A data transmission method, system and related device

Abstract

This application relates to the field of data transmission technology, and in particular to a data transmission method, system, and related equipment. The method includes: a client generating a data index and a data encryption key for data to be encrypted; sending the data encryption key to a hardware cryptographic device and encrypting the data to be encrypted to generate encrypted data; the hardware cryptographic device obtaining a key encryption key and encrypting the data encryption key to generate key-encrypted data; obtaining a key identifier and sending the key-encrypted data and the key identifier to the client; the client uploading the encrypted data, key-encrypted data, data index, and key identifier to a cloud storage server; the cloud storage server storing it as a target record; and the client downloading the encrypted data from the cloud storage server based on the data index and decrypting the encrypted data to obtain the data to be encrypted. This application helps improve the security of cloud-stored data.

Description

Technical Field

[0001] This application relates to the field of data transmission technology, and in particular to a data transmission method, system and related equipment. Background Technology

[0002] With the rapid development of cloud computing technology, more and more users are choosing to upload confidential data to cloud storage servers for storage and management. To ensure the confidentiality of cloud storage data, the standard practice is for users to encrypt the data before uploading it to the cloud storage server, thereby preventing unauthorized access. Traditional data encryption methods typically use a single key to encrypt the data. However, relying solely on static encryption of cloud data with a single key to ensure confidentiality still carries significant risks. Once the key is leaked, all encrypted data is at risk of being cracked, leading to extremely serious consequences for users. Summary of the Invention

[0003] To help improve the security of cloud storage data, this application provides a data transmission method, system, and related equipment.

[0004] Firstly, this application provides a data transmission method, which adopts the following technical solution:

[0005] A data transmission method, comprising:

[0006] The client obtains the data to be encrypted and generates a data index and a data encryption key for the data to be encrypted.

[0007] The data encryption key is sent to the hardware cryptographic device, and the data to be encrypted is encrypted based on the data encryption key to generate encrypted data;

[0008] The hardware cryptographic device obtains the key encryption key and encrypts the data encryption key based on the key encryption key to generate key-encrypted data;

[0009] Obtain the key identifier corresponding to the key encryption key, and send the key encryption data and the key identifier to the client;

[0010] The client uploads the encrypted data, the key-encrypted data, the data index, and the key identifier to the cloud storage server;

[0011] The cloud storage server stores the received encrypted data, the key encrypted data, the data index, and the key identifier as a target record;

[0012] The client downloads the encrypted data from the cloud storage server based on the data index and decrypts the encrypted data to obtain the data to be encrypted.

[0013] By adopting the above technical solution, the client first obtains the data to be encrypted and generates a data index and a data encryption key for it. Then, it sends the data encryption key to the hardware cryptographic device and uses the same data encryption key to encrypt the data to be encrypted. After obtaining the key encryption key, the hardware cryptographic device uses its data encryption key to generate key-encrypted data and sends the key-encrypted data and the corresponding key identifier to the client. The client then uploads the encrypted data, key-encrypted data, data index, and key identifier to the cloud storage server, which stores this information as the target record. When the data is needed, the client downloads the encrypted data from the cloud storage server based on the data index and decrypts it to obtain the original data to be encrypted.

[0014] By combining the client with the hardware cryptographic device, the data encryption key and the encrypted data are managed separately. The encryption processing of the data encryption key by the hardware cryptographic device enhances the security of the data encryption key. The cloud storage server only stores the encrypted data and related identification information, avoiding the direct exposure of the data to be encrypted and the data encryption key, effectively reducing the risk of data leakage during transmission and storage. At the same time, the data index facilitates quick location and retrieval of target data, which helps to improve the convenience of data access.

[0015] Optionally, after obtaining the key identifier corresponding to the key encryption key and sending the key encryption data and the key identifier to the client, the method further includes:

[0016] The client retrieves the local identifier stored locally on the client's local machine;

[0017] Compare the key identifier with the local identifier;

[0018] If the key identifier and the local identifier are inconsistent, the local identifier shall be updated to the key identifier.

[0019] Optionally, the client downloads the encrypted data from the cloud storage server based on the data index, and decrypts the encrypted data to obtain the data to be encrypted, including:

[0020] The client sends the data index to the cloud storage server;

[0021] The cloud storage server matches the data index with its own index database and retrieves the target record corresponding to the data index;

[0022] Send the target record to the client;

[0023] Based on the target record, the client obtains the key encryption data and the key identifier, and sends the key encryption data and the key identifier to the hardware cryptographic device;

[0024] The hardware cryptographic device obtains the corresponding key encryption key based on the key identifier;

[0025] Based on the key encryption key, the key-encrypted data is decrypted to obtain the data encryption key;

[0026] Send the data encryption key to the client;

[0027] The client decrypts the encrypted data based on the data encryption key and obtains the data to be encrypted.

[0028] Optional, also includes:

[0029] The update server determines whether a key update command has been detected;

[0030] If the key update instruction is detected, the key update instruction is sent to the hardware cryptographic device;

[0031] After receiving the key update instruction, the hardware cryptographic device generates a corresponding new key encryption key;

[0032] Generate a new key identifier for the encryption key of the new key, and send the new key identifier to the update server;

[0033] The update server stores the new key encryption key in its own hardware security area, extracts the new key identifier corresponding to the new key encryption key, and completes the key update.

[0034] Optionally, storing the new key encryption key within its own hardware security area, extracting the new key identifier corresponding to the new key encryption key, and completing the key update includes:

[0035] The update server sends the new key identifier to both the client and the cloud storage server;

[0036] The client records the new key identifier into its local identifier list and updates the client's corresponding local identifier list.

[0037] The cloud storage server records the new key identifier into the local identifier list and updates the corresponding local identifier list of the cloud storage server.

[0038] Optionally, after the update server stores the new key encryption key within its own hardware security area, extracts the new key identifier corresponding to the new key encryption key, and completes the key update, the update further includes:

[0039] The client obtains a set of encrypted data consisting of all encrypted data that needs to be re-encrypted;

[0040] Based on the encrypted data set, obtain the corresponding data index set;

[0041] Send all data index sets to the cloud storage server;

[0042] The cloud storage server matches the data index set with its own index database and obtains the target record set corresponding to the data index set;

[0043] Send the target record set to the client;

[0044] The client updates the encrypted data set based on the target record set.

[0045] Optionally, the client updating the encrypted data set based on the target record set includes:

[0046] Based on the target record set, the client obtains a key encryption data set and a key identifier set, and sends the key encryption data set and the key identifier set to the hardware cryptographic device;

[0047] The hardware cryptographic device obtains the corresponding key encryption key set based on the key identifier set;

[0048] Based on the key encryption key set, the key encryption data set is decrypted to obtain the data encryption key set;

[0049] Send the set of data encryption keys to the client;

[0050] The client decrypts the encrypted data set based on the data encryption key set to obtain the data set to be encrypted;

[0051] Based on the set of data to be encrypted, a new set of data encryption keys is generated, and the set of data to be encrypted is then uploaded to the cloud storage server using the set of data encryption keys.

[0052] Secondly, this application also discloses a data transmission system, which adopts the following technical solution:

[0053] A data transmission system, comprising:

[0054] The client module is used to acquire the data to be encrypted and generate a data index and a data encryption key for the data to be encrypted;

[0055] The data encryption key is sent to the hardware cryptographic device, and the data to be encrypted is encrypted based on the data encryption key to generate encrypted data;

[0056] A hardware cryptographic device module is used to acquire a key encryption key and encrypt the data encryption key based on the key encryption key to generate key-encrypted data;

[0057] Obtain the key identifier corresponding to the key encryption key, and send the key encryption data and the key identifier to the client;

[0058] The client module is used to upload the encrypted data, the key encrypted data, the data index, and the key identifier to the cloud storage server;

[0059] The cloud storage server module is used to store the received encrypted data, the key encrypted data, the data index, and the key identifier as a target record;

[0060] The client module is used to download the encrypted data from the cloud storage server based on the data index, and decrypt the encrypted data to obtain the data to be encrypted.

[0061] By adopting the above technical solution, the client first obtains the data to be encrypted and generates a data index and a data encryption key for it. Then, it sends the data encryption key to the hardware cryptographic device and uses the same data encryption key to encrypt the data to be encrypted. After obtaining the key encryption key, the hardware cryptographic device uses its data encryption key to generate key-encrypted data and sends the key-encrypted data and the corresponding key identifier to the client. The client then uploads the encrypted data, key-encrypted data, data index, and key identifier to the cloud storage server, which stores this information as the target record. When the data is needed, the client downloads the encrypted data from the cloud storage server based on the data index and decrypts it to obtain the original data to be encrypted.

[0062] By combining the client with the hardware cryptographic device, the data encryption key and the encrypted data are managed separately. The encryption processing of the data encryption key by the hardware cryptographic device enhances the security of the data encryption key. The cloud storage server only stores the encrypted data and related identification information, avoiding the direct exposure of the data to be encrypted and the data encryption key, effectively reducing the risk of data leakage during transmission and storage. At the same time, the data index facilitates quick location and retrieval of target data, which helps to improve the convenience of data access.

[0063] Thirdly, the computer device provided in this application adopts the following technical solution:

[0064] A smart terminal includes a memory and a processor, wherein the memory stores a computer program that can run on the processor, and when the processor loads the computer program, it executes the method of the first aspect.

[0065] By adopting the above technical solution, a computer program is generated based on the method of the first aspect and stored in a memory for loading and execution by a processor. Thus, a smart terminal is made based on the memory and the processor, making it convenient for users to use.

[0066] Fourthly, the computer-readable storage medium provided in this application adopts the following technical solution:

[0067] A computer-readable storage medium storing a computer program that, when loaded by a processor, executes the method of the first aspect.

[0068] By adopting the above technical solution, a computer program is generated based on the method of the first aspect and stored in a computer-readable storage medium for loading and execution by a processor. The computer-readable storage medium facilitates the reading and storage of the computer program.

[0069] In summary, this application includes the following beneficial technical effects:

[0070] By combining the client with the hardware cryptographic device, the data encryption key and the encrypted data are managed separately. The encryption processing of the data encryption key by the hardware cryptographic device enhances the security of the data encryption key. The cloud storage server only stores the encrypted data and related identification information, avoiding the direct exposure of the data to be encrypted and the data encryption key, effectively reducing the risk of data leakage during transmission and storage. At the same time, the data index facilitates quick location and retrieval of target data, which helps to improve the convenience of data access. Attached Figure Description

[0071] Figure 1 This is a main flowchart of a data transmission method according to an embodiment of this application;

[0072] Figure 2 This is a flowchart of steps S201 to S203;

[0073] Figure 3 This is a flowchart of steps S301 to S308;

[0074] Figure 4 This is a flowchart of steps S401 to S405;

[0075] Figure 5 This is a flowchart of steps S501 to S503;

[0076] Figure 6 This is a flowchart of steps S601 to S606;

[0077] Figure 7 This is a flowchart of steps S701 to S706;

[0078] Figure 8 This is a block diagram of a data transmission system according to an embodiment of this application.

[0079] Explanation of reference numerals in the attached figures:

[0080] 1. Client module; 2. Hardware cryptographic device module; 3. Cloud storage server module; 4. Update server module. Detailed Implementation

[0081] Firstly, this application discloses a data transmission method.

[0082] Reference Figure 1 A data transmission method, comprising steps S101 to S107:

[0083] Step S101: The client obtains the data to be encrypted and generates a data index and a data encryption key for the data to be encrypted.

[0084] Specifically, the client receives user input or system-generated data to be encrypted (such as business documents, personal privacy data, etc.) through a local interface, uses a random number generation algorithm to generate a unique and non-repeatable data index, and generates the data encryption key required for the symmetric encryption algorithm. Both the data index and the data encryption key are bound to the current data to be encrypted.

[0085] In this embodiment, the data to be encrypted, also known as the original data, refers to confidential data (such as documents, files, database records, etc.) that the client needs to store in the cloud storage server. This is the core object that needs to be protected in this solution. The index is a unique and non-repeatable identifier generated for the data to be encrypted, used to locate the encrypted data in the cloud storage server. Since the data in the cloud storage is all encrypted and cannot be directly retrieved by content, the client generates a unique index and binds it to the encrypted data. After uploading, the cloud storage server stores the record using the index as the "retrieval key". When downloading, the client only needs to provide the index to quickly match the corresponding encrypted data record.

[0086] Step S102: Send the data encryption key to the hardware cryptographic device, and encrypt the data to be encrypted based on the data encryption key to generate encrypted data.

[0087] Specifically, the client transmits the data encryption key to the hardware cryptographic device through a secure communication channel. Simultaneously, it uses an encryption algorithm (such as AES-256) locally to perform encryption on the data to be encrypted using the data encryption key, generating ciphertext as encrypted data. In this embodiment, the encrypted data refers to the encrypted result formed after the data to be encrypted is encrypted with the data encryption key. It is the core data uploaded by the client to the cloud storage server and does not contain key information itself. Even if it is illegally obtained, it cannot be decrypted without the corresponding data encryption key, thus ensuring the confidentiality of the data during storage and transmission.

[0088] Step S103: The hardware cryptographic device obtains the key encryption key and encrypts the data encryption key based on the key encryption key to generate key encrypted data.

[0089] Specifically, the hardware cryptographic device retrieves a preset long-term key encryption key from its own secure storage area, uses the key encryption key to encrypt the received data encryption key, and generates key ciphertext as key encrypted data. In this embodiment, the key encryption key is used to encrypt and decrypt the data encryption key. It is generated by the hardware cryptographic device and stored in its secure area, with a long usage period (until the next key update). Its core function is to protect the security of the data encryption key, realizing hierarchical management of "keys of keys." Even if the key ciphertext in the cloud storage server is stolen, the data encryption key cannot be recovered without this key. Key encrypted data refers to the encrypted data formed after the data encryption key is encrypted by the key encryption key. It is generated by the hardware cryptographic device and uploaded to the cloud storage server for storage along with the encrypted data, data index, and key identifier. Only by decrypting with the corresponding key encryption key can the original data encryption key be recovered, which is a key form of protecting the data encryption key.

[0090] Step S104: Obtain the key identifier corresponding to the key encryption key, and send the key encryption data and the key identifier to the client.

[0091] Specifically, in this embodiment, the hardware cryptographic device extracts the key identifier corresponding to the currently used key encryption key. This identifier is used to distinguish between different versions of the key encryption key. Then, the key encryption data and the key identifier are returned to the client through a secure channel.

[0092] Step S105: The client uploads the encrypted data, key-encrypted data, data index, and key identifier to the cloud storage server.

[0093] Specifically, in this embodiment, the client packages the ciphertext, key ciphertext, data index, and key identifier into structured data and uploads it to a designated storage bucket of the cloud storage service server via the HTTPS protocol.

[0094] Step S106: The cloud storage server stores the received encrypted data, key encrypted data, data index and key identifier as the target record.

[0095] Specifically, after verifying the received structured data, the cloud storage server stores the four pieces of information as a database record or object storage file, using the data index as the primary key. In this embodiment, the target record refers to the complete data unit stored in the cloud storage server that corresponds to a single piece of data to be encrypted. It consists of four parts: encrypted data, key encrypted data, data index, and key identifier. This record is the smallest unit of data storage, uniquely identified by the index, and contains all the encrypted information required for decryption.

[0096] Step S107: The client downloads encrypted data from the cloud storage server based on the data index and decrypts the encrypted data to obtain the data to be encrypted.

[0097] Specifically, in this embodiment, the client initiates a download request through the data index, receives the target record returned by the cloud storage server, decrypts it through a hardware cryptographic device to obtain the data encryption key, and finally uses the data encryption key to decrypt the ciphertext to obtain the original data to be encrypted.

[0098] The data transmission method provided in this embodiment involves the client first acquiring the data to be encrypted and generating a data index and a data encryption key for it. Then, the client sends the data encryption key to a hardware cryptographic device and simultaneously encrypts the data to be encrypted using the same key. The hardware cryptographic device, after acquiring the key encryption key, uses its data encryption key to generate key-encrypted data and sends the key-encrypted data and its corresponding key identifier to the client. The client then uploads the encrypted data, key-encrypted data, data index, and key identifier to a cloud storage server, which stores this information as a target record. When the data is needed, the client downloads the encrypted data from the cloud storage server based on the data index and decrypts it to obtain the original data to be encrypted.

[0099] By combining the client with the hardware cryptographic device, the data encryption key and the encrypted data are managed separately. The encryption processing of the data encryption key by the hardware cryptographic device enhances the security of the data encryption key. The cloud storage server only stores the encrypted data and related identification information, avoiding the direct exposure of the data to be encrypted and the data encryption key, effectively reducing the risk of data leakage during transmission and storage. At the same time, the data index facilitates quick location and retrieval of target data, which helps to improve the convenience of data access.

[0100] Reference Figure 2In one embodiment of this example, after obtaining the key identifier corresponding to the key encryption key in step S104 and sending the key encryption data and the key identifier to the client, steps S201 to S203 are further included:

[0101] Step S201: The client obtains the local identifier stored locally on the client.

[0102] Specifically, in this embodiment, the client reads the identifier corresponding to the key encryption key saved during the last interaction from the local secure storage area (such as the operating system key chain or trusted execution environment) and uses it as the local identifier.

[0103] Step S202: Compare the key identifier and the local identifier.

[0104] Specifically, in this embodiment, the client compares the received key identifier with the local identifier using a string matching algorithm to determine whether they are consistent, thereby detecting whether the key encryption key has been updated.

[0105] Step S203: If the key identifier and the local identifier are inconsistent, update the local identifier to the key identifier.

[0106] Specifically, in this embodiment, when an identifier mismatch is detected, the client immediately replaces the old identifier stored locally with the newly received key identifier and writes it to the local secure storage area, overwriting the original record.

[0107] The data transmission method provided in this embodiment, after the hardware cryptographic device sends the key-encrypted data and key identifier to the client, the client obtains the locally stored local identifier and compares it with the received key identifier. If the two are inconsistent, the local identifier is updated to the key identifier. Through the comparison and update mechanism between the client's local identifier and the key identifier, it is ensured that the client always holds the latest key identifier, providing an accurate identification basis for subsequent key decryption operations based on the key identifier, avoiding key acquisition failure due to identifier mismatch, further ensuring the smoothness and security of the data decryption process, and enhancing the stability of the entire data transmission system.

[0108] Reference Figure 3 In one embodiment of this example, step S107, where the client downloads encrypted data from the cloud storage server based on the data index and decrypts the encrypted data to obtain the data to be encrypted, includes steps S301 to S308:

[0109] Step S301: The client sends the data index to the cloud storage server.

[0110] Specifically, in this embodiment, the client initiates a data download request by sending the data index as a request parameter through the API interface provided by the cloud storage server.

[0111] Step S302: The cloud storage server matches the data index with its own index database and retrieves the target record corresponding to the data index.

[0112] Specifically, the cloud storage server uses the primary key index of the index database to quickly match and retrieve the complete target record containing encrypted data, key-encrypted data, data index, and key identifier.

[0113] Step S303: Send the target record to the client.

[0114] Specifically, in this embodiment, the cloud storage server encapsulates the retrieved target record into a response data packet and transmits it to the requesting client via the HTTPS protocol.

[0115] Step S304: Based on the target record, the client obtains the key encryption data and key identifier, and sends the key encryption data and key identifier to the hardware cryptographic device.

[0116] Specifically, in this embodiment, the client parses the response data packet, extracts the key encryption data and key identifier field, and forwards it to the hardware cryptographic device through a secure channel.

[0117] Step S305: The hardware cryptographic device obtains the corresponding key encryption key based on the key identifier.

[0118] Specifically, in this embodiment, the hardware cryptographic device uses the key identifier as an index to look up the corresponding key encryption key in the locally securely stored key table.

[0119] Step S306: Based on the key encryption key, decrypt the key-encrypted data to obtain the data encryption key.

[0120] Specifically, in this embodiment, the hardware cryptographic device uses the matched key to encrypt the key, and decrypts the encrypted data according to the reverse process of the preset encryption algorithm to restore the data encryption key.

[0121] Step S307: Send the data encryption key to the client.

[0122] Specifically, in this embodiment, the hardware cryptographic device transmits the decrypted data encryption key to the client through a secure channel.

[0123] Step S308: The client decrypts the encrypted data based on the data encryption key and obtains the data to be encrypted.

[0124] Specifically, in this embodiment, the client uses a data encryption key and a decryption algorithm to decrypt the encryption key and recover the original data to be encrypted.

[0125] The data transmission method provided in this embodiment involves the client sending a data index to the cloud storage server. The cloud storage server matches the data index with its own index database and returns the corresponding target record. The client extracts the key encryption data and key identifier from the target record and sends them to the hardware cryptographic device. The hardware cryptographic device obtains the corresponding key encryption key based on the key identifier, decrypts it to obtain the data encryption key, and sends it to the client. The client finally uses the data encryption key to decrypt the encrypted data and obtain the original data to be encrypted.

[0126] By accurately locating target data through data indexing and combining the mechanism of hardware cryptographic devices obtaining corresponding encryption keys based on key identifiers, a complete and secure decryption chain is constructed. This ensures that only clients with the correct identifier and authorization can obtain the key required for decryption through hardware cryptographic devices. This not only achieves accurate acquisition and decryption of encrypted data, but also further enhances the security of data during use through multi-layer key management and hardware-level key processing, preventing unauthorized access.

[0127] Reference Figure 4 In one embodiment of this example, steps S401 to S405 are further included:

[0128] Step S401: The update server determines whether a key update command has been detected.

[0129] Specifically, in this embodiment, the update server checks whether a key update needs to be performed according to a preset cycle (such as once a month).

[0130] Step S402: If a key update command is detected, a key update command is sent to the hardware cryptographic device.

[0131] Specifically, in this embodiment, the update server sends a data packet containing an update identifier to the hardware cryptographic device via an encrypted communication link.

[0132] Step S403: After receiving the key update instruction, the hardware cryptographic device generates the corresponding new key encryption key.

[0133] Specifically, in this embodiment, the hardware cryptographic device uses a cryptographically secure pseudo-random number generator to generate a new key encryption key in a local secure environment.

[0134] Step S404: Generate a new key identifier for the new key encryption key and send the new key identifier to the update server.

[0135] Specifically, in this embodiment, the hardware cryptographic device generates a new key identifier (such as a hash value) for the new key encryption key and sends it to the update server through a secure channel.

[0136] Step S405: The update server stores the new key encryption key in its own hardware security area, extracts the new key identifier corresponding to the new key encryption key, and completes the key update.

[0137] Specifically, in this embodiment, the update server stores the new key encryption key in its own hardware security module, extracts and records the new key identifier, and completes the update of the key system.

[0138] The data transmission method provided in this embodiment firstly involves the update server detecting key update requirements without interrupting cloud services. After triggering the update process, the update server sends an instruction to the hardware cryptographic device to generate a new key encryption key and creates a corresponding new key identifier. The new key encryption key is stored by the update server in the hardware security area and synchronized to the identifier lists of the client and the cloud storage server, thereby completing the key update.

[0139] On the one hand, the entire update process is executed online without interrupting cloud services, avoiding unreasonable situations and potential errors caused by service interruptions and ensuring the continuity of cloud storage services. On the other hand, by generating new encryption keys in a timely manner and replacing old ones, the usage cycle of individual keys is reduced, lowering the risk of leakage caused by long-term use of the same key. This ensures both the timeliness and security of key updates and maintains the continuity of cloud services, effectively addressing the challenges of key management in cloud storage scenarios.

[0140] Reference Figure 5 In one embodiment of this example, step S405 involves the update server storing the new key encryption key within its own hardware security area, extracting the new key identifier corresponding to the new key encryption key, and completing the key update, including steps S501 to S503:

[0141] Step S501: The update server sends the new key identifier to the client and the cloud storage server.

[0142] Specifically, in this embodiment, the update server sends the new key identifier to all clients in the system and the cloud storage server through broadcast or peer-to-peer encrypted communication.

[0143] Step S502: The client records the new key identifier into the local identifier list and updates the corresponding local identifier list of the client.

[0144] Specifically, after receiving the new key identifier, the client adds it to the local identifier list and updates the currently active identifier to the new key identifier.

[0145] Step S503: The cloud storage server records the new key identifier into the local identifier list and updates the corresponding local identifier list of the cloud storage server.

[0146] Specifically, the cloud storage server writes the new key identifier into its own key identifier management library and updates the currently effective key identifiers in the system. In this embodiment, the local identifier list refers to the list stored locally by the client or the cloud storage server to record all valid key identifiers, including currently active and historically retained key identifiers, which is used to quickly match the corresponding key version during data interaction or updates.

[0147] The data transmission method provided in this embodiment involves the update server storing the new key encryption key and retrieving the new key identifier, then sending the new key identifier to the client and the cloud storage server; the client records the new key identifier in its local identifier list and updates its own local identifier list; the cloud storage server also records the new key identifier in its local identifier list and updates its own list.

[0148] By synchronously updating the local identifier lists of the client and the cloud storage server, the system ensures that all relevant nodes in the system hold the new key identifier consistently. This provides a unified identification benchmark for subsequent key calls and data decryption based on the key identifier, avoids interaction errors caused by inconsistencies in identifiers between different nodes, ensures smooth connection of all parts of the system after the key update, and enhances the accuracy and reliability of data transmission and access.

[0149] Reference Figure 6 In one embodiment of this example, after step S405 where the update server stores the new key encryption key within its own hardware security area, extracts the new key identifier corresponding to the new key encryption key, and completes the key update, steps S601 to S606 are further included:

[0150] Step S601: The client obtains the encrypted data set consisting of all the encrypted data that needs to be re-encrypted.

[0151] Specifically, the client determines all encrypted data encrypted with the old key encryption key based on the locally recorded list of old key identifiers associated with the data, forming an encrypted data set. In this embodiment, the encrypted data set refers to the set of all encrypted data that needs to be updated, that is, all encrypted data associated with the old key encryption key, which is selected by the client based on the old key identifier and is the target object for the encrypted data update.

[0152] Step S602: Based on the encrypted data set, obtain the corresponding data index set.

[0153] Specifically, the client extracts all data indexes corresponding to the encrypted data set through the association mapping between data and indexes, forming a data index set. In this embodiment, the data index set is a set of data indexes that correspond one-to-one with the encrypted data set, that is, a list of unique identifiers bound to the ciphertext to be updated. It is extracted by the client based on the encrypted data set and used to initiate batch data retrieval requests to the cloud storage server to locate the corresponding target records.

[0154] Step S603: Send all data index sets to the cloud storage server.

[0155] Step S604: The cloud storage server matches the data index set with its own index database and obtains the target record set corresponding to the data index set.

[0156] Specifically, in this embodiment, the cloud storage server retrieves all corresponding data records through batch index matching to form a target record set.

[0157] Step S605: Send the target record set to the client.

[0158] Step S606: The client updates the encrypted data set based on the target record set.

[0159] Specifically, in this embodiment, the client initiates a batch decryption and re-encryption process, updating all encrypted data based on the new key encryption key.

[0160] The data transmission method provided in this embodiment involves the client first determining all encrypted data that needs to be re-encrypted and forming an encrypted data set after the update server completes the key update. Then, the client obtains all data indexes corresponding to this set to form a data index set. Subsequently, the client sends the data index set to the cloud storage server, which matches it with its own index database, filters out the corresponding target record set, and feeds it back to the client. Finally, the client performs an update operation on the encrypted data set based on the received target record set.

[0161] By precisely locating the target record corresponding to the encrypted data that needs to be updated through the data index set, targeted filtering and retrieval of specific encrypted data are achieved, avoiding indiscriminate processing of all data in cloud storage and improving the targeting and efficiency of ciphertext updates. At the same time, updating encrypted data based on the target record set ensures the accuracy of the update object, reduces update errors caused by incorrect data location, and provides reliable data support for subsequent secure updates of ciphertext.

[0162] Reference Figure 7 In one embodiment of this example, step S606: The client updates the encrypted data set based on the target record set, including steps S701 to S706:

[0163] Step S701: Based on the target record set, the client obtains the key encryption data set and the key identifier set, and sends the key encryption data set and the key identifier set to the hardware cryptographic device.

[0164] Specifically, in this embodiment, the client extracts key encryption data and key identifiers in batches from the target record set, forms a corresponding set, and sends it to the hardware cryptographic device.

[0165] Step S702: The hardware cryptographic device obtains the corresponding key encryption key set based on the key identifier set.

[0166] Specifically, the hardware cryptographic device matches the corresponding new and old key encryption keys in batches according to the key identifier set, forming a key encryption key set. The key encryption key set refers to a set of key encryption keys matched by the hardware cryptographic device based on the key identifier set during the ciphertext update process. It is used to decrypt the corresponding key encryption data set in batches, realize the parallel processing of multiple sets of keys, and improve the efficiency of ciphertext update.

[0167] Step S703: Based on the key encryption key set, decrypt the key encryption data set to obtain the data encryption key set.

[0168] Specifically, the hardware cryptographic device uses the corresponding key to encrypt the data set in batches and decrypt the data set in batches to obtain the data encryption key set. In this embodiment, the data encryption key set refers to a set of data encryption keys generated and managed by the client or hardware cryptographic device in the scenario of batch update of ciphertext. Each data encryption key corresponds to a piece of data to be encrypted (or a batch of associated data to be encrypted), and the set as a whole is used to perform batch encryption or decryption operations on the data set to be encrypted.

[0169] Step S704: Send the data encryption key set to the client.

[0170] Step S705: The client decrypts the encrypted data set based on the data encryption key set and obtains the data set to be encrypted.

[0171] Specifically, the client uses the data encryption key set to decrypt the encryption key set in batches and restore the original data set to be encrypted. In this embodiment, in the ciphertext update process, the set of original data obtained after decrypting the encrypted data set with the data encryption key set, which is the plaintext data body that needs to be re-encrypted, is the basis for generating new ciphertext.

[0172] Step S706: Based on the data set to be encrypted, generate a new set of data encryption keys, and encrypt and upload the data set to be encrypted to the cloud storage server based on the data encryption key set.

[0173] Specifically, in this embodiment, the client regenerates a new set of data encryption keys for the set of data to be encrypted, encrypts the data with the new data encryption keys to obtain a new set of encryption keys, and simultaneously encrypts the new data encryption keys with the new key encryption keys to obtain a new set of encrypted data. Finally, the new encryption keys, the new key encrypted data, the original index, and the new key identifier are re-uploaded to the cloud storage server to overwrite the old records.

[0174] The data transmission method provided in this embodiment involves the client extracting a key-encrypted data set and a key identifier set from the target record set and sending them to a hardware cryptographic device. The hardware cryptographic device obtains the corresponding key encryption key set based on the key identifier set, decrypts it to obtain a data encryption key set, and returns it to the client. The client uses this data encryption key set to decrypt the encrypted data set to obtain the data set to be encrypted. Subsequently, a new data encryption key set is generated, and the dataset to be encrypted is re-encrypted and uploaded to the cloud storage server.

[0175] The key decryption process is completed using hardware cryptographic devices, ensuring the security of key processing. The encryption key is regenerated based on the original data and encryption is performed, achieving synchronous association between the ciphertext and the new key, avoiding the security risks of ciphertext caused by the leakage of the old key. The entire process improves the efficiency of ciphertext updates by processing batch data in a centralized manner, while ensuring the integrity and availability of the updated data, and strengthening the security protection of data throughout its entire lifecycle.

[0176] Secondly, this application also discloses a data transmission system.

[0177] Reference Figure 8 A data transmission system, comprising:

[0178] The client module is used to obtain the data to be encrypted and generate a data index and a data encryption key for the data to be encrypted;

[0179] The data encryption key is sent to the hardware cryptographic device, and the data to be encrypted is encrypted based on the data encryption key to generate encrypted data;

[0180] The hardware cryptographic device module is used to obtain the key encryption key and encrypt the data encryption key based on the key encryption key to generate key encrypted data;

[0181] Obtain the key identifier corresponding to the key encryption key, and send the key encryption data and the key identifier to the client;

[0182] The client module is used to upload encrypted data, key-encrypted data, data indexes, and key identifiers to the cloud storage server.

[0183] The cloud storage server module is used to store the received encrypted data, key encrypted data, data index, and key identifier as target records;

[0184] The client module is used to download encrypted data from the cloud storage server based on the data index, and decrypt the encrypted data to obtain the data to be encrypted.

[0185] Thirdly, this application discloses a smart terminal, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor loads the computer program, it executes a data transmission method according to the above embodiments.

[0186] Fourthly, embodiments of this application disclose a computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is loaded by a processor, it executes a data transmission method of the above embodiments.

[0187] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A data transmission method, characterized by, include: The client obtains the data to be encrypted and generates a data index and a data encryption key for the data to be encrypted. The client sends the data encryption key to the hardware cryptographic device through a secure communication channel, and encrypts the data to be encrypted based on the data encryption key to generate encrypted data; wherein, the hardware cryptographic device stores its own generated key encryption key; The hardware cryptographic device obtains the key encryption key from its own secure storage area, and encrypts the data encryption key based on the key encryption key to generate key-encrypted data; The hardware cryptographic device obtains the key identifier corresponding to the key encryption key, and sends the key encryption data and the key identifier to the client through a secure communication channel; The client uploads the encrypted data, the key-encrypted data, the data index, and the key identifier to the cloud storage server; The cloud storage server stores the received encrypted data, the key encrypted data, the data index, and the key identifier as a target record with the data index as the primary key. The target record contains the complete encrypted information required for decryption. The client downloads and decrypts the encrypted data from the cloud storage server based on the data index, specifically including: The client sends a data index to the cloud storage server, and the cloud storage server matches the data index with its own index database and then returns the target record. The client extracts key encryption data and key identifier from the target record and sends them to the hardware cryptographic device through a secure communication channel. The hardware cryptographic device obtains the corresponding key encryption key from its own secure storage area based on the key identifier, decrypts the key-encrypted data to obtain the data encryption key, and feeds back the data encryption key to the client through a secure communication channel; The client decrypts the encrypted data using the data encryption key to obtain the data to be encrypted.

2. The data transmission method of claim 1, wherein, After obtaining the key identifier corresponding to the key encryption key and sending the key encryption data and the key identifier to the client, the process further includes: The client retrieves the local identifier stored locally on the client's local machine; Compare the key identifier with the local identifier; If the key identifier and the local identifier are inconsistent, the local identifier shall be updated to the key identifier.

3. The data transmission method of claim 1, wherein Also includes: The update server determines whether a key update command has been detected; If the key update instruction is detected, the key update instruction is sent to the hardware cryptographic device; After receiving the key update instruction, the hardware cryptographic device generates a corresponding new key encryption key; Generate a new key identifier for the encryption key of the new key, and send the new key identifier to the update server; The update server stores the new key encryption key in its own hardware security area, extracts the new key identifier corresponding to the new key encryption key, and completes the key update.

4. The data transmission method of claim 3, wherein, The step of storing the new key encryption key within its own hardware security area, extracting the new key identifier corresponding to the new key encryption key, and completing the key update includes: The update server sends the new key identifier to both the client and the cloud storage server; The client records the new key identifier into its local identifier list and updates the client's corresponding local identifier list. The cloud storage server records the new key identifier into the local identifier list and updates the corresponding local identifier list of the cloud storage server.

5. The data transmission method of claim 3, wherein, After the update server stores the new key encryption key within its own hardware security area, extracts the new key identifier corresponding to the new key encryption key, and completes the key update, it also includes: The client obtains a set of encrypted data consisting of all encrypted data that needs to be re-encrypted; Based on the encrypted data set, obtain the corresponding data index set; Send all data index sets to the cloud storage server; The cloud storage server matches the data index set with its own index database and obtains the target record set corresponding to the data index set; Send the target record set to the client; The client updates the encrypted data set based on the target record set.

6. A data transmission method according to claim 5, characterized in that, The client updates the encrypted data set based on the target record set, including: Based on the target record set, the client obtains a key encryption data set and a key identifier set, and sends the key encryption data set and the key identifier set to the hardware cryptographic device; The hardware cryptographic device obtains the corresponding key encryption key set based on the key identifier set; Based on the key encryption key set, the key encryption data set is decrypted to obtain the data encryption key set; Send the set of data encryption keys to the client; The client decrypts the encrypted data set based on the data encryption key set to obtain the data set to be encrypted; Based on the set of data to be encrypted, a new set of data encryption keys is generated, and the set of data to be encrypted is then uploaded to the cloud storage server using the set of data encryption keys.

7. A data transmission system for carrying out the method of any one of claims 1 to 6, characterized by include: The client module is used to acquire the data to be encrypted and generate a data index and a data encryption key for the data to be encrypted; The data encryption key is sent to the hardware cryptographic device, and the data to be encrypted is encrypted based on the data encryption key to generate encrypted data; A hardware cryptographic device module is used to acquire a key encryption key and encrypt the data encryption key based on the key encryption key to generate key-encrypted data; Obtain the key identifier corresponding to the key encryption key, and send the key encryption data and the key identifier to the client; The client module is used to upload the encrypted data, the key encrypted data, the data index, and the key identifier to the cloud storage server; The cloud storage server module is used to store the received encrypted data, the key encrypted data, the data index, and the key identifier as a target record; The client module is used to download the encrypted data from the cloud storage server based on the data index, and decrypt the encrypted data to obtain the data to be encrypted.

8. A smart terminal comprising a memory, a processor, characterized in that, The memory is used to store computer programs that can run on the processor, and when the processor loads the computer program, it executes the method of any one of claims 1 to 6.

9. A computer-readable storage medium having stored therein a computer program, characterized in that, When the computer program is loaded by the processor, it executes the method of any one of claims 1 to 6.

Images