A system and method for constructing a trusted secure digital storage space

Abstract

The application discloses a system and method for constructing a trusted secure digital storage space, and relates to the technical field of secure data storage, which comprises the following steps: performing dynamic sharding mapping on original data to generate an initial time dynamic allocation key; performing secondary encryption on the initial time dynamic allocation key to obtain a re-encrypted time dynamic allocation key; performing permission control on data access behavior according to a user role and a temporarily generated key; performing layered verification on encrypted data sharding to calculate a storage authentication code; and performing a dynamic redundant storage strategy according to a data sensitive category of the original data to accelerate a secondary encryption processing calculation process. The application integrates dynamic sharding, layered encryption, dynamic access control, layered verification and self-recovery disaster recovery technology systematically to construct a comprehensive data security protection framework and provides a complete, operable, safe and efficient method + technical implementation.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of secure data storage, and in particular to a system and method for constructing a trusted secure digital storage space. BACKGROUND

[0002] Traditional centralized storage solutions, such as cloud storage, face serious security risks such as single point of failure, data leakage, and malicious tampering. Although distributed storage technology solves the problem of single point of failure, how to ensure the confidentiality, integrity, availability of data among untrusted distributed nodes and implement flexible access control is still the focus and difficulty of current research.

[0003] At present, the Chinese invention patent with application number CN202410544273.6 discloses a secure data management system based on space-time encryption, which comprises the following steps: constructing a three-dimensional virtual storage space; acquiring stream data in real time, dividing the stream data into a plurality of to-be-stored data packets, constructing a stream data storage time sequence; constructing a space allocation storage function, generating a random number sequence based on the stream data storage time sequence, dividing the three-dimensional virtual storage space into a plurality of storage units, and generating a storage unit use order table based on the random number sequence; storing each to-be-stored data packet according to the stream data storage time sequence and the storage unit use order table, and constructing and storing a storage space information table. The application determines the storage location of data based on the space allocation storage function, and when physical data storage is performed, the storage data in the virtual space is mapped into the physical storage space, the data is disturbed, the data security is ensured, and the data storage speed is improved. However, the existing technology always focuses on solving a single aspect, and lacks a comprehensive solution that systematically integrates data sharding, multi-layer encryption, dynamic access control, integrity verification, and disaster recovery. In particular, for multi-source heterogeneous and highly sensitive data such as education archives, meteorological observation data, and power grid monitoring data, the existing methods are difficult to achieve an ideal balance between security, efficiency, and flexibility, and the existing technology cannot dynamically adapt to different data characteristics and cannot provide end-to-end security protection while considering storage efficiency and system performance. SUMMARY

[0004] The technical problem solved by the present application is that the existing technology always focuses on solving a single aspect, and lacks a comprehensive solution that systematically integrates data sharding, multi-layer encryption, dynamic access control, integrity verification, and disaster recovery. In particular, for multi-source heterogeneous and highly sensitive data such as education archives, meteorological observation data, and power grid monitoring data, the existing methods are difficult to achieve an ideal balance between security, efficiency, and flexibility, and the existing technology cannot dynamically adapt to different data characteristics and cannot provide end-to-end security protection while considering storage efficiency and system performance.

[0005] To solve the above technical problems, the present application provides the following technical solutions: a method for constructing a trusted secure digital storage space, comprising the following steps:

[0006] Step S1: extracting the original data input by the user, performing dynamic slice mapping on the original data to obtain a standard time slice mapping, and generating an initial time dynamic allocation key based on the standard time slice mapping;

[0007] Step S2: performing secondary encryption on the initial time dynamic allocation key to obtain a re-encrypted time dynamic allocation key;

[0008] Step S3: performing permission control on data access behavior according to the user role and the temporarily generated key;

[0009] Step S4: performing hierarchical verification on the encrypted data slices, and storing them in the distributed storage node after verification, and calculating the storage authentication code;

[0010] Step S5: performing a dynamic redundant storage strategy according to the data sensitivity category of the original data, and accelerating the secondary encryption processing calculation process of step S2 through the parallel computing capability of the graphics processing unit (GPU).

[0011] Preferably, the step S1 comprises:

[0012] The original data includes generation time, geographic location and sensitive category, and the sensitive category is divided into a first sensitive data set, a second sensitive data set and a third sensitive data set, the first sensitive data set includes user identity and privacy information, authentication and control information and core business information, the second sensitive data set includes internal business and process data, user operation logs, device ID without specific identity information and internal employee work number and position, and the third sensitive data set includes public information.

[0013] The time-space slice interval of the original data is calculated, and the process of calculating the time-space slice interval comprises:

[0014] The original data is marked with data items, time stamps and space coordinates, the space coordinates include the address storage space size of the original data and the pointer coordinates of the original data, and dynamic slice mapping is performed based on the time stamps and space coordinates of the original data.

[0015] Preferably, the dynamic slice mapping comprises:

[0016] The time slice of the data corresponding to the longest time period in the original data is subtracted from the time slice of the data corresponding to the shortest time period in the original data to obtain a first time slice, the time slice of the data in the original data is subtracted from the time slice of the smallest unit of data corresponding to the storage address of the current original data to obtain a second time slice, and the first time slice is compared with the second time slice to obtain a standard time slice mapping.

[0017] storing the address as a data key, performing a pseudo-random function mapping on the data key, and generating a unique sub-key;

[0018] distributing the unique sub-key to the original data of the corresponding time slice respectively, and obtaining an initial time dynamic allocation key of the original data.

[0019] Preferably, the step S2 comprises:

[0020] The secondary encryption specifically comprises:

[0021] sorting the original data in the order of timestamps, extracting the initial time dynamic allocation key corresponding to the original data, and storing the initial time dynamic allocation key in a sequential queue, initializing a head node of the current sequential queue as a value of a next node multiplied by a preset random number minus one, taking a remainder of 1 after a cosine function, wherein an argument of the cosine function is a result of an inverse cosine function, and an argument of the inverse cosine function is a value of the current head node;

[0022] iteratively encrypting the initial time dynamic allocation key based on the sequential queue according to the calculation step of the head node to obtain a re-encrypted time dynamic allocation key.

[0023] Preferably, the step S2 further comprises generating an encryption header, and a generation process of the encryption header comprises:

[0024] quantizing the re-encrypted time dynamic allocation key sequence, and the quantization processing comprises: performing binary conversion on the re-encrypted time dynamic allocation key to obtain a re-encrypted binary ciphertext sequence, performing an exclusive OR operation on the re-encrypted binary ciphertext sequence bit by bit, and storing a value of the initial time dynamic allocation key sequence and a number of iterations in a head node of the sequential queue to form the encryption header;

[0025] The encryption header is used to regenerate the binary key sequence of the corresponding original data during decryption.

[0026] Preferably, the step S3 comprises:

[0027] mapping each user to a pre-input user role set through a first pseudo-random function, dynamically generating a temporary key for each user when a user who needs to access data initiates a request, deriving a permission set of a user role in the user role set corresponding to each user through a second pseudo-random function, and point-to-point binding the permission set and the temporary key, encapsulating the binding result into the original data, and encrypting the access token after digital signature;

[0028] The user performs decryption and access operations on the data through the temporary key with the bound permission.

[0029] The user presents an access token to the original data node, the original data node verifies the signature of the token, extracts the permission information bound in the verification token, and confirms that the operation requested by the user is within the permission range, and after verification, the user decrypts and accesses the data through the temporary key.

[0030] Preferably, the step S4 comprises:

[0031] The identity data and process data in the original data are identified respectively, the identity data includes user certificate, user ID, user role and user permission, and the process data includes transaction record, key exchange record, access log, approval record and flow record;

[0032] The digital signature of the identity data is generated by the national secret SM2 algorithm, and is packaged into an extensible markup language format for verification;

[0033] The hash value of the standard time slice mapping of the process data is calculated, and the hash value is constructed into a Merkle hash tree, and the root hash value of the Merkle hash tree is used as the basis for verification of the original data.

[0034] Preferably, when storing the original data, the original data is calculated for storage authentication code, and the calculation process comprises:

[0035] The re-encryption time dynamic allocation key is XORed with the preset first operation parameter to calculate the hash value, and the first hash storage authentication code is obtained, the re-encryption time dynamic allocation key is XORed with the preset second operation parameter to calculate the hash value, and the second hash storage authentication code is obtained, the first hash storage authentication code, the second hash storage authentication code and the data content after secondary encryption are spliced to obtain the third hash storage authentication code, and the third hash storage authentication code is subjected to repetitive inspection, and when the third hash storage authentication code exists, the storage is refused.

[0036] Preferably, the step S5 comprises:

[0037] According to the sensitive category of the original data, the dynamic redundant storage strategy is executed on the data slice after secondary encryption, and the dynamic redundant storage strategy specifically comprises:

[0038] When the standard time slice mapping of the original data corresponds to the first sensitive data set, the storage mechanism of multiple copies combined with erasure code is automatically triggered, and the storage mechanism includes: generating a first copy, a second copy and a third copy by copying the twice-encrypted data, and storing the first copy, the second copy and the third copy in a plurality of storage addresses which are physically or logically isolated from each other; and performing erasure code algorithm calculation on the original plaintext of the standard time slice mapping in parallel to generate a plurality of redundant check slices, and storing the redundant check slices in storage addresses different from those of the first copy, the second copy and the third copy.

[0039] When the standard time slice mapping of the original data corresponds to the third sensitive data set, the storage mechanism of single copy combined with cross-region synchronization is triggered, and the storage mechanism includes: copying the twice-encrypted data to obtain a fourth copy, and writing the fourth copy into a response execution queue with the highest priority; and changing the fourth copy to be copied to a plurality of address different backup areas in a quasi-real-time manner by executing a cross-region synchronization process.

[0040] The specific implementation process of accelerating the secondary encryption processing and calculation process of step S2 by using the parallel computing capability of the graphics processor GPU includes:

[0041] Step S51: a plurality of initial time dynamic allocation keys to be subjected to secondary encryption processing are combined into a secondary encryption data set, and the secondary encryption data set is transmitted from the main memory RAM controlled by the central processing unit CPU to the global video memory VRAM dedicated to the graphics processor GPU through the high-speed bus as a whole.

[0042] Step S52: the central processing unit CPU issues an instruction to the graphics processor GPU to perform the secondary encryption processing of step S2 on the initial time dynamic allocation keys in the secondary encryption data set.

[0043] Step S53: after receiving the instruction, the streaming multiprocessor of the graphics processor GPU creates a plurality of threads for parallel execution, wherein each thread is independently assigned to process an initial time dynamic allocation key in the data set, and all threads use the single instruction multiple thread SIMT architecture of the graphics processor GPU to synchronously and in parallel execute each step of the secondary encryption operation.

[0044] Step S54: when all threads have completed a predetermined number of iteration calculations, a result data set including all re-encrypted time dynamic allocation keys is obtained, and the result data set of the re-encrypted time dynamic allocation keys is transmitted from the video memory of the graphics processor GPU back to the main memory of the central processing unit CPU, and the central processing unit CPU receives the results and then continues to perform subsequent quantization processing and file encryption steps.

[0045] A system for constructing a trusted secure digital storage space is used to execute a method for constructing a trusted secure digital storage space, comprising a space-time slicing module, a secondary encryption module, a permission control module, a storage authentication module and an optimization module:

[0046] The space-time slicing module comprises extracting user inputted original data, dynamically slicing and mapping the original data to obtain a standard time slicing mapping, and generating an initial time dynamic allocation key based on the standard time slicing mapping;

[0047] The secondary encryption module comprises secondary encryption of the initial time dynamic allocation key to obtain a re-encrypted time dynamic allocation key;

[0048] The permission control module comprises permission control of data access behavior according to user roles and dynamically generated temporary keys;

[0049] The storage authentication module comprises hierarchical verification of encrypted data slices, and storage in a distributed storage node after verification, and calculation of a storage authentication code;

[0050] The optimization module comprises dynamic redundant storage strategy according to data sensitive categories of original data, and secondary encryption processing calculation process accelerated by parallel computing capability of a graphics processing unit (GPU).

[0051] The application has the following advantages: The entire security strategy of the application is not static and fixed, but alive. From data slicing, key generation, access control to redundant storage, each step is dynamically associated with the space-time properties and sensitivity of the data itself. Compared with traditional storage systems, it can provide appropriate protection for data of different values, realize the optimal allocation of security resources, avoid the waste of resources caused by excessive protection of non-sensitive data, and ensure that core data is protected at the highest level. Creatively, the space-time metadata of the data is used as the seed of the initial key, realizing one key for one number. Then, the initial key is secondary encrypted through space-time conversion mapping to generate the final key. This design makes the key have context relevance, high complexity and randomness, and builds a double security barrier. While designing a computationally intensive strong encryption algorithm (secondary encryption), GPU parallel computing is introduced to solve its performance bottleneck. This reflects a deep understanding of the practicality of the technical solution. It does not sacrifice usability for absolute security in theory, but successfully combines extreme security and high processing performance through heterogeneous computing (CPU+GPU), so that the scheme can cope with large-scale and high-concurrency real application scenarios. From different dimensions, the security of data is protected, and a defense-in-depth system is constructed. If a single layer of defense is broken, other layers can still provide protection, greatly improving the overall robustness of the system. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 A basic flowchart of a method for constructing a trusted secure digital storage space is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the above objectives, features and advantages of the present application more apparent, more understandable, the specific embodiments of the present application will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments.

[0054] REFERENCE Figure 1 For an embodiment of the present application, a method for constructing a trusted secure digital storage space is provided, comprising the following steps:

[0055] Step S1: extracting the original data input by the user, performing dynamic sharding mapping on the original data to obtain a standard time sharding mapping, and generating an initial time dynamic allocation key based on the standard time sharding mapping;

[0056] Step S2: performing secondary encryption on the initial time dynamic allocation key to obtain a re-encrypted time dynamic allocation key;

[0057] Step S3: performing permission control on the data access behavior according to the user role and the temporarily generated temporary key;

[0058] Step S4: performing layered verification on the encrypted data sharding, and storing the verified data in the distributed storage node, and calculating the storage authentication code;

[0059] Step S5: performing dynamic redundant storage strategy according to the data sensitivity category of the original data, and accelerating the secondary encryption processing calculation process of step S2 through the parallel computing capability of the graphics processing unit (GPU).

[0060] The method integrates dynamic sharding, layered encryption, dynamic access control, layered verification and self-healing disaster recovery technology systematically to construct a comprehensive data security protection framework. The method has systematicity, integration and dynamics, and provides a complete, operable and efficient method+technology implementation that takes into account security and efficiency. The method seamlessly connects data perception, dynamic encryption, fine-grained permissions, efficient verification and intelligent disaster recovery, and finally constructs a trusted secure digital storage space that can actively adapt to data characteristics and security requirements.

[0061] Step S1 comprises:

[0062] The original data includes generation time, geographical location and sensitive categories, which are divided into a first sensitive data set, a second sensitive data set and a third sensitive data set. The first sensitive data set includes user identity and privacy information, authentication and control information and core business information. The second sensitive data set includes internal business and process data, user operation logs, device IDs without specific identity information and internal employee work numbers and positions. The third sensitive data set includes public information.

[0063] The time and space slice interval of the original data is calculated. The process of calculating the time and space slice interval includes:

[0064] The original data is marked with data items, timestamps and spatial coordinates. The spatial coordinates include the address storage space size of the original data and the pointer coordinates of the original data. Dynamic slice mapping is performed based on the timestamps and spatial coordinates of the original data.

[0065] The internal business and process data includes education files, medical data, power grid data and weather data.

[0066] The education files include students' ordinary grades, course attendance records and teachers' internal teaching evaluations.

[0067] The medical data includes ordinary medical records (not involving highly sensitive diseases), hospital internal scheduling information and drug inventory data.

[0068] The power grid data includes regular power grid load data, general operation logs of equipment and maintenance plans for non-critical areas.

[0069] The weather data includes intermediate calculation results of ongoing, not yet final verified weather models and internal research reports.

[0070] According to the time, space and sensitivity attributes of the data, dynamic slicing is performed to optimize security and storage efficiency.

[0071] Fine-grained and contextualized data management is achieved. By pre-classifying and attribute marking the data, it provides a basis for subsequent dynamic security policies (such as dynamic encryption and dynamic redundant storage). It turns abstract data into objects with explicit identity (sensitivity, time and space attributes), allowing the system to treat them differently, which is the basis for adaptive security.

[0072] The dynamic slice mapping includes:

[0073] Subtracting the time slice corresponding to the data of the longest time period in the original data from the time slice corresponding to the data of the shortest time period in the original data obtains a first time slice, subtracting the time slice of the smallest unit of data corresponding to the storage address of the current original data from the time slice of the original data obtains a second time slice, comparing the first time slice with the second time slice obtains a standard time slice mapping;

[0074] Storing the address of the standard time slice mapping, taking the stored address as a data key, performing pseudo-random function mapping on the data key to generate a unique sub-key;

[0075] Distributing the unique sub-key to the original data corresponding to the time slice respectively to obtain an initial time dynamic allocation key of the original data.

[0076] Avoiding storage redundancy or security risks caused by traditional fixed block, adapting to multi-source heterogeneous data such as education archives, meteorological data and power grid monitoring data.

[0077] A strong binding relationship between data spatiotemporal characteristics and initial keys is established, which means that the key is no longer a random string unrelated to data content, but is derived from the time and storage properties of the data itself. This method makes key generation deterministic and traceable, while the dynamic slicing method avoids the security vulnerabilities (such as fixed data block size vulnerable to analysis attacks) brought by traditional fixed block, improving security and storage efficiency.

[0078] Step S2 includes:

[0079] The secondary encryption specifically includes:

[0080] Sorting the original data in the order of timestamps, and extracting the initial time dynamic allocation key corresponding to the original data into a sequential queue, initializing the head node of the current sequential queue as the value of the next node multiplied by the current preset random number minus one, taking the remainder of 1 after the cosine function, the argument of the cosine function being 4 times the result of the inverse cosine function, and the argument of the inverse cosine function being the value of the current head node;

[0081] Iteratively encrypting the initial time dynamic allocation key based on the sequential queue with the calculation steps of the head node to obtain a re-encrypted time dynamic allocation key.

[0082] The complexity and unpredictability of the key are greatly enhanced. Although the initial key is related to the data properties, there may still be some regularity, the introduction of nonlinearity and pseudo-randomness makes it almost impossible to deduce the final re-encrypted key from the initial key or data, effectively resisting password analysis and statistical attacks, and significantly improving the encryption strength.

[0083] Step S2 also includes generating an encryption header, and the generation process of the encryption header includes:

[0084] Quantization processing is performed on the re-encryption time dynamic allocation key sequence, and the quantization processing includes: binary conversion of the re-encryption time dynamic allocation key to obtain a re-encryption binary ciphertext sequence, performing an exclusive OR operation on the re-encryption binary ciphertext sequence bit by bit, and storing the initial time dynamic allocation key sequence value and the number of iterations calculated into the head node of the order queue to form an encryption header;

[0085] The encryption header is used to regenerate the binary key sequence corresponding to the original data during decryption.

[0086] The encryption header itself also needs to be stored or transmitted in a secure manner (for example, encrypted using the public key of the data receiver) so as to be used in the subsequent data decryption process.

[0087] Even if the inner homomorphic encryption is cracked, the attacker still needs to crack the re-encryption to obtain the original plaintext data, which can effectively resist cracking attempts on the data through statistical analysis and conventional attack means. The calculation process of the chaotic mapping is efficient, and combined with the parallel computing capability of the graphics processor, the data processing throughput in the data encryption process can be guaranteed to meet the efficiency requirements in actual applications.

[0088] The decryption steps are as follows:

[0089] Step S21: When an authorized user needs to access the data, first obtain the corresponding encryption header;

[0090] Step S22: According to the information contained in the encryption header, regenerate the binary key sequence consistent with the encryption process according to the same calculation method;

[0091] Step S23: Use the regenerated chaotic binary key sequence to perform an exclusive OR operation with the final ciphertext to restore the homomorphic encrypted ciphertext;

[0092] Step S24: Use the corresponding Paillier private key to decrypt the restored homomorphic encrypted ciphertext to obtain the original data fragments;

[0093] Step S25: Reorganize all the original data fragments obtained after decryption according to the original order of the data fragments, and place the reorganized data in the correct position according to the metadata information of the data fragments, and finally restore the complete original data.

[0094] In this way, the data storage decision is dynamically combined with the data encryption process and the data itself attributes to realize the optimization and security of storage. The data security and computing compatibility are improved through re-encryption.

[0095] It supports encrypted computation (homogeneous properties), is suitable for cloud computing environments, enhances randomness through re-encryption, resists statistical analysis attacks, and improves encryption throughput through parallel computing and GPU acceleration.

[0096] This provides an efficient, self-contained decryption mechanism that separates key management from data storage. The encryption header is essentially an instruction manual for decrypting this complex lock (data after double encryption). It does not contain the final key itself, but only the initial parameters for generating the final key and the number of iterations. This allows the system to complete decryption securely and efficiently by simply transmitting the small encryption header, without needing to store and transmit a large and highly sensitive final key sequence.

[0097] Step S3 includes:

[0098] Each user is mapped to a pre-input user role set through a first pseudo-random function. When a user who needs to access data makes a request, a temporary key is dynamically generated for each user. The permission set derived from the user role in the user role set corresponding to each user is bound to the temporary key point-to-point through a second pseudo-random function. The binding result is encapsulated into the original data and encrypted in the access token after digital signature.

[0099] Users perform data decryption and access operations using temporary keys bound to their permissions;

[0100] The user presents an access token to the original data node. After verifying the token's signature, the original data node extracts the permission information bound to the verification token and confirms that the user's requested operation is within the scope of permissions. After successful verification, the user decrypts and accesses the data using a temporary key.

[0101] The output of the first pseudo-random function deterministically maps a user to a specified role in a preset set of user roles. The temporary key is unique and has an expiration time. The binding operation performed by the second pseudo-random function is functionally equivalent to the inverse function mapping, that is, it creates a security association that can only unlock the corresponding permissions by using the specific temporary key.

[0102] This mechanism avoids security risks caused by static permission configuration or static key leakage by strongly binding permissions to dynamic, one-time keys, and supports secure collaboration between distributed nodes.

[0103] The dynamic, one-time and fine-grained access control is realized. The permission-temporary key strong binding mechanism discards the traditional static password or long-term effective API key. Each access uses a time-limited key generated for a specific operation. Even if the temporary key is leaked, the scope and time of the impact are extremely limited, greatly reducing the security risk caused by credential leakage, and very consistent with the idea of zero trust security architecture.

[0104] Step S4 includes:

[0105] The identity data and process data in the original data are identified respectively, the identity data includes user certificate, user ID, user role and user permission, and the process data includes transaction record, key exchange record, access log, approval record and flow record;

[0106] A digital signature of the identity data is generated by using the national SM2 algorithm, and is packaged in an extensible markup language format for verification;

[0107] The hash value of the standard time slice mapping of the process data is calculated, and the hash value is constructed into a Merkle hash tree, and the root hash value of the Merkle hash tree is taken as a verification basis to verify the original data.

[0108] The data integrity and uniqueness are ensured by the multiple verification mechanisms, the double verification mechanism (Merkle tree + XML signature) improves the data integrity, and the anti-replay mechanism avoids storage redundancy and malicious data injection.

[0109] When the original data is stored, a storage authentication code of the original data is calculated, and the calculation process includes:

[0110] The hash value is calculated after the re-encryption time dynamic allocation key is subjected to an exclusive OR operation with a preset first operation parameter to obtain a first hash storage authentication code, the hash value is calculated after the re-encryption time dynamic allocation key is subjected to an exclusive OR operation with a preset second operation parameter to obtain a second hash storage authentication code, the first hash storage authentication code, the second hash storage authentication code and the data content subjected to secondary encryption are spliced to obtain a third hash storage authentication code, and the third hash storage authentication code is subjected to repetitive inspection, and when the third hash storage authentication code already exists, the storage is rejected.

[0111] The uniqueness of the stored data is ensured, and the replay attack and data redundancy are effectively prevented. By generating a unique fingerprint (storage authentication code) for each encrypted data block, the system can quickly judge whether the data already exists before data writing. If it exists, the storage is rejected. This not only saves the storage space, but more importantly, can prevent attackers from consuming system resources or achieving malicious purposes by repeatedly sending legitimate data packets (replay attack).

[0112] Step S5 comprises:

[0113] According to the sensitive category of the original data, a dynamic redundant storage strategy is performed on the secondary encrypted data fragments, and the dynamic redundant storage strategy specifically comprises:

[0114] When the standard time slice mapping of the original data corresponds to the first sensitive data set, a storage mechanism combining multiple copies and erasure code is automatically triggered, and the storage mechanism comprises: generating a first copy, a second copy and a third copy by copying the secondary encrypted data, and distributing the first copy, the second copy and the third copy in a plurality of storage addresses that are physically or logically isolated from each other; and performing erasure code algorithm calculation on the original plaintext of the standard time slice mapping in parallel to generate a plurality of redundant check fragments, and storing the redundant check fragments in storage addresses different from those of the first copy, the second copy and the third copy. The purpose is to be able to calculate and restore the complete original data through the remaining copies and check fragments when multiple data copies are lost or damaged at the same time;

[0115] When the standard time slice mapping of the original data corresponds to the third sensitive data set, a storage mechanism combining a single copy and cross-region synchronization is triggered, and the storage mechanism comprises: copying the secondary encrypted data to obtain a fourth copy, and writing the fourth copy into a highest priority response execution queue; and changing the fourth copy to be copied to a plurality of address different backup areas in a quasi-real-time manner through an execution cross-region synchronization process. This mechanism ensures that in the event of a catastrophic failure in the main area, the backup area can be quickly switched to, thereby realizing disaster backup of data while ensuring low latency;

[0116] The specific implementation process of accelerating the secondary encryption processing and calculation process of step S2 by using the parallel computing capability of a graphics processing unit (GPU) comprises:

[0117] Step S51: A plurality of initial time dynamic allocation keys to be subjected to secondary encryption processing are combined into a secondary encryption data set, and the secondary encryption data set is transmitted from a central processing unit (CPU) controlled main memory (RAM) to a graphics processing unit (GPU) dedicated global video memory (VRAM) through a high-speed bus as a whole;

[0118] Step S52: The central processing unit (CPU) issues an instruction to the graphics processing unit (GPU) to perform secondary encryption processing of the initial time dynamic allocation keys in the secondary encryption data set according to step S2;

[0119] Step S53: After the stream multiprocessor of the graphics processor GPU receives the instruction, a plurality of threads are created for parallel execution, each thread is independently allocated to process an initial time dynamic allocation key in the data set, and all threads use the single instruction multiple thread SIMT architecture of the graphics processor GPU to synchronously and in parallel execute each step of the secondary encryption operation; this means that in one clock cycle, the same step of mathematical calculation on a large number of keys can be completed at the same time, thereby greatly shortening the time required for overall encryption;

[0120] Step S54: When all threads have completed the preset number of iteration calculations, a result data set including all re-encrypted time dynamic allocation keys is obtained, the re-encrypted time dynamic allocation key result data set is transmitted from the video memory of the graphics processor GPU to the main memory of the central processing unit CPU, and after the central processing unit CPU receives the results, subsequent quantization processing and file encryption steps are continued. Through this process, the computationally intensive encryption task that needs to be executed in series is efficiently parallelized, significantly improving the data processing throughput of the entire system.

[0121] High availability and high performance are achieved through dynamic redundancy and parallel processing, adaptive redundancy reduces storage overhead, and parallel computing and retrieval improves system response speed.

[0122] A balance between high availability, high performance and cost-effectiveness is achieved. The highest level of disaster recovery is achieved by using multiple copies + erasure code for the most sensitive data, and the cost of single copy + cross-region synchronization is used for public data, which realizes on-demand allocation of resources and avoids resource waste or insufficient protection caused by one-size-fits-all strategy. The computationally intensive secondary encryption task is offloaded from the CPU to the GPU with thousands of cores for parallel processing, turning the time-consuming serial computation into efficient parallel computation, greatly improving the encryption throughput of the system, solving the performance bottleneck problem caused by strong encryption, and making the entire scheme feasible in practical applications.

[0123] A system for building a trusted and secure digital storage space, which is used to execute a method for building a trusted and secure digital storage space, comprising a space-time slicing module, a secondary encryption module, a permission control module, a storage authentication module and an optimization module:

[0124] The space-time slicing module includes extracting user input raw data, dynamically slicing and mapping the raw data to obtain a standard time slicing mapping, and generating an initial time dynamic allocation key based on the standard time slicing mapping;

[0125] The secondary encryption module includes secondary encryption of the initial time dynamic allocation key to obtain a re-encrypted time dynamic allocation key;

[0126] The permission control module includes permission control on data access behavior according to user roles and dynamically generated temporary keys.

[0127] The storage authentication module includes hierarchical verification on encrypted data fragments, and storage in a distributed storage node after verification, and calculation of a storage authentication code.

[0128] The optimization module includes dynamic redundant storage strategy according to data sensitive categories of original data, and secondary encryption processing calculation process accelerated by parallel computing capability of a graphics processing unit (GPU).

[0129] The entire security strategy of the present application is not static and fixed, but alive. From data fragmentation, key generation, access control to redundant storage, each step is dynamically associated with the spatiotemporal properties and sensitivity of the data itself. Compared with traditional storage systems, it can provide appropriate protection for data of different values, achieving optimal allocation of security resources, avoiding waste of resources caused by excessive protection of non-sensitive data, and ensuring that core data is protected at the highest level. Creatively, the spatiotemporal metadata of the data is used as the seed of the initial key, realizing one key for one number. Then, the initial key is encrypted twice through spatiotemporal conversion mapping to generate the final key. This design makes the key have context relevance, high complexity and randomness, and builds a double security barrier. While designing a computationally intensive strong encryption algorithm (secondary encryption), GPU parallel computing is introduced to solve its performance bottleneck. This reflects a deep understanding of the practicality of the technical solution. It does not sacrifice usability for absolute security in theory, but successfully combines extreme security and high processing performance through heterogeneous computing (CPU+GPU), so that the scheme can cope with large-scale and high-concurrency real application scenarios. From different dimensions, the security of the data is protected, and a defense-in-depth system is built. If a single layer of defense is broken, other layers can still provide protection, greatly improving the overall robustness of the system.

[0130] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, a system or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (or computer- readable storage media) having computer-usable program code embodied in the medium. The medium can be any available medium or combination thereof that is accessible by a general purpose or special purpose computer. By way of example, such computer-usable storage media can include a volatile memory, such as a random access memory (RAM), a non-volatile memory, such as a read-only memory (ROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a floppy diskette, a compact disk, a hard disk, or any other medium that can be used to carry or store computer-usable program code in the form of computer-usable instructions or data structures and that can be accessed by a general purpose or special purpose computer, or a general-purpose or special-purpose processor. Also, the present application can be embodied in a computer program product which can be executed in particu Figure 1 one or more functions specified in the flow or flows and / or blocks Figure 1 one or more functions specified in the flow or flows and / or blocks

[0131] It should be noted that the above-mentioned embodiments are only used to illustrate but not to limit the technical solutions of the present application. Although the present application is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalent replaced, without departing from the spirit and scope of the technical solutions of the present application, which should be covered in the scope of the claims of the present application.

Claims

1. A method of constructing a trusted secure digital storage space, characterized by, The method comprises the following steps: Step S1: extracting the original data input by the user, performing dynamic slice mapping on the original data to obtain a standard time slice mapping, and generating an initial time dynamic allocation key based on the standard time slice mapping; Step S2: performing secondary encryption on the initial time dynamic allocation key to obtain a re-encrypted time dynamic allocation key; Step S3: performing permission control on the data access behavior according to the user role and the temporarily generated key; Step S4: performing hierarchical verification on the encrypted data slice, and storing it in the distributed storage node after verification, and calculating the storage authentication code; Step S5: performing dynamic redundant storage strategy according to the data sensitivity category of the original data, and accelerating the secondary encryption processing calculation process of step S2 through the parallel computing capability of the graphics processing unit (GPU); The step S1 comprises: The original data comprises generation time, geographical position and sensitive category, and the sensitive category is divided into a first sensitive data set, a second sensitive data set and a third sensitive data set, the first sensitive data set comprises user identity and privacy information, authentication and control information and core business information, the second sensitive data set comprises internal business and process data, user operation log, device ID without specific identity information and internal employee work number and position, and the third sensitive data set comprises public information; The time and space slice interval of the original data is calculated, and the process of calculating the time and space slice interval comprises: The original data is marked with a data item, a timestamp and a space coordinate, the space coordinate comprises an address storage space size of the original data and a pointer coordinate of the original data, and dynamic slice mapping is performed based on the timestamp and the space coordinate of the original data; The dynamic slice mapping comprises: The time slice of the data corresponding to the longest time period in the original data is subtracted from the time slice of the data corresponding to the shortest time period in the original data to obtain a first time slice, the time slice of the data of the smallest unit corresponding to the storage address of the current original data is subtracted from the time slice of the original data to obtain a second time slice, and the first time slice is compared with the second time slice to obtain a standard time slice mapping; The standard time slice mapping is stored in an address, and the stored address is used as a data key, a pseudo-random function mapping is performed on the data key to generate a unique sub-key; The unique sub-key is distributed to the original data corresponding to the time slice respectively to obtain an initial time dynamic allocation key of the original data; The step S2 comprises: The secondary encryption specifically comprises: The original data is sorted according to the order of the timestamp, and the initial time dynamic allocation key corresponding to the original data is stored in a sequential queue, the head node of the current sequential queue is initialized as the value of the next node multiplied by the current preset random number minus one, plus the cosine function and then taking the remainder of 1, the argument of the cosine function is 4 times the result of the inverse cosine function, and the argument of the inverse cosine function is the value of the current head node; The initial time dynamic allocation key is iteratively encrypted based on the sequential queue and the calculation step of the head node to obtain a re-encrypted time dynamic allocation key; The step S2 further comprises generating an encryption header, and the generation process of the encryption header comprises: The re-encryption time dynamic allocation key sequence is quantized, including binary conversion of the re-encryption time dynamic allocation key to obtain a re-encryption binary ciphertext sequence, performing an exclusive OR operation on the re-encryption binary ciphertext sequence bit by bit, and storing an initial time dynamic allocation key sequence value and a number of iterations calculated into a head node of a sequential queue to form an encryption head; The encryption head is used to regenerate a binary key sequence corresponding to the original data during decryption.

2. The method of claim 1, wherein, The step S3 includes: Each user is mapped to a pre-input user role set through a first pseudo-random function, a temporary key is dynamically generated for each user when a user who needs to access data initiates a request, a permission set derived from a user role in the user role set corresponding to each user is bound to the temporary key through a second pseudo-random function, and the binding result is encapsulated into an original data and encrypted in an access token after digital signature; The user performs decryption and access operations on data through the temporary key with bound permissions; The user presents the access token to an original data node, the original data node verifies the signature of the token, extracts the permission information bound in the verification token, and confirms that the operation requested by the user is within the permission range, and after verification, the user decrypts and accesses the data through the temporary key.

3. The method of claim 2, wherein, The step S4 includes: Identity data and process data in the original data are identified respectively, the identity data includes user certificate, user ID, user role and user permission, and the process data includes transaction record, key exchange record, access log, approval record and flow record; A digital signature of the identity data is generated through a national secret SM2 algorithm, and is encapsulated into an extensible markup language format for verification; A hash value of a standard time slice mapping of the process data is calculated, and the hash value is constructed into a Merkle hash tree, and a root hash value of the Merkle hash tree is used as a verification basis to verify the original data.

4. The method of claim 3, wherein, When storing the original data, a storage authentication code of the original data is calculated, and the calculation process includes: The re-encryption time dynamic allocation key is subjected to an exclusive OR operation with a preset first operation parameter to calculate a hash value, to obtain a first hash storage authentication code, the re-encryption time dynamic allocation key is subjected to an exclusive OR operation with a preset second operation parameter to calculate a hash value, to obtain a second hash storage authentication code, the first hash storage authentication code, the second hash storage authentication code and the data content after secondary encryption are spliced to obtain a third hash storage authentication code, and the third hash storage authentication code is subjected to repetitive inspection, and when the third hash storage authentication code already exists, storage is refused.

5. The method for building a trusted secure digital storage space as claimed in claim 4, wherein, The step S5 includes: According to the sensitive categories of the original data, a dynamic redundant storage strategy is performed on the data slice after secondary encryption, and the dynamic redundant storage strategy specifically includes: When the standard time slice mapping of the original data corresponds to the first sensitive data set, a storage mechanism combining multiple copies and erasure coding is automatically triggered, including: generating a first copy, a second copy and a third copy by copying the twice-encrypted data, and storing the first copy, the second copy and the third copy in a plurality of storage addresses that are physically or logically isolated from each other; performing erasure coding algorithm calculation on the original plaintext of the standard time slice mapping in parallel to generate a plurality of redundant check slices; and storing the redundant check slices in storage addresses different from those of the first copy, the second copy and the third copy; When the standard time slice mapping of the original data corresponds to the third sensitive data set, a storage mechanism combining single copy and cross-region synchronization is triggered, including: copying the twice-encrypted data to obtain a fourth copy; writing the fourth copy into a highest priority response execution queue; and changing the fourth copy to be copied to a plurality of address different backup areas in a quasi-real-time manner through an execution cross-region synchronization process; The specific implementation process of accelerating the secondary encryption processing calculation process of step S2 by using the parallel computing capability of the graphics processor GPU includes: Step S51: a plurality of initial time dynamic allocation keys to be subjected to secondary encryption processing are combined into a secondary encryption data set, and the secondary encryption data set is transmitted from the main memory RAM controlled by the central processing unit CPU to the global video memory VRAM dedicated to the graphics processor GPU through a high-speed bus as a whole; Step S52: the central processing unit CPU issues an instruction to the graphics processor GPU to perform the secondary encryption processing of step S2 on the initial time dynamic allocation keys in the secondary encryption data set; Step S53: after receiving the instruction, the streaming multi-processor of the graphics processor GPU creates a plurality of threads for parallel execution, wherein each thread is independently assigned to process an initial time dynamic allocation key in the data set, and all threads use the single instruction multiple thread SIMT architecture of the graphics processor GPU to synchronously and in parallel execute each step of the secondary encryption operation; Step S54: when all threads have completed a predetermined number of iteration calculations, a result data set including all re-encrypted time dynamic allocation keys is obtained, and the result data set of the re-encrypted time dynamic allocation keys is transmitted from the video memory of the graphics processor GPU back to the main memory of the central processing unit CPU, and the central processing unit CPU receives these results and then continues to perform subsequent quantization processing and file encryption steps.

6. A system for building a trusted secure digital storage space for performing a method of building a trusted secure digital storage space, characterized in that, The system includes a space-time slicing module, a secondary encryption module, a permission control module, a storage authentication module and an optimization module: The space-time slicing module includes extracting user input original data, dynamically slicing and mapping the original data to obtain a standard time slice mapping, and generating an initial time dynamic allocation key based on the standard time slice mapping; The secondary encryption module includes twice-encrypting the initial time dynamic allocation key to obtain a re-encrypted time dynamic allocation key; The permission control module includes controlling the data access behavior according to the user role and the temporarily generated temporary key; The storage authentication module comprises hierarchical verification on the encrypted data fragments, and storing in the distributed storage node after verification, and calculating the storage authentication code; The optimization module comprises a dynamic redundant storage strategy according to the data sensitive categories of the original data, and a secondary encryption processing calculation process accelerated by the parallel computing capability of a graphic processing unit (GPU); The space-time slicing module comprises: The original data comprises generation time, geographical position and sensitive categories, and the sensitive categories are divided into a first sensitive data set, a second sensitive data set and a third sensitive data set, the first sensitive data set comprises user identity and privacy information, authentication and control information and core business information, the second sensitive data set comprises internal business and process data, user operation logs, device ID without specific identity information and internal employee work number and position, and the third sensitive data set comprises public information; The space-time slicing interval of the original data is calculated, and the process of calculating the space-time slicing interval comprises: The original data is marked with a data item, a timestamp and a space coordinate, the space coordinate comprises an address storage space size of the original data and a pointer coordinate of the original data, and dynamic slicing mapping is performed based on the timestamp and the space coordinate of the original data; The dynamic slicing mapping comprises: A first time slice corresponding to the longest time period in the original data is subtracted from a time slice corresponding to the shortest time period in the original data to obtain a first time slice, a time slice of a minimum unit of data corresponding to a storage address of the current original data is subtracted from a time slice of the original data to obtain a second time slice, and the first time slice is compared with the second time slice to obtain a standard time slice mapping; The standard time slice mapping is stored in an address, and the stored address is used as a data key, a pseudo-random function mapping is performed on the data key to generate a unique sub-key; The unique sub-key is distributed to the original data corresponding to the time slice respectively to obtain an initial time dynamic allocation key of the original data; The secondary encryption module comprises: The secondary encryption specifically comprises: The original data is sorted according to the order of the timestamp, and the initial time dynamic allocation key corresponding to the original data is stored in a sequential queue, a head node of the current sequential queue is initialized as a value of a next node multiplied by a preset random number minus one, and then a cosine function is added to take a remainder of 1, the argument of the cosine function is a result of an inverse cosine function, and the argument of the inverse cosine function is a value of the current head node; The initial time dynamic allocation key is iteratively encrypted based on the sequential queue and the calculation step of the head node to obtain a re-encrypted time dynamic allocation key; The secondary encryption module further comprises generating an encryption head, and the generation process of the encryption head comprises: The re-encrypted time dynamic allocation key sequence is quantized, the quantization processing comprises binary conversion of the re-encrypted time dynamic allocation key to obtain a re-encrypted binary ciphertext sequence, a bitwise exclusive OR operation is performed on the re-encrypted binary ciphertext sequence, a value of the initial time dynamic allocation key sequence and a number of iteration calculations are stored in a head node of the sequential queue to form the encryption head. The encryption head is used to regenerate the binary key sequence corresponding to the original data at decryption time.

Images