A distributed file encryption storage method and system based on dynamic strategy and quantum enhancement

Abstract

The application discloses a kind of distributed file encryption storage method and system based on dynamic strategy and quantum enhancement, comprising the following steps: S1, the file is preprocessed and then fragmented;S2, the file after fragmentation is layered dynamically encrypted;S3, the file after encryption and the corresponding key fragment are stored in a distributed manner;S4, the stored file and key are managed in a double-blockchain collaborative manner.The problem of coarse encryption granularity in traditional encryption is solved, and the attack cost is increased through three-level encryption of file→fragment→sub-fragment;The risk of "key-data coexistence" is broken, and a zero-trust security architecture is realized through physical isolation storage;The performance bottleneck of single chain is solved by double-chain division, and the operation log and key are separated for storage evidence to meet the audit requirements of GDPR.

Description

Technical Field

[0001] This invention relates to the field of distributed storage and data security technology, and in particular to a distributed file encryption storage method and system based on dynamic strategies and quantum enhancement. Background Technology

[0002] With the development of cloud computing and AI industries, distributed storage has gradually become the mainstream choice for data centers due to its low cost, high storage capacity and easy expansion. Distributed storage uses high-speed interconnected storage servers as the hardware foundation to build a distributed file system. It uses virtualization technology to merge several storage nodes into a storage pool and provides unified storage services to the outside world. It has the advantages of convenient and simple management, low technical difficulty, cost savings and easy expansion.

[0003] However, due to the discrete distribution of data structures in distributed file systems, it is difficult to effectively encrypt data in a single storage node, posing a security risk. Although data center security architectures can prevent external attacks to a certain extent through access control, they cannot prevent data leakage from within. Secondly, a user's data is often stored in a cloud subsystem, which means that the data is concentrated in a certain data center, resulting in single points of failure due to network, power supply, etc. Once the cloud system fails and the data is lost, it cannot be recovered.

[0004] Improving the security of data stored in distributed storage is a technical problem that needs to be solved. Summary of the Invention

[0005] This invention aims to propose a distributed file encryption storage method and system based on dynamic strategies and quantum enhancement, in order to solve the problem of how to improve the security of data stored in distributed storage in the prior art.

[0006] This invention proposes a distributed file encryption storage method based on dynamic strategy and quantum enhancement, including the following steps: S1, preprocessing the file and then fragmenting it; S2, performing layered dynamic encryption on the fragmented file; S3, distributing the encrypted file and the corresponding key fragments for storage; S4, performing dual-blockchain collaborative management on the stored file and key.

[0007] Further, step S1 includes the step of: dividing the original file F into m data fragments using an erasure coding algorithm. For each data shard n sub-shards are generated using a secret sharing algorithm. , where any Each sub-part can be reconfigured. .

[0008] Further, step S2 includes the step of: for each sub-segment The logic for generating a dynamic encryption key is as follows: FileID is the unique identifier for the file. Identify the target storage node; insert the fragment into the corresponding storage node according to the storage node allocation, and then use the storage node's public key. Asymmetric encryption is applied to the corresponding sub-shards; the encryption logic is as follows: .

[0009] Further, step S3 includes the step of: transferring the dynamic encryption key. Divide into t key fragments The original key can be reconstructed if the threshold value r (r≤t) is met; the key is stored in a separate first blockchain network; the storage location metadata is encrypted and stored in a second blockchain network; wherein, the metadata includes file identifier FileID, key segment storage transaction hash TxHash_Key, and ciphertext sub-segment storage node mapping table.

[0010] Further, step S3 includes: S31, execution of the key management chain, including: releasing the key sharding threshold through a smart contract; recording key operation audit logs; node identity authentication management; S32, execution of the file storage chain, including: traversing the hash tree of the stored file feature values; recording file access operation events; associating the key management chain transaction certificate; S33, determining whether the file storage chain requester has the necessary permissions; if yes, proceed to step S34; if no, refuse to match and authenticate the key and file storage; S34, determining whether the signature of the key management chain meets the preset requirements; if yes, release the key to open the file; if no, refuse to match and authenticate the key and file storage.

[0011] Furthermore, the signature preset requirements of the key management chain include the number of valid signatures collected by the key management chain and the validity period of the timestamp.

[0012] Furthermore, the allocation steps of the storage nodes include: constructing a node trustworthiness evaluation model; and sharding the ciphertext sub-data. Nodes are sorted in descending order of TrustScore, with the top p% of high-scoring nodes stored as core sub-shards. The remaining sub-shards are distributed across nodes in different physical domains. When a node's TrustScore drops below a threshold... When the time comes, the sub-shards will be automatically migrated to the backup high-trust node, triggering the node migration.

[0013] Furthermore, the calculation formula for the constructed node credibility evaluation model is as follows: ; in, Uptime_j represents the node online rate, Reputation_j represents the historical service rating, and FailureRate_j represents the failure rate.

[0014] The present invention also provides a distributed file encryption storage system based on dynamic strategy and quantum enhancement, which uses the above-mentioned distributed file encryption storage method based on dynamic strategy and quantum enhancement to encrypt and store distributed files.

[0015] The distributed file encryption storage method and system based on dynamic strategy and quantum enhancement of the present invention have the following advantages: To address the issue of coarse-grained encryption in traditional methods, a three-level encryption approach—file → sharding → sub-sharding—is used to increase the cost of attacks. It also overcomes the risk of "key-data coexistence" by implementing a zero-trust security architecture through physically isolated storage. Dual-chain division of labor addresses the performance bottleneck of a single chain, and the separate storage of operation logs and keys meets GDPR audit requirements. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 The diagram shown is a system framework diagram of an embodiment of the present invention.

[0017] Figure 2 The diagram shows the verification flowchart of the dual-chain collaborative verification in this invention. Detailed Implementation

[0018] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0019] This invention provides a distributed file encryption and storage method based on dynamic strategy and quantum enhancement, comprising the following steps: S1, preprocessing the file and then fragmenting it; S2, performing layered dynamic encryption on the fragmented file; S3, distributing the encrypted file and corresponding key fragments; S4, managing the stored file and key through a dual-blockchain collaborative system. In a preferred embodiment, step S1 includes the step of: dividing the original file F into m data fragments using an erasure coding algorithm. For each data shard n sub-shards are generated using a secret sharing algorithm. Among them, any k (k≤n) sub-partitions can be reconstructed. Step S2 includes the following steps: for each sub-segment The logic for generating a dynamic encryption key is as follows: (,Timestamp); where FileID is the unique identifier of the file. Identify the target storage node; insert the fragment into the corresponding storage node according to the storage node allocation, and then use the storage node's public key. Asymmetric encryption is applied to the corresponding sub-shards; the encryption logic is as follows: Step S3 includes the step of: transferring the dynamic encryption key. Divide into t key fragments The original key can be reconstructed if a threshold value r (r≤t) is met; key fragments are stored in an independent first blockchain network; the storage location metadata is encrypted and stored in a second blockchain network; wherein, the metadata includes file identifier FileID, key fragment storage transaction hash TxHash_Key, and ciphertext sub-fragment storage node mapping table. Step S3 includes: S31, execution of the key management chain, including: releasing the key fragment threshold through a smart contract; recording key operation audit logs; node identity authentication management; S32, execution of the file storage chain, including: traversing the hash tree of the stored file feature value; recording file access operation events; associating the key management chain transaction certificate; S33, determining whether the file storage chain requester has the authority; if yes, proceed to step S34; if no, refuse to match and authenticate the key and file storage; S34, determining whether the signature of the key management chain meets the preset requirements; if yes, release the key to open the file; if no, refuse to match and authenticate the key and file storage. The key management chain's signature preset requirements include the number of valid signatures collected by the key management chain and the validity period of the timestamp. The allocation steps for the storage nodes include: constructing a node trustworthiness assessment model; and fragmenting the ciphertext. Nodes are sorted in descending order of TrustScore, with the top p% of high-scoring nodes stored as core sub-shards. The remaining sub-shards are distributed across nodes in different physical domains. When a node's TrustScore drops below a threshold... When this occurs, the sub-shard is automatically migrated to a backup high-trust node, triggering node migration. The calculation formula for the constructed node trustworthiness assessment model is as follows: ;in, Uptime_j represents the node online rate, Reputation_j represents the historical service rating, and FailureRate_j represents the failure rate.

[0020] The present invention also provides a distributed file encryption storage system based on dynamic strategy and quantum enhancement, which uses the above-mentioned distributed file encryption storage method based on dynamic strategy and quantum enhancement to encrypt and store distributed files.

[0021] The following example uses the PACS (Picture Archiving System) of a top-tier hospital. Figure 1 As shown, the hospital needs to store 100,000 patient DICOM image files per year. This requires compliance with medical data security standards (HIPAA / Information Security Level 3.0), cross-hospital disaster recovery (Beijing / Shanghai / Guangzhou data centers), and tiered access control for attending physicians.

[0022] Case file: Brain CT image of patient Zhang (DICOM format, 128MB); Operator: Director Li (Access Level A).

[0023] The first step is to preprocess the file and generate: Then, it is fragmented; The sharding code is as follows: parameter: (Fault tolerance 3-part loss); Generate 8 16MB data fragments For each Di, perform a second partition (Shamir parameters: n=7, k=4). for Di in DataFragments: There are a total of 56 sub-shards.

[0024] The second step involves layered dynamic encryption: Segmentation for sub-slices (Belonging to D1) Generate dynamic key: ; Encryption using the public key of Shanghai node SH02: curve.

[0025] The third step is to perform credibility scheduling:

[0026] Table 1 shows the specific dynamic scheduling display for reliability-based scheduling. The top 30% of highly trusted nodes (TrustScore>0.9) store critical sub-shards (k=4 required sub-shards for each Di), while the remaining nodes store redundant sub-shards.

[0027] The fourth step is to perform key separation and evidence preservation: The evidence storage code is as follows: Secure Storage Agent -> Key Management Chain: Submit { Divided into 5 pieces, 3 pieces need to be reconstructed. } Key Management Chain --> Secure Storage Proxy: TxHash_Key=0xK123 Secure Storage Agent -> File Evidence Chain: Submit {

[0028] } File evidence storage chain --> Secure storage agent: TxHash_File=0xF456.

[0029] In addition, after storage is complete, file retrieval and verification are usually required. The retrieval and verification process is as follows: For example, when a department head reviews the image for a consultation, the first step is to perform a dual-chain collaborative verification, the verification process of which is as follows: Figure 2 As shown.

[0030] Then, layered decryption and reconstruction are performed, and the client obtains... Decrypt the data layer by layer, using equal sub-shards (at least 4 sub-shards for each Di). Then perform integrity verification and calculate... (Compare with FileID), and once verification is successful, the image can be displayed. The decryption code in Mathematica is as follows: / / First layer: Node private key decryption / / Second layer: Dynamic key decryption (requires reconstruction) ) Reconstructing D1 from any 4 sub-slices / / File Reorganization Reconstructing files from any 5 data fragments The technical solution provided by this invention can achieve the following: To defend against node intrusion attacks, a simulation was performed where the Shanghai node SH02 was compromised (private key leakage). The protection mechanism ensured that the attacker only obtained... (A single subshard) cannot reconstruct D1 (at least 4 subshards are required), and the key management chain rejects the unauthorized signature request; only 0.18% of the data (i.e., 1 / 56 of the subshards) is lost. Dynamic failover was implemented, simulating a power outage in the Beijing data center (BJ03 node went offline, TrustScore dropped to 0); subsequently, the system responded, the trust scheduler detected the failure of BJ03; it automatically migrated the core sub-shards stored thereto to the Guangzhou high-trust node GZ05 (TrustScore=0.88); the file evidence chain updated the encrypted mapping table (new transaction 0xF789); the recovery time was only 1.3 seconds.

[0031] Audit traceability security For example, it can trace Director Li's access on a specific day, month, year, hour, and minute; the document storage chain includes: permission verification record (Tx:0xQ123); the key management chain includes: key release signature (participating nodes: SH02 / BJ01 / GZ05); the operation process can be clearly recorded, facilitating auditing and tracing.

[0032] Based on actual data testing, the actual technical performance of this method and system is shown in the table below:

[0033] Table 2 shows a comparison of the technical performance of this invention.

[0034] Table 3 shows the technical solutions and corresponding effects of this invention. Therefore, the distributed file encryption storage method and system based on dynamic strategy and quantum enhancement provided by this invention solves the problem of coarse granularity of traditional encryption, improves the cost of attack through three-level encryption of file → fragmentation → sub-fragmentation; breaks the risk of "key-data coexistence", and achieves a zero-trust security architecture through physical isolation storage; the dual-chain division of labor solves the performance bottleneck of single chain, and the operation log and key are stored separately to meet GDPR audit requirements.

[0035] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A distributed file encryption storage method based on dynamic strategy and quantum enhancement, characterized in that, Including the following steps: S1. After preprocessing the file, it is divided into fragments; step S1 includes the following steps: dividing the original file F into m data fragments using an erasure coding algorithm. For each data shard n sub-shards are generated using a secret sharing algorithm. Among them, any k (k≤n) sub-partitions can be reconstructed. ; S2. Perform layered dynamic encryption on the fragmented files; step S2 includes the following steps: for each sub-fragment The logic for generating a dynamic encryption key is as follows: FileID is the unique identifier for the file. Identify the target storage node; insert the fragment into the corresponding storage node according to the storage node allocation, and then use the storage node's public key. Asymmetric encryption is applied to the corresponding sub-shards; the encryption logic is as follows: ; S3. Distribute the encrypted file and its corresponding key fragments for storage; step S3 includes the following steps: storing the dynamic encryption key... Divide into t key fragments The original key can be reconstructed if the threshold value r (r≤t) is met; the key fragments are stored in an independent first blockchain network; the storage location metadata is encrypted and stored in a second blockchain network; wherein, the metadata includes file identifier FileID, key fragment storage transaction hash TxHash_Key, and ciphertext sub-fragment storage node mapping table; The allocation steps for the storage nodes include: constructing a node trustworthiness assessment model; and fragmenting the ciphertext sub-shards. Sort by TrustScore in descending order, store the top p% high-scoring nodes as core sub-shards, and distribute the remaining sub-shards across nodes in different physical domains; when a node's TrustScore drops below the threshold δ, the sub-shard is automatically migrated to a backup high-trust node, triggering node migration. S4. Perform dual-blockchain collaborative management of the stored files and keys.

2. The distributed file encryption storage method based on dynamic strategy and quantum enhancement according to claim 1, characterized in that, Step S3 includes: S31. Execution of the key management chain, including: Key sharding threshold release is achieved through smart contracts; Record key operation audit logs; Node identity authentication management; S32. Execution of the document evidence chain, including: Traverse the hash tree containing the feature values ​​of the stored files; Record file access operation events; Associated key management chain transaction credentials; S33. Determine whether the requester of the document evidence chain has the necessary permissions; if yes, proceed to step S34; otherwise, refuse to match and authenticate the key and the document evidence. S34. Determine whether the signature of the key management chain meets the preset requirements; if yes, release the key to open the file; if no, refuse to match and authenticate the key and file.

3. The distributed file encryption storage method based on dynamic strategy and quantum enhancement according to claim 2, characterized in that, The signature preset requirements for the key management chain include the number of valid signatures collected by the key management chain and the validity period of the timestamp.

4. The distributed file encryption storage method based on dynamic strategy and quantum enhancement according to claim 3, characterized in that, The calculation formula for the constructed node credibility assessment model is as follows: ; in, , For node online rate, Rating for historical purposes This refers to the failure rate.

5. A distributed file encryption storage system based on dynamic strategy and quantum enhancement, characterized in that, The distributed file encryption storage method based on dynamic strategy and quantum enhancement as described in any one of claims 1-4 is used to encrypt and store distributed files.

Images