes: The original data is labeled with data items, timestamps, and spatial coordinates. The spatial coordinates include the address storage space size of the original data and the pointer coordinates of the original data. The time and space of the original data are dynamically segmented and mapped.

3. The method for constructing a trusted and secure digital storage space as described in claim 1, characterized in that, The dynamic fragmentation mapping includes: Subtract the time slice of the data corresponding to the longest time period in the original data from the time slice of the data corresponding to the shortest time period in the original data to obtain the first time slice. Subtract the time slice of the original data from the time slice of the smallest unit of data corresponding to the storage address of the current original data to obtain the second time slice. Compare the first time slice with the second time slice to obtain the standard time slice mapping. The standard time-slice mapping is stored at an address, and the stored address is used as a data key. The data key is then mapped using a pseudo-random function to generate a unique subkey. The unique subkeys are distributed to the original data of the corresponding time slices to obtain the initial time-dynamic allocation key of the original data.

4. The method for constructing a trusted and secure digital storage space as described in claim 1, characterized in that, Step S2 includes: Secondary encryption specifically includes: The original data is sorted according to the timestamp order, and the initial time dynamic allocation key corresponding to the original data is extracted and stored in the sequential queue. The head node of the current sequential queue is initialized to the value of the next node multiplied by the current preset random number minus one, plus the cosine function and the remainder after dividing by 1. The independent variable of the cosine function is the result of 4 multiplied by the inverse cosine function, and the independent variable of the inverse cosine function is the value of the current head node. The initial time-dynamically allocated key is based on a sequential queue, and iterative encryption operations are performed using the calculation steps of the head node to obtain the re-encryption time-dynamically allocated key.

5. The method for constructing a trusted and secure digital storage space as described in claim 1, characterized in that, Step S2 further includes generating an encryption header, the generation process of which includes: The re-encryption time-dynamically allocated key sequence is quantized. The quantization process includes converting the re-encryption time-dynamically allocated key into binary to obtain a re-encryption binary ciphertext sequence, performing a bitwise XOR operation on the re-encryption binary ciphertext sequence, and storing the initial time-dynamically allocated key sequence value and the number of iterations in the head node of the sequential queue to form an encryption header. The encryption header is used to regenerate the binary key sequence corresponding to the original data during decryption.

6. The method for constructing a trusted and secure digital storage space as described in claim 1, characterized in that, Step S3 includes: Each user is mapped to a pre-input user role set through a first pseudo-random function. When a user who needs to access data makes a request, a temporary key is dynamically generated for each user. The permission set derived from the user role in the user role set corresponding to each user is bound to the temporary key point-to-point through a second pseudo-random function. The binding result is encapsulated into the original data and encrypted in the access token after digital signature. Users perform data decryption and access operations using temporary keys bound to their permissions; The user presents an access token to the original data node. After verifying the token's signature, the original data node extracts the permission information bound to the verification token and confirms that the user's requested operation is within the scope of permissions. After successful verification, the user decrypts and accesses the data using a temporary key.

7. The method for constructing a trusted and secure digital storage space as described in claim 1, characterized in that, Step S4 includes: Identify the identity data and process data in the original data respectively. The identity data includes user certificates, user IDs, user roles and user permissions, while the process data includes transaction records, key exchange records, access logs, approval records and transfer records. Digital signatures for identity data are generated using the national cryptographic SM2 algorithm and encapsulated in Extensible Markup Language (Extreme Markup Language) format for verification. Calculate the hash value of the standard time-slice mapping of the process data, construct a Merkle hash tree from the hash value, and use the root hash value of the Merkle hash tree as the verification basis to verify the original data.

8. The method for constructing a trusted and secure digital storage space as described in claim 1, characterized in that, When storing raw data, a storage authentication code is calculated on the raw data. The calculation process includes: The re-encryption time-dynamic allocation key is XORed with a preset first operation parameter to calculate a hash value, resulting in a first hash storage authentication code. The re-encryption time-dynamic allocation key is XORed with a preset second operation parameter to calculate a hash value, resulting in a second hash storage authentication code. The first hash storage authentication code, the second hash storage authentication code, and the data content after secondary encryption are concatenated to obtain a third hash storage authentication code. The third hash storage authentication code is then subjected to a duplicate check. If the third hash storage authentication code already exists, storage is rejected.

9. The method for constructing a trusted and secure digital storage space as described in claim 1, characterized in that, Step S5 includes: Based on the sensitivity category of the original data, a dynamic redundancy storage strategy is applied to the data fragments after secondary encryption. The dynamic redundancy storage strategy specifically includes: When the standard time-slice mapping of the original data corresponds to the first sensitive dataset, a multi-replica combined erasure coding storage mechanism is automatically triggered. The storage mechanism includes: copying the data after secondary encryption to generate a first replica, a second replica, and a third replica, and distributing the first replica, the second replica, and the third replica in several physically or logically isolated storage addresses; performing erasure coding algorithm calculations on the original plaintext of the standard time-slice mapping in parallel to generate several redundant check fragments; and storing the redundant check fragments in storage addresses different from those of the first replica, the second replica, and the third replica. When the standard time-slice mapping of the original data corresponds to the third sensitive dataset, a storage mechanism combining single replica and cross-region synchronization is triggered. The storage mechanism includes: copying the data after secondary encryption to obtain a fourth replica, writing the fourth replica into the highest priority response execution queue, and copying the changes of the fourth replica to several standby areas with different addresses in a near real-time manner by executing the cross-region synchronization process. The specific implementation process of accelerating the secondary encryption processing calculation in step S2 by utilizing the parallel computing capabilities of the graphics processing unit (GPU) includes: Step S51: Combine several initial time-dynamically allocated keys to be encrypted into a dataset to be encrypted, and transfer the dataset to be encrypted as a whole from the main memory RAM controlled by the central processing unit (CPU) to the global video memory VRAM dedicated to the graphics processing unit (GPU) via a high-speed bus. Step S52: The central processing unit (CPU) sends an instruction to the graphics processing unit (GPU) to perform secondary encryption processing on the initial time dynamically allocated key in the dataset to be encrypted for the second time in step S2. Step S53: After receiving the instruction, the streaming multiprocessor of the graphics processing unit (GPU) creates several threads for parallel execution. Each thread is independently assigned to process an initial time dynamically allocated key in the dataset. All threads utilize the GPU's Single Instruction Multithreaded (SIMT) architecture to synchronously and in parallel execute each step of the secondary encryption operation. Step S54: After all threads have completed the preset number of iterations, a result dataset including all re-encryption time-dynamic allocation keys is obtained. The result dataset of the re-encryption time-dynamic allocation keys is transferred from the GPU's video memory to the CPU's main memory. After receiving these results, the CPU continues to execute subsequent quantization processing and file encryption steps.

10. A system for constructing a trusted and secure digital storage space, the system being used to execute a method for constructing a trusted and secure digital storage space, characterized in that, It includes a spatiotemporal sharding module, a secondary encryption module, an access control module, a storage authentication module, and an optimization module: The spatiotemporal sharding module includes extracting the raw data input by the user, performing dynamic sharding mapping on the raw data to obtain a standard time sharding mapping, and generating an initial dynamic allocation key based on the standard time sharding mapping; The secondary encryption module includes performing secondary encryption on the initial time-dynamically allocated key to obtain the re-encrypted time-dynamically allocated key; The access control module includes access control for data access behavior based on user roles and dynamically generated temporary keys; The storage authentication module includes performing layered verification on encrypted data fragments, storing them in distributed storage nodes after successful verification, and calculating storage authentication codes. The optimization module includes a dynamic redundancy storage strategy based on the data sensitivity categories of the original data, and accelerates the secondary encryption processing calculation process by leveraging the parallel computing capabilities of the graphics processing unit (GPU).

Images