Data security storage method and system based on cloud disk

Abstract

The application provides a cloud disk-based data security storage method and system, relates to the technical field of security storage, and comprises the following steps: obtaining a user access request, performing multi-factor authentication, generating a dynamic key seed based on authentication process data and deriving a dynamic encryption key, dividing target data into multiple data shards, encrypting each shard based on its location information and the dynamic encryption key to generate a shard encryption key, storing the encrypted shards to the cloud, and establishing a mapping relationship between a user identifier, an authentication time and a storage location. The application improves the security of cloud disk data storage and realizes fine-grained dynamic encryption protection.

Description

Technical Field

[0001] This invention relates to the field of secure storage technology, and in particular to a data security storage method and system based on cloud disks. Background Technology

[0002] With the increasing popularity of cloud storage services, more and more users are choosing to store their personal and business data in cloud drives. Cloud drives offer advantages such as large storage space, ease of sharing, and accessibility anytime, anywhere, making them an important method of modern data storage. While the development of cloud drive technology has made data storage more convenient, it has also brought challenges to data security. User data stored on the servers of third-party cloud service providers faces security risks such as data leaks, unauthorized access, and compromised data integrity.

[0003] Current mainstream cloud storage solutions for data security have some significant shortcomings. First, traditional cloud storage security authentication mechanisms mostly use a single username and password method, which has low security strength and is difficult to resist security threats such as phishing attacks and password cracking. Once the credentials are leaked, attackers can easily gain full access to all data.

[0004] Secondly, existing cloud storage encryption technologies typically use static encryption keys to encrypt the entire dataset. Since the encryption key remains unchanged over a long period, if it is leaked, all historical and future data will be at security risk. This single-key encryption method cannot achieve dynamic key updates or fine-grained data access control. Summary of the Invention

[0005] This invention provides a cloud disk-based data security storage method and system, which can solve the problems in the prior art.

[0006] A first aspect of the present invention provides a cloud disk-based data security storage method, comprising:

[0007] The system obtains an access request initiated by a user for data on a target cloud disk, the access request carrying a user identifier; based on the user identifier, it extracts an authentication factor combination corresponding to the user identifier from a preset multi-factor authentication configuration, the authentication factor combination containing at least two different types of authentication factors, and sequentially verifies each authentication factor to obtain an authentication result;

[0008] When the authentication result is successful, a dynamic key seed associated with the user identifier and authentication time is generated based on the verification process data of each authentication factor in the authentication factor combination. Then, a dynamic encryption key for encrypting the target cloud disk data is generated based on the dynamic key seed through a key derivation function.

[0009] The target cloud disk data is divided into a plurality of data shards, and for each data shard, a shard encryption key corresponding to the data shard is generated based on the location information of the data shard in the target cloud disk data and the dynamic encryption key, the data shard is encrypted using the shard encryption key to obtain an encrypted data shard; all encrypted data shards are stored in a cloud storage node, and a mapping relationship between the user identifier, the authentication time and the storage location of the target cloud disk data is established.

[0010] The authentication factor combination corresponding to the user identifier is extracted from the preset multi-factor authentication configuration based on the user identifier, and the verification of each authentication factor is sequentially completed, including:

[0011] According to the user identifier, the authentication factor type set bound to the user identifier and the verification constraint condition corresponding to each authentication factor type are obtained by querying the preset multi-factor authentication configuration; based on the security level of each authentication factor type in the authentication factor type set, the verification order of each authentication factor in the authentication factor combination is determined;

[0012] According to the verification order, for the current authentication factor to be verified, the authentication factor corresponding to the verification request is sent to the user terminal, and the type identifier and verification mode indication of the authentication factor are included in the verification request; the authentication feature in the authentication response data returned by the user terminal for the authentication factor is extracted;

[0013] The authentication feature and the verification constraint condition corresponding to the authentication factor are matched, and when the authentication feature satisfies the verification constraint condition, the authentication timestamp, the authentication feature and the position sequence number of the authentication factor in the verification order of the authentication factor are recorded as the authentication process data of the authentication factor;

[0014] It is judged whether there is an unverified authentication factor in the authentication factor combination, when there is an unverified authentication factor, the step of sending the authentication factor corresponding to the verification request to the user terminal is returned, when all authentication factors in the authentication factor combination are verified and each authentication feature satisfies the corresponding verification constraint condition, it is determined that the authentication result is verified, and the authentication process data of all authentication factors is combined to form an authentication process data set.

[0015] According to the authentication process data of each authentication factor in the authentication factor combination, a dynamic key seed associated with the user identifier and the authentication time is generated, including:

[0016] Time-varying characteristic parameters are extracted from the authentication process data of each authentication factor, including a verification timestamp of each authentication factor and the authentication time; for each authentication factor, the time-varying characteristic parameters of the authentication factor are associated and mapped with the authentication characteristics corresponding to the authentication factor in the authentication factor combination, to generate a time sequence characteristic vector corresponding to the authentication factor;

[0017] According to the verification order of each authentication factor in the authentication factor combination, the time sequence characteristic vectors corresponding to all authentication factors are sequentially spliced to form an authentication sequence characteristic; the user identifier, the authentication time and the authentication sequence characteristic are combined, and an irreversible transformation is performed on the combination result to generate the dynamic key seed.

[0018] Based on the dynamic key seed, a dynamic encryption key for encrypting the target cloud disk data is generated through a key derivation function, including:

[0019] The data type identifier and data size parameter of the target cloud disk data are obtained; the dynamic key seed, the data type identifier and the data size parameter are taken as inputs of the key derivation function, and a key expansion operation is performed through the key derivation function to generate the dynamic encryption key.

[0020] The location information of the data fragment in the target cloud disk data and the dynamic encryption key generate a fragment encryption key corresponding to the data fragment, and the data fragment is encrypted using the fragment encryption key, including:

[0021] The starting position offset and data length of the data fragment in the target cloud disk data are determined, and the starting position offset and data length are combined to form the location information of the data fragment;

[0022] Key feature components are extracted from the dynamic encryption key, including time sequence information of the authentication process and attribute information of the target cloud disk data; the location information of the data fragment and the key feature components are fused to generate a position-related key factor of the data fragment;

[0023] Based on the position-related key factor of the data fragment, a key derivation function is used to generate a fragment encryption key corresponding to the data fragment, so that the fragment encryption key is associated with the location information of the data fragment, the time sequence information of the authentication process and the attribute information of the target cloud disk data at the same time;

[0024] The original data content in the data fragment is extracted; the original data content is encrypted using the fragment encryption key to generate encrypted data content; the encrypted data content and the location information of the data fragment are bound to form an encrypted data fragment corresponding to the data fragment.

[0025] The position-related key factor of the data slice is used to generate a slice encryption key corresponding to the data slice by a key derivation function, including:

[0026] A position feature component and a key feature component are extracted from the position-related key factor of the data slice, the position feature component is subjected to a numerical mapping transformation to generate a position-related transformation parameter;

[0027] The key feature component and the position-related transformation parameter are cross-mixed to generate a mixed key vector, so that the mixed key vector embodies the position feature of the data slice and the timing information of the authentication process at the same time;

[0028] The mixed key vector is used as a first input parameter of the key derivation function; a data content digest of the data slice is obtained, and the data content digest is used as a second input parameter of the key derivation function;

[0029] The first input parameter and the second input parameter are subjected to an iterative expansion operation by the key derivation function to generate a slice encryption key corresponding to the data slice.

[0030] In a second aspect of the embodiment of the application, a data security storage system based on a cloud disk is provided, including:

[0031] A first unit is configured to obtain an access request initiated by a user for target cloud disk data, the access request carrying a user identifier; based on the user identifier, a combination of authentication factors corresponding to the user identifier is extracted from a preset multi-factor authentication configuration, the combination of authentication factors including at least two authentication factors of different types, and the authentication factors are verified in sequence to obtain an authentication result;

[0032] A second unit is configured to, when the authentication result is verified, generate a dynamic key seed associated with the user identifier and an authentication time according to the verification process data of each authentication factor in the combination of authentication factors, and generate a dynamic encryption key for encrypting the target cloud disk data based on the dynamic key seed by a key derivation function;

[0033] A third unit is configured to divide the target cloud disk data into a plurality of data slices, and for each data slice, generate a slice encryption key corresponding to the data slice based on the position information of the data slice in the target cloud disk data and the dynamic encryption key, encrypt the data slice using the slice encryption key to obtain an encrypted data slice, store all encrypted data slices to a cloud storage node, and establish a mapping relationship between the user identifier, the authentication time, and the storage location of the target cloud disk data.

[0034] A third aspect of the embodiments of the present application,

[0035] An electronic device is provided, comprising:

[0036] A processor;

[0037] A memory for storing processor-executable instructions;

[0038] The processor is configured to invoke the instructions stored in the memory to perform the method described above.

[0039] A fourth aspect of the embodiments of the present application,

[0040] A computer-readable storage medium is provided, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the method described above.

[0041] The beneficial effects of the present application are as follows:

[0042] By introducing a multi-factor authentication mechanism, not only the security of user identity authentication is improved, but also the verification data generated in the authentication process is ingeniously used for the generation of dynamic key seeds, so that the encryption key is closely associated with the user identity authentication process, and the security of the system is enhanced.

[0043] Based on the user identifier and the authentication time, a dynamic key seed is generated, and a dynamic encryption key is generated through a key derivation function, avoiding the problem that a static key is easy to be attacked, and improving the security of the key.

[0044] The data fragmentation technology is adopted, and a fragmented encryption key is generated for each fragment, and the fragmented encryption key is associated with the position information of the data fragment in the original data, so that even if a single fragment is cracked, the encryption key of other fragments cannot be derived, and the security of data storage is significantly enhanced. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 A flowchart of the data security storage method based on a cloud disk according to the embodiments of the present application. DETAILED DESCRIPTION

[0046] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0047] The technical solutions of the present application will be described in detail below with specific examples. The following specific examples can be combined with each other, and some examples may not be described in detail for the same or similar concepts or processes.

[0048] Figure 1 The flowchart of the cloud disk-based data security storage method of the embodiments of the present application is shown in FIG. 1, which comprises the following steps: Figure 1

[0049] An access request initiated by a user for target cloud disk data is acquired, and the access request carries a user identifier; based on the user identifier, a combination of authentication factors corresponding to the user identifier is extracted from a preset multi-factor authentication configuration, the combination of authentication factors contains at least two different types of authentication factors, and the verification of each authentication factor is sequentially completed to obtain an authentication result.

[0050] When the authentication result is a verification pass, a dynamic key seed associated with the user identifier and the authentication time is generated according to the verification process data of each authentication factor in the combination of authentication factors, and a dynamic encryption key used to encrypt the target cloud disk data is generated based on the dynamic key seed through a key derivation function.

[0051] The target cloud disk data is divided into multiple data shards, and for each data shard, a shard encryption key corresponding to the data shard is generated based on the location information of the data shard in the target cloud disk data and the dynamic encryption key, the data shard is encrypted using the shard encryption key to obtain an encrypted data shard; all encrypted data shards are stored in a cloud storage node, and a mapping relationship between the user identifier, the authentication time and the storage location of the target cloud disk data is established.

[0052] In an optional implementation, extracting the combination of authentication factors corresponding to the user identifier from the preset multi-factor authentication configuration and sequentially completing the verification of each authentication factor based on the user identifier comprises:

[0053] According to the user identifier, the set of authentication factor types bound to the user identifier and the verification constraint conditions corresponding to each authentication factor type in the set of authentication factor types are obtained by querying the preset multi-factor authentication configuration; based on the security levels of each authentication factor type in the set of authentication factor types, the verification order of each authentication factor in the combination of authentication factors is determined;

[0054] According to the verification order, for the current authentication factor to be verified, a verification request corresponding to the authentication factor is sent to the user terminal, and the verification request contains the type identifier of the authentication factor and the verification mode indication; the verification response data returned by the user terminal for the authentication factor is received, and the authentication features in the verification response data are extracted.​

[0055] The authentication feature is matched with the verification constraint condition corresponding to the authentication factor, when the authentication feature satisfies the verification constraint condition, the verification timestamp of the authentication factor, the authentication feature and the position sequence number of the authentication factor in the verification sequence are recorded as the verification process data of the authentication factor;

[0056] It is judged whether there is an unverified authentication factor in the authentication factor combination, when there is an unverified authentication factor, the step of sending the verification request corresponding to the authentication factor to the user terminal is returned, when all authentication factors in the authentication factor combination complete verification and each authentication feature satisfies the corresponding verification constraint condition, it is determined that the authentication result is verified and the verification process data of all authentication factors is combined to form an authentication process data set.

[0057] According to the user identifier, the preset multi-factor authentication configuration is queried, and the authentication factor type set bound to the user identifier and the verification constraint condition corresponding to each authentication factor type are obtained. Specifically, a user authentication factor configuration table can be maintained in the database, which includes a user identifier field, an authentication factor type set field, and a verification constraint condition field corresponding to each authentication factor type. When the user identifier is received, the authentication factor configuration information of the user is obtained through the SQL query statement "SELECT authentication factor type set, verification constraint condition FROM user authentication factor configuration table WHERE user identifier='received user identifier'".

[0058] For example, the user "user123" may bind three authentication factor types: password authentication, SMS verification code authentication and face recognition authentication. Among them, the verification constraint condition of password authentication is "not less than 8 characters and contains numbers and letters"; the verification constraint condition of SMS verification code authentication is "six digits and valid within five minutes"; the verification constraint condition of face recognition authentication is "similarity threshold not less than 0.85".

[0059] Next, based on the security level of each authentication factor type in the authentication factor type set, the verification sequence of each authentication factor in the authentication factor combination is determined. The security level of each authentication factor type can be preset in the system, for example: the security level of password authentication is 1, the security level of SMS verification code authentication is 2, the security level of fingerprint authentication is 3, and the security level of face recognition authentication is 4. The higher the security level, the higher the priority of verification, so as to ensure that the authentication factor with high security level is verified first. Based on the above example, the verification sequence will be: face recognition authentication, SMS verification code authentication, password authentication.

[0060] According to the determined verification sequence, a verification request corresponding to the authentication factor is sent to the user terminal, and the verification request contains the type identifier and verification mode indication of the authentication factor.

[0061] The verification response data returned by the user terminal for the authentication factor is received, and the authentication feature in the verification response data is extracted. The format and content of the verification response data are also different for different types of authentication factors. For example, for face recognition authentication, the verification response data may contain the feature vector of the face image; for password authentication, the verification response data contains the password hash value input by the user; for SMS verification code authentication, the verification response data contains the verification code input by the user.

[0062] The extracted authentication feature is matched with the verification constraint condition corresponding to the authentication factor. For example, for face recognition authentication, the extracted face feature vector can be calculated for similarity with the pre-stored user face feature template to determine whether the similarity threshold 0.85 set in the verification constraint condition is reached. When the authentication feature meets the verification constraint condition, the verification timestamp, authentication feature and position sequence number of the authentication factor in the verification sequence of the authentication factor are recorded as the verification process data of the authentication factor.

[0063] It is judged whether there is an unverified authentication factor in the authentication factor combination, and when there is an unverified authentication factor, the step of sending the authentication factor corresponding to the verification request to the user terminal is returned. For example, after completing face recognition authentication, the SMS verification code authentication request is sent, and then the password authentication request is sent.

[0064] When all authentication factors in the authentication factor combination are verified and each authentication feature meets the corresponding verification constraint condition, it is determined that the authentication result is verified, and the verification process data of all authentication factors is combined to form an authentication process data set. The authentication process data set contains the complete information of the entire multi-factor authentication process, which can be used for subsequent audit and analysis.

[0065] The authentication process data set can be further encrypted to ensure the security and integrity of the verification process. In some high security scenarios, the authentication process data set can also be recorded by blockchain technology to prevent illegal modification of the data at a later stage.

[0066] After the completion of the entire multi-factor authentication process, the authentication result can be returned to the user terminal, and the user is granted corresponding access rights or performs corresponding business operations.

[0067] In an optional implementation, generating a dynamic key seed associated with the user identifier and the authentication time according to the verification process data of each authentication factor in the authentication factor combination includes:

[0068] The time-varying characteristic parameters are extracted from the authentication process data of each authentication factor, and the time-varying characteristic parameters include the authentication time stamp of each authentication factor and the authentication time point; for each authentication factor, the time-varying characteristic parameters of the authentication factor are associated and mapped with the authentication characteristics corresponding to the authentication factor in the authentication factor combination, to generate the time sequence characteristic vector corresponding to the authentication factor;

[0069] According to the authentication order of each authentication factor in the authentication factor combination, the time sequence characteristic vectors corresponding to all authentication factors are sequentially spliced to form the authentication sequence characteristics; the user identifier, the authentication time point and the authentication sequence characteristics are combined, and irreversible transformation is performed on the combination result to generate the dynamic key seed.

[0070] After the user completes the multi-factor authentication process, the authentication process data of each authentication factor will be generated. Time-varying characteristic parameters are extracted from these authentication process data. The time-varying characteristic parameters mainly include the authentication time stamp of each authentication factor and the authentication time point of the entire authentication process. The authentication time stamp refers to the specific time point when each authentication factor is verified, and the authentication time point refers to the time point when the entire authentication process is completed. For example, the user first performs fingerprint recognition, then performs face recognition, and finally inputs a password, and the authentication time stamp of each of the three authentication factors and the authentication time point when the entire authentication process is completed will be recorded.

[0071] The extraction of time-varying characteristic parameters adopts time series analysis method, and for the verification process of each authentication factor, the start verification time, the end verification time and the verification result return time are recorded. These time points constitute the time characteristic set of the authentication factor. For example, for fingerprint recognition, the time points when the user starts pressing the fingerprint sensor, completes the collection, and the system completes the comparison are recorded, so as to obtain complete time series information.

[0072] For each authentication factor, the time-varying characteristic parameters of the authentication factor are associated and mapped with the authentication characteristics corresponding to the authentication factor in the authentication factor combination, to generate the time sequence characteristic vector corresponding to the authentication factor. The authentication characteristics refer to the characteristic parameters of the authentication factor, such as the ridge feature point of the fingerprint, the geometric feature of the face, the spectrum feature of the voiceprint, etc. The association and mapping process adopts a feature fusion algorithm to combine the time-varying characteristics and the authentication characteristics to generate a comprehensive characteristic vector containing time dimension and feature dimension.

[0073] In a specific implementation, for the fingerprint authentication factor, the time sequence feature vector can be represented as a combination of fingerprint feature parameters (such as the number of feature points, distribution density) and verification timestamps. Similarly, for the face authentication factor, the time sequence feature vector can be represented as a combination of facial feature parameters (such as feature point positions, feature point distances) and verification timestamps. For the password authentication factor, the time sequence feature vector can be represented as a combination of password input characteristics (such as input speed, key interval) and verification timestamps.

[0074] Next, according to the verification order of each authentication factor in the authentication factor combination, the time sequence feature vectors corresponding to all authentication factors are sequentially spliced to form the authentication sequence feature. This step ensures that the authentication order information is also included in the final feature, enhancing security. For example, if the user completes fingerprint recognition, face recognition, and password input in sequence, the time sequence feature vectors of the three authentication factors are spliced in this order. The splicing method can be simple vector concatenation, or more complex feature fusion methods such as weighted fusion or feature conversion, etc.

[0075] After forming the authentication sequence feature, the user identifier, authentication time, and authentication sequence feature are combined. The user identifier can be a user account, device ID, or other information that can uniquely identify the user. The combination method can be direct splicing or processing through a specific combination function. For example, the user identifier and authentication time can be converted to binary representations, and then bitwise operations such as XOR, circular shift, etc. are performed with the authentication sequence feature to form a more complex combination result.

[0076] Finally, an irreversible transformation is performed on the combined result to generate a dynamic key seed. Irreversible transformations usually use cryptographic hash functions such as SHA-256, SHA-3, etc. These functions have one-way, collision resistance, etc. features, which can ensure that even if an attacker obtains the dynamic key seed, the original user authentication information cannot be reverse-engineered. In specific implementations, the combined result can be preprocessed, such as padding, blocking, etc., then the hash function is applied, and multiple rounds of hash calculation can be performed to enhance security.

[0077] In practical applications, this dynamic key seed can be used in subsequent encrypted communication, identity verification, etc. Since the dynamic key seed is associated with the user's multiple authentication factors, authentication time, and authentication order, even if an attacker cracks a certain authentication factor, it is difficult to generate an effective key seed, greatly improving the security of the system.

[0078] In addition, the generation process of the dynamic key seed can be customized according to application scenarios. For example, in a high-security financial system, the number of authentication factors can be increased, the collection accuracy of time-varying characteristic parameters can be improved, and stronger irreversible transformation algorithms can be used; in general application scenarios, the process can be appropriately simplified to balance security and user experience.

[0079] The dynamic key seed generated by the above method not only contains the user's multi-identity authentication information, but also integrates the dynamic characteristics of the time dimension, which can provide high-strength key basis for subsequent security applications.

[0080] In an optional implementation, generating a dynamic encryption key for encrypting the target cloud disk data based on the dynamic key seed through a key derivation function includes:

[0081] Obtaining a data type identifier and a data size parameter of the target cloud disk data; taking the dynamic key seed, the data type identifier, and the data size parameter as inputs of the key derivation function, performing a key expansion operation through the key derivation function to generate the dynamic encryption key.

[0082] The dynamic key seed is the basis for generating a dynamic encryption key, and the dynamic key seed can be generated based on user identity, device identifier, timestamp, and other information. After obtaining the dynamic key seed, in order to generate a dynamic encryption key for encrypting the target cloud disk data, first, the relevant attribute information of the target cloud disk data needs to be obtained.

[0083] Obtaining a data type identifier and a data size parameter of the target cloud disk data. The data type identifier is used to represent the type of the target cloud disk data, such as text type, image type, audio type, video type, or binary data type, etc. Different types of data may need to use different encryption strategies when encrypted, so the data type identifier is an important input parameter for generating a dynamic encryption key. The data size parameter is used to represent the size or complexity of the target cloud disk data, such as file size, data block number, or data structure hierarchy, etc. The data size parameter can affect the complexity and strength of key generation, and for large-scale data, a stronger encryption key may be needed.

[0084] The specific acquisition method can be achieved by analyzing the metadata information of the target cloud disk data. For example, the data type identifier can be determined by reading the file extension or header information; the data size parameter can be determined by calculating the file size or data block number. In some embodiments, the data size parameter can be further divided into two parameters of total data size and data block size to support the scenario of block encryption.

[0085] The dynamic key seed, data type identifier, and data size parameter are taken as inputs of a key derivation function. A key derivation function is a function that can derive one or more keys from an initial key material (in this case, the dynamic key seed). In one embodiment, HKDF (HMAC-based Key Derivation Function) can be used as the key derivation function, which is a key derivation function based on HMAC and has good security and scalability.

[0086] Before inputting the parameters into the key derivation function, the parameters need to be preprocessed. First, the data type identifier is converted into a fixed-length byte array. For example, the text type identifier can be converted into the corresponding ASCII code value. The data size parameter is converted into a byte array. For example, the file size can be converted into an 8-byte long integer representation. Then, the dynamic key seed, the converted data type identifier byte array, and the data size parameter byte array are concatenated into a complete input byte array.

[0087] The key expansion operation is performed by the key derivation function to generate the dynamic encryption key. In the case of using HKDF as the key derivation function, the key expansion operation is divided into two stages: the extraction stage and the expansion stage. In the extraction stage, the input dynamic key seed and data attribute information are converted into a fixed-length pseudo-random key by the HMAC algorithm. In the expansion stage, the dynamic encryption key of the required length is generated based on the pseudo-random key generated in the extraction stage.

[0088] In specific implementation, first, SHA-256 hash algorithm is used as the basis of HMAC, the dynamic key seed is taken as the key, and the concatenation result of the data type identifier and the data size parameter is taken as the message. The HMAC operation is performed to obtain the pseudo-random key in the extraction stage. Then, the pseudo-random key is used as a new key, combined with a counter and application information (such as the "encryption" string), and the HMAC operation is performed multiple times until a key material of sufficient length is generated. Finally, the part of the required length is taken from the generated key material as the final dynamic encryption key.

[0089] To enhance security, an additional random factor can be added in the key derivation process. For example, a randomly generated salt value can be added to the input of the key derivation function to prevent rainbow table attacks; or an iteration number parameter can be added to the key derivation function to increase the computational complexity of key generation through multiple iterations, thereby enhancing the ability to resist brute force cracking.

[0090] The generated dynamic encryption key can be directly used for encrypting the target cloud disk data, or can be used as a master key to further derive a sub-key for different data blocks. In the block encryption scenario, a dedicated encryption key for each data block can be generated based on the master key and the data block index using the same key derivation function, thereby realizing a more flexible encryption strategy.

[0091] The dynamic encryption key generated by the above method has high randomness and unpredictability, and is closely related to the attributes of the target cloud disk data, which can effectively improve the security of cloud disk data encryption. At the same time, since the data type and size are considered in the key generation process, the encryption strategy can better adapt to different types and sizes of cloud disk data, providing a more flexible and efficient data protection mechanism.

[0092] In an optional implementation, the position information of the data fragment in the target cloud disk data and the fragment encryption key corresponding to the dynamic encryption key of the data fragment are used to encrypt the data fragment using the fragment encryption key.

[0093] The starting position offset and data length of the data fragment in the target cloud disk data are determined, and the starting position offset and the data length are combined to form the position information of the data fragment;

[0094] The key feature component is extracted from the dynamic encryption key, the key feature component includes the timing information of the authentication process and the attribute information of the target cloud disk data; the position information of the data fragment and the key feature component are fused to generate a position-related key factor of the data fragment;

[0095] Based on the position-related key factor of the data fragment, the fragment encryption key corresponding to the data fragment is generated through a key derivation function, so that the fragment encryption key is associated with the position information of the data fragment, the timing information of the authentication process and the attribute information of the target cloud disk data;

[0096] The original data content in the data fragment is extracted; the original data content is encrypted using the fragment encryption key to generate encrypted data content; the encrypted data content and the position information of the data fragment are bound to form the encrypted data fragment corresponding to the data fragment.

[0097] In this embodiment, in order to realize the secure storage of cloud disk data, a data fragment encryption method based on position information and dynamic key is proposed. The method first determines the position information of the data fragment in the target cloud disk data, then generates a fragment encryption key dedicated to the data fragment in combination with a dynamic encryption key, and finally encrypts the data fragment using the fragment encryption key.

[0098] In the implementation process, first, the target cloud disk data is sharded, which is divided into multiple data shards. For each data shard, the following steps are performed for encryption processing:

[0099] The position information of the data shard in the target cloud disk data is determined. Specifically, the offset of the data shard relative to the starting position of the target cloud disk data is calculated, denoted as offset, which is usually in bytes. At the same time, the data length of the data shard is determined, denoted as length, also in bytes. Combine offset and length to form a position descriptor as the position information of the data shard. For example, offset and length can be concatenated into a string "offset:length", or constructed into a data structure containing two fields.

[0100] Extract the key feature component from the dynamic encryption key. The dynamic encryption key is generated during user authentication, containing authentication timing information and attribute information of the target cloud disk data. The authentication timing information can include authentication timestamp, session validity period, etc.; the attribute information of the target cloud disk data can include data owner ID, data type identifier, creation time, etc. Extract these information from the dynamic encryption key to form the key feature component.

[0101] Perform fusion operation on the position information of the data shard and the key feature component to generate the position-related key factor. Fusion operation can be performed in various ways, for example, a hash function can be used to connect the position information and the key feature component and then perform hash, i.e. hash(position information | key feature component); or use XOR operation, XOR the binary representation of the position information and the key feature component; or use more complex operation, such as HMAC (Hash-based Message Authentication Code), use the key feature component as the key and the position information as the message to calculate, i.e. HMAC(key feature component, position information). Through these fusion operations, the position-related key factor obtained will be associated with the position and authentication information of the data shard.

[0102] Based on the location-related key factor, a sharded encryption key is generated through a key derivation function. A key derivation function (KDF) is able to derive one or more keys from an initial key material. In this method, a location-related key factor is used as input to generate a sharded encryption key for encrypting a specific data shard through a KDF. Commonly used KDFs include PBKDF2 (Password-Based Key Derivation Function 2), HKDF (HMAC-based Extract-and-Expand Key Derivation Function), etc. For example, HKDF can be used to generate a key material suitable for use by an encryption algorithm, using the location-related key factor as input. The generated sharded encryption key will associate the location information of the data shard, the timing information of the authentication process, and the attribute information of the target cloud disk data at the same time, ensuring that even if the attacker obtains part of the information, the correct encryption key cannot be derived.

[0103] The original data content in the data shard is extracted. For each data shard, the original data content that needs to be protected is separated out. The original data content refers to the part of the user data actually stored in the data shard, excluding the metadata or tag information that may be attached.

[0104] The original data content is encrypted using the sharded encryption key to generate encrypted data content. The encryption transformation can use a symmetric encryption algorithm such as AES (Advanced Encryption Standard) to encrypt the original data content using the sharded encryption key. The encryption mode can choose CBC (Cipher Block Chaining), CTR (Counter), or GCM (Galois / Counter Mode), etc. For example, using the AES-256-GCM mode, not only can data confidentiality be provided, but also integrity protection.

[0105] The encrypted data content is bound with the location information of the data shard to form an encrypted data shard. The binding operation can be achieved by prefixing or suffixing the location information to the encrypted data, or constructing a data structure containing the location information and the encrypted data. This binding ensures that the encrypted data shard can be correctly positioned when decrypted, and prevents the data shard from being incorrectly rearranged or replaced.

[0106] Through the above steps, each shard of the target cloud disk data is encrypted, and finally all the encrypted data shards are combined to form complete encrypted cloud disk data. This method integrates the position information of the data shard into the generation process of the encryption key, so that each data shard has a unique encryption key related to its position, significantly improving data security. Even if an attacker obtains the encrypted content of some data shards, it is difficult to decrypt or recombine the original data, because decryption requires simultaneous knowledge of the dynamic encryption key, authentication information, and correct position information.

[0107] In an optional implementation, the generation of the shard encryption key corresponding to the data shard based on the position-related key factor of the data shard through the key derivation function includes:

[0108] Extracting a position feature component and a key feature component from the position-related key factor of the data shard, performing numerical mapping transformation on the position feature component to generate a position-related transformation parameter;

[0109] Cross-mixing the key feature component and the position-related transformation parameter to generate a mixed key vector, so that the mixed key vector simultaneously embodies the position feature of the data shard and the timing information of the authentication process;

[0110] Taking the mixed key vector as a first input parameter of the key derivation function; obtaining a data content digest of the data shard, and taking the data content digest as a second input parameter of the key derivation function;

[0111] Performing iterative expansion operation on the first input parameter and the second input parameter through the key derivation function to generate the shard encryption key corresponding to the data shard.

[0112] Extracting a position feature component and a key feature component from the position-related key factor of the data shard. The position feature component can contain the logical position information of the data shard in the overall data, such as shard index, physical storage address, or data block identifier; while the key feature component carries timing information or encryption-related parameters generated in the authentication process. The extraction process can be implemented by bit operation, for example, assuming that the position-related key factor is a 128-bit binary data, the high 64 bits can be taken as the position feature component and the low 64 bits can be taken as the key feature component.

[0113] Next, a numerical mapping transformation is performed on the location feature component to generate a location-dependent transformation parameter. This transformation can be a non-linear mapping function that ensures sufficient diversity in the generated transformation parameter even for adjacent locations. In a specific implementation, a polynomial mapping function can be used, such as bringing each byte value of the location feature component into a polynomial equation for calculation. For example, assuming the location feature component is 8 bytes [b0, b1,..., b7], a mapping can be constructed as follows: f(b) = (b0^3 + b1^2*b2 + b3*b4 + b5 + b6*b7) mod 256, thereby converting the location feature into a new set of byte values to form the location-dependent transformation parameter.

[0114] Subsequently, the key feature component is cross-mixed with the location-dependent transformation parameter to generate a mixed key vector. Cross-mixing can be achieved through operations such as XOR, substitution, permutation, etc. This step ensures that the generated mixed key vector embodies both the location feature of the data slice and the timing information of the authentication process. For example, the key feature component can be bit-wise XORed with the location-dependent transformation parameter, then byte-level substitution is performed based on the result, and finally overall permutation is performed to produce a highly confused mixed key vector.

[0115] After obtaining the mixed key vector, it is used as the first input parameter of the key derivation function. The key derivation function can be constructed based on a cryptographically secure hash function, such as HMAC-SHA256 or PBKDF2, etc. This choice ensures the security and irreversibility of the key derivation process.

[0116] The data content digest of the data slice is obtained and used as the second input parameter of the key derivation function. The data content digest can be calculated by applying a hash function such as SHA-256 to the data slice content, which associates the generated key with the data content itself, enhancing security. For example, when the data content is "sensitive_data_block", its SHA-256 digest value will be used as the second input parameter.

[0117] The first input parameter and the second input parameter are subjected to an iterative expansion operation by the key derivation function to generate a slice encryption key corresponding to the data slice. The iterative expansion operation can use standard algorithms such as HKDF (HMAC-based Key Derivation Function) to expand the initial input into key material of the required length through multiple rounds of hash calculation. In a specific implementation, the mixed key vector and the data content digest can be concatenated first, then the HKDF algorithm is applied, with appropriate salt values and iteration counts specified, to finally generate a slice encryption key of the required length to meet the encryption requirements.

[0118] In practical application scenarios, the key derivation mechanism based on location and content can effectively cope with the security protection needs of data shards in a storage system. For example, in a distributed storage system, even if an attacker obtains some data shards, due to the lack of complete location-related information and authentication timing information, the attacker cannot derive the correct shard encryption key, thereby ensuring the security of the overall data. At the same time, this scheme also facilitates the implementation of fine-grained access control, allowing different users to access different data shards, thereby enhancing the flexibility and security of the system.

[0119] Through the above technical solution, location-aware encryption protection of data shards is achieved, so that the encryption key of each data shard is closely bound to its location information and content characteristics, significantly improving data security and attack resistance.

[0120] The data security storage system based on the cloud disk according to the embodiment of the application comprises:

[0121] The first unit is configured to obtain an access request initiated by a user for target cloud disk data, wherein the access request carries a user identifier; based on the user identifier, extract a combination of authentication factors corresponding to the user identifier from a preset multi-factor authentication configuration, wherein the combination of authentication factors comprises at least two authentication factors of different types, and sequentially complete verification of each authentication factor to obtain an authentication result.

[0122] The second unit is configured to, when the authentication result is verified, generate a dynamic key seed associated with the user identifier and an authentication time based on the verification process data of each authentication factor in the combination of authentication factors, and generate a dynamic encryption key for encrypting the target cloud disk data based on the dynamic key seed through a key derivation function.

[0123] The third unit is configured to divide the target cloud disk data into a plurality of data shards, and for each data shard, generate a shard encryption key corresponding to the data shard based on the location information of the data shard in the target cloud disk data and the dynamic encryption key, encrypt the data shard using the shard encryption key to obtain an encrypted data shard, and store all encrypted data shards to a cloud storage node, and establish a mapping relationship between the user identifier, the authentication time, and the storage location of the target cloud disk data.

[0124] In a third aspect, the embodiment of the application provides an electronic device, comprising:

[0125] a processor;

[0126] a memory for storing processor-executable instructions;

[0127] The processor is configured to invoke instructions stored in the memory to perform the method described above.

[0128] In a fourth aspect, the present application provides a computer readable storage medium having stored thereon computer program instructions, which when executed by a processor, implement the method described above.

[0129] The present application can be a method, apparatus, system, and / or computer program product. The computer program product can include a computer readable storage medium having computer readable program instructions stored therein, which, when executed by a processor, perform various aspects of the present application.

[0130] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A cloud disk-based data security storage method, characterized in that, The method comprises the following steps: obtaining an access request initiated by a user for target cloud disk data, the access request carrying a user identifier; based on the user identifier, extracting a combination of authentication factors corresponding to the user identifier from a preset multi-factor authentication configuration, the combination of authentication factors including at least two different types of authentication factors, and sequentially completing verification of each authentication factor to obtain an authentication result; when the authentication result is verified, generating a dynamic key seed associated with the user identifier and the authentication time based on the verification process data of each authentication factor in the combination of authentication factors, and generating a dynamic encryption key for encrypting the target cloud disk data based on the dynamic key seed through a key derivation function; 2. The method of claim 1, wherein, dividing the target cloud disk data into multiple data shards, and for each data shard, generating a shard encryption key corresponding to the data shard based on the location information of the data shard in the target cloud disk data and the dynamic encryption key, encrypting the data shard using the shard encryption key to obtain an encrypted data shard; storing all encrypted data shards to a cloud storage node, and establishing a mapping relationship between the user identifier, the authentication time and the storage location of the target cloud disk data. extracting a combination of authentication factors corresponding to the user identifier from a preset multi-factor authentication configuration based on the user identifier and sequentially completing verification of each authentication factor includes: querying the preset multi-factor authentication configuration based on the user identifier to obtain a set of authentication factor types bound to the user identifier and verification constraint conditions corresponding to each authentication factor type; based on the security level of each authentication factor type in the set of authentication factor types, determining the verification order of each authentication factor in the combination of authentication factors; according to the verification order, for the current authentication factor to be verified, sending a verification request corresponding to the authentication factor to the user terminal, the verification request including the type identifier of the authentication factor and the verification mode indication; receiving the verification response data returned by the user terminal for the authentication factor, and extracting the authentication feature in the verification response data; matching the authentication feature with the verification constraint condition corresponding to the authentication factor, when the authentication feature satisfies the verification constraint condition, recording the authentication timestamp, the authentication feature and the position sequence number of the authentication factor in the verification order as the verification process data of the authentication factor; 3. The method of claim 1, wherein, determining whether there is an unverified authentication factor in the combination of authentication factors, when there is an unverified authentication factor, returning to execute the step of sending the authentication request corresponding to the authentication factor to the user terminal, when all authentication factors in the combination of authentication factors are verified and each authentication feature satisfies the corresponding verification constraint condition, determining that the authentication result is verified, and combining the verification process data of all authentication factors to form an authentication process data set. generating a dynamic key seed associated with the user identifier and the authentication time based on the verification process data of each authentication factor in the combination of authentication factors includes: Time-varying characteristic parameters are extracted from the authentication process data of each authentication factor, and the time-varying characteristic parameters include a verification timestamp of each authentication factor and the authentication time; for each authentication factor, the time-varying characteristic parameters of the authentication factor are associated and mapped with the authentication characteristics corresponding to the authentication factor in the authentication factor combination, to generate a time sequence characteristic vector corresponding to the authentication factor; According to the verification order of each authentication factor in the authentication factor combination, the time sequence characteristic vectors corresponding to all authentication factors are sequentially spliced to form an authentication sequence characteristic; the user identifier, the authentication time and the authentication sequence characteristic are combined, and an irreversible transformation is performed on the combination result to generate the dynamic key seed.

4. The method of claim 3, wherein, Based on the dynamic key seed, a dynamic encryption key for encrypting the target cloud disk data is generated through a key derivation function, including: Obtaining the data type identifier and data size parameter of the target cloud disk data; taking the dynamic key seed, the data type identifier and the data size parameter as inputs of the key derivation function, performing key expansion operation through the key derivation function to generate the dynamic encryption key.

5. The method of claim 1, wherein, Based on the location information of the data fragment in the target cloud disk data and the dynamic encryption key, a fragment encryption key corresponding to the data fragment is generated, and the data fragment is encrypted using the fragment encryption key, including: Determine the starting position offset and data length of the data fragment in the target cloud disk data, and combine the starting position offset and the data length to form the location information of the data fragment; Extract a key feature component from the dynamic encryption key, the key feature component containing time sequence information of the authentication process and attribute information of the target cloud disk data; perform fusion operation on the location information of the data fragment and the key feature component to generate a location-related key factor of the data fragment; Based on the location-related key factor of the data fragment, a fragment encryption key corresponding to the data fragment is generated through a key derivation function, so that the fragment encryption key is associated with the location information of the data fragment, the time sequence information of the authentication process and the attribute information of the target cloud disk data at the same time; Extract the original data content in the data fragment; perform encryption transformation on the original data content using the fragment encryption key to generate encrypted data content; bind the encrypted data content with the location information of the data fragment to form an encrypted data fragment corresponding to the data fragment.

6. The method of claim 5, wherein, Based on the location-related key factor of the data fragment, a fragment encryption key corresponding to the data fragment is generated through a key derivation function, including: Extract a location feature component and a key feature component from the location-related key factor of the data fragment, perform numerical mapping transformation on the location feature component to generate a location-related transformation parameter; Cross-mix the key feature component and the location-related transformation parameter to generate a mixed key vector, so that the mixed key vector simultaneously embodies the location feature of the data fragment and the time sequence information of the authentication process; The mixed key vector is taken as a first input parameter of the key derivation function; a data content digest of the data slice is obtained, and the data content digest is taken as a second input parameter of the key derivation function; The first input parameter and the second input parameter are subjected to an iterative expansion operation by the key derivation function, to generate a slice encryption key corresponding to the data slice.

7. A cloud disk based data security storage system for implementing the method of any one of claims 1-6, characterized in that, Comprise: A first unit is configured to obtain an access request initiated by a user for target cloud disk data, the access request carrying a user identifier; based on the user identifier, extract a combination of authentication factors corresponding to the user identifier from a preset multi-factor authentication configuration, the combination of authentication factors including at least two different types of authentication factors, and sequentially complete the verification of each authentication factor to obtain an authentication result; A second unit is configured to, when the authentication result is verified, generate a dynamic key seed associated with the user identifier and an authentication time according to the verification process data of each authentication factor in the combination of authentication factors, and generate a dynamic encryption key for encrypting the target cloud disk data based on the dynamic key seed through a key derivation function; A third unit is configured to divide the target cloud disk data into a plurality of data slices, and for each data slice, generate a slice encryption key corresponding to the data slice based on the location information of the data slice in the target cloud disk data and the dynamic encryption key, encrypt the data slice using the slice encryption key to obtain an encrypted data slice; store all encrypted data slices to a cloud storage node, and establish a mapping relationship between the user identifier, the authentication time and the storage location of the target cloud disk data.

8. An electronic device, comprising: Comprise: A processor; A memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method of any one of claims 1 to 6.

9. A computer-readable storage medium having stored thereon computer program instructions, wherein, The computer program instructions are executed by the processor to implement the method of any one of claims 1 to 6.

Images