Computer cloud storage data full life cycle encryption protection method

Abstract

The invention provides a computer cloud storage data full-life-cycle encryption protection method which has the characteristics of full-life-cycle coverage, dynamic adaptive encryption and modular collaborative management, data sensitivity is dynamically evaluated and encryption parameters are adjusted through a context sensing model, accurate matching of encryption strength and security requirements is realized, and the security of the computer cloud storage data is improved. Excessive encryption or insufficient security is avoided; a distributed key management and homomorphic encryption technology is adopted, so that continuous security of data in transmission, storage and processing links is ensured, and the key leakage risk is reduced; by integrating access control, life cycle monitoring and safe destruction modules, an end-to-end protection system is constructed, threats such as unauthorized access, data tampering and residue leakage can be effectively defended, so that the confidentiality, integrity and availability of cloud storage data are remarkably improved, and meanwhile, the management cost and compliance risk are reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data storage, in particular to a computer cloud storage data full life cycle encryption protection method. BACKGROUND

[0002] With the rapid development and wide application of cloud computing technology, data storage gradually shifts from local to cloud. Cloud storage has become the preferred solution for enterprises and individuals to handle big data due to its advantages such as elastic expansion, low cost and convenient access. Cloud computing platforms provide massive data storage and processing capabilities through distributed architecture and virtualization technology, and are widely used in finance, medical care, government affairs and Internet of Things fields.

[0003] However, when data is stored in the cloud, it is often only encrypted and protected in a single link such as transmission or storage. For example, only the SSL / TLS protocol is used to protect the transmission channel, or only a static encryption algorithm (such as AES) is applied in the storage layer. This segmented encryption method cannot cover the full life cycle of data from generation, transmission, storage, processing to destruction, resulting in data exposure to potential risks in non-encrypted links. In the prior art, cloud storage security mainly relies on traditional encryption methods and access control mechanisms, but there are many limitations: first, the encryption strategy lacks dynamic adaptability and cannot adjust the encryption strength according to data sensitivity and context environment, resulting in resource waste or security deficiency; second, key management is centralized, which is prone to single point of failure, and the key generation and distribution process can be exploited by attackers; in addition, data often needs to be decrypted for processing, increasing the risk of leakage, while advanced technologies such as homomorphic encryption are limited due to large computational overhead; finally, data life cycle management is imperfect, lacking effective monitoring and destruction mechanisms, resulting in residual data that can be recovered. The existence of these problems makes cloud storage data face multiple threats such as unauthorized access, man-in-the-middle attacks, data tampering and leakage, especially in industries with strict compliance requirements (such as GDPR, HIPAA), data full life cycle security has become a rigid requirement.

[0004] Therefore, there is an urgent need in the art to develop an encryption protection method and system covering the full life cycle of data, which can dynamically adjust the encryption strategy, integrate key management, access control and security monitoring, and ensure that data is fully protected at every link in the cloud, thereby improving the overall security level. SUMMARY

[0005] The purpose of the present application is to provide a computer cloud storage data full life cycle encryption protection method to solve the problems existing in the prior art.

[0006] To achieve the above purpose, the present application provides the following solutions: The application provides a computer cloud storage data full life cycle encryption protection method, comprising the following steps: S1. Receiving raw data through a data intake module and extracting metadata, the metadata including data type, data size, data source, data owner and timestamp; S2. Calculating data sensitivity score based on the metadata using a machine learning model through a context analysis module, wherein the machine learning model adopts a logistic regression algorithm, and the formula is: ; Wherein, is a feature vector converted from metadata, is a weight vector, is the transpose of the weight vector, is a bias term; S3. Dynamically selecting encryption algorithm and encryption round number according to the data sensitivity score through an encryption strategy engine, wherein the calculation formula of the encryption round number is: ; Wherein, is the minimum encryption round number, is the maximum encryption round number, represents rounding down; S4. Deriving data encryption key based on master key and context parameters through a key management module, wherein the context parameters include data identifier, timestamp and the data sensitivity score, and the derivation formula is: ; Wherein, is the master key, is the context parameter; S5. Encrypting the raw data using the data encryption key and the encryption round number through an encryption execution module to generate encrypted data, wherein the encryption process includes block processing, initial permutation, encryption round cycle, the encryption round cycle including byte replacement, row shift, column mixing and round key addition operation; S6. Transmitting the encrypted data to a secure storage module through a secure transmission module, and ensuring transmission security using TLS / SSL protocol; S7. Distributively storing the encrypted data through a secure storage module, and recording metadata and access log; S8. Access control of the encrypted data based on user attributes and permissions through an access control module, wherein the access decision formula is: ; Wherein, is the access authorization result, 1 indicating allowing access and 0 indicating rejecting access, for user attributes, for weights, for thresholds; S9. Monitor the data state through the lifecycle management module, and trigger re-encryption or secure destruction operations according to the strategy; S10. Securely delete the data and its keys through the secure destruction module, using multiple overwriting or cryptographic wiping methods, and verify the destruction result through hash checking.

[0007] Preferably, in step S2, the training method of the machine learning model includes: Using a labeled data set, optimize the loss function through gradient descent method, the formula is: ; Where, is the number of samples, is the true label of the th sample, is the predicted sensitivity score of the th sample.

[0008] Preferably, in step S3, the dynamic selection of the encryption algorithm includes: Use AES-128 algorithm when S < 0.3; Use AES-192 algorithm when 0.3 ≤ S < 0.7; Use AES-256 algorithm when S ≥ 0.7.

[0009] Preferably, in step S5, the initial permutation uses a permutation table P, which is dynamically generated based on the data sensitivity score, and the generation function formula is: ; Where, The function generates a random permutation with the data sensitivity score as the seed.

[0010] Preferably, in step S7, distributed storage includes storing encrypted data in multiple cloud storage nodes in blocks, and dynamically adjusting the backup frequency based on damage probability statistics, where the damage probability statistics are calculated through historical data analysis and mathematical models.

[0011] Preferably, in step S8, the access control module uses homomorphic encryption processing, and uses algorithm to calculate encrypted data, the encryption formula is: ; Where, is part of the public key, is the plaintext, is a random number, This is the public key.

[0012] Preferably, in step S9, the data status includes creation, active, archived and destruction status, and the status transition is based on time strategy and access frequency strategy.

[0013] Preferably, in step S10, secure deletion includes repeatedly overwriting the storage location with random data and verifying the result using a secure destruction verification formula, which is: ; in, This is the data storage area.

[0014] This invention also provides a computer cloud storage data lifecycle encryption protection system for executing the above-described computer cloud storage data lifecycle encryption protection method, the system comprising: The data ingestion module is used to receive raw data and extract metadata; The context analysis module is used to calculate the data sensitivity score S based on metadata; The encryption strategy engine is used to dynamically select the encryption algorithm and the number of encryption rounds based on the data sensitivity score S; The key management module is used to generate, store, and manage data encryption keys; The encryption execution module is used to encrypt data using a data encryption key and a number of encryption rounds; A secure transmission module is used to ensure the security of encrypted data during transmission; A secure storage module is used for distributed storage and management of encrypted data; A security processing module is used to support homomorphic encryption computation; The access control module is used to control data access based on user permissions; The lifecycle management module is used to monitor data status and trigger encryption or destruction operations; The secure destruction module is used to securely delete data and its keys.

[0015] Preferably, the modules in the system are connected via a central control bus to enable coordinated management of data flow and control flow.

[0016] The present invention achieves the following beneficial technical effects compared to the prior art: This invention provides a method for full lifecycle encryption protection of computer cloud storage data, featuring full lifecycle coverage, dynamic adaptive encryption, and modular collaborative management. It achieves precise matching of encryption strength and security requirements by dynamically assessing data sensitivity and adjusting encryption parameters through a context-aware model, avoiding over-encryption or insufficient security. Distributed key management and homomorphic encryption technologies ensure continuous data security during transmission, storage, and processing, reducing the risk of key leakage. By integrating access control, lifecycle monitoring, and secure destruction modules, an end-to-end protection system is constructed, effectively defending against threats such as unauthorized access, data tampering, and residual leakage. This significantly improves the confidentiality, integrity, and availability of cloud storage data while reducing management costs and compliance risks. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 The flowchart of the computer cloud storage data full lifecycle encryption protection method provided by the present invention. Detailed Implementation

[0019] Unless otherwise specified, the terms "connection" and "linkage" used in this application include both direct and indirect connections (linkages). In the description of this invention, it should be understood that the terms "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," and "counterclockwise," etc., indicating orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention.

[0020] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can mean that the first feature is in direct contact with the second feature, or that the first feature is in indirect contact with the second feature through an intermediate medium. Furthermore, "above," "over," and "on top" of the second feature can mean that the first feature is directly above or diagonally above the second feature, or simply that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature can mean that the first feature is directly below or diagonally below the second feature, or simply that the first feature is at a lower horizontal level than the second feature.

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] The purpose of this invention is to provide a method for full lifecycle encryption protection of computer cloud storage data. By constructing a complete encryption system covering the entire process of data generation, transmission, storage, processing, and destruction, dynamic and adaptive protection of data security is achieved. The core of this method lies in introducing a context-aware mechanism, using machine learning models to dynamically assess data sensitivity, and adaptively adjusting the encryption strategy based on the assessment results, thereby optimizing system performance while ensuring security.

[0023] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0024] Example 1: This embodiment provides a method for full lifecycle encryption protection of computer cloud storage data, such as... Figure 1 As shown, the data ingestion module first receives raw data and extracts metadata. This metadata includes key information such as data type, data size, data source, data owner, and timestamp. This metadata is not only used for data management but also provides a foundation for subsequent sensitivity analysis. The data ingestion module employs a multi-threaded asynchronous processing mechanism to ensure efficient data reception under high concurrency, while simultaneously verifying data integrity and consistency through data validation algorithms.

[0025] Subsequently, the context analysis module calculates a data sensitivity score based on the extracted metadata using a pre-trained machine learning model. This model employs a logistic regression algorithm, and its formula is as follows: ; in, The feature vector is derived from metadata through normalization and one-hot encoding, and includes numerical encoding of data type, logarithmic scaling of data size, source credibility score, etc. The weight vector is obtained through model training, and its dimensions are... Consistent This is the transpose of the weight vector. is the bias term used to adjust the model output; e is the natural constant.

[0026] During model training, a labeled historical dataset is used, and the loss function is optimized using gradient descent. ; in, For the sample size, For the first The true labels of each sample (0 indicates insensitive, 1 indicates sensitive). For the first The prediction sensitivity score for each sample is the model's predicted value. During training, hyperparameters are adjusted through cross-validation to ensure the model's generalization ability.

[0027] The encryption policy engine dynamically selects the encryption algorithm and the number of encryption rounds based on the calculated data sensitivity score. The formula for calculating the number of encryption rounds is: ; in, This is the minimum number of encryption rounds (default value is 10). This is the maximum number of encryption rounds (default value is 20). This indicates rounding down to the nearest integer.

[0028] The encryption algorithm selection strategy is as follows: AES-128 is used when S < 0.3, AES-192 is used when 0.3 ≤ S < 0.7, and AES-256 is used when S ≥ 0.7. This dynamic adjustment mechanism ensures that highly sensitive data receives stronger encryption protection, while low-sensitivity data avoids the performance overhead caused by over-encryption.

[0029] The key management module derives the data encryption key DEK based on the master key MK and context parameters. The derivation formula is: ; in, The master key is stored in the hardware security module. Context parameters include the data identifier, timestamp, and data sensitivity score. The key derivation process employs Key Derivation Functions (KDFs) to enhance security, ensuring each data segment has an independent encryption key. Key storage utilizes a distributed keystore combined with a threshold secret sharing scheme to prevent single-point-of-disclosure risks.

[0030] The encryption execution module encrypts the original data using the data encryption key DEK and the encryption round number N. The encryption process includes block processing, initial permutation, and encryption round iteration. Block processing divides the data into 128-bit fixed-size blocks; the initial permutation uses a dynamically generated permutation table, whose generation function is: ; in, The function generates random permutations using the data sensitivity score as a seed to enhance encryption randomness; the encryption round cycle includes byte substitution (using AES S-Box), row shifting, column mixing (except in the last round), and round key addition. The encrypted data is output in matrix form to ensure consistent formatting.

[0031] The secure transmission module transmits encrypted data to the secure storage module via the TLS / SSL protocol. During transmission, a forward secure key exchange protocol (such as DHE or ECDHE) and a two-way authentication mechanism are used to prevent man-in-the-middle attacks. The transport layer encryption and the encryption of the data itself form a double protection, ensuring that the data content remains secure even if the transmission channel is breached.

[0032] The secure storage module distributes encrypted data across multiple cloud storage nodes, dividing the data into blocks and recording metadata and access logs. The storage strategy dynamically adjusts backup frequency based on corruption probability statistics. Corruption probability is calculated using a historical data analysis model, taking into account factors such as node failure rate, network outage frequency, and data access patterns. Backup operations employ asynchronous replication technology to ensure data consistency and availability.

[0033] The access control module makes access decisions based on user attributes and permissions, using the following formula: ; in, The access authorization result is 1, indicating that access is allowed, and 0, indicating that access is denied. For user attributes (such as role, department, security level). As weight, The threshold value is used. For the data to be calculated, the module supports homomorphic encryption processing, using... algorithm: ; in, It is a part of the public key (usually n+1). For plain text, It is a random number. This is the public key. This algorithm allows addition operations to be performed in an encrypted state, avoiding the risk of decryption during data processing.

[0034] The lifecycle management module monitors data status (including creation, active, archived, and destruction status), and state transitions are automatically triggered based on time and access frequency policies. For example, data that has not been accessed for a long time is automatically transferred to the archived state, triggering a re-encryption operation; data that has reached its retention period is transferred to the destruction queue. Re-encryption uses a newly derived data encryption key to ensure key validity.

[0035] The secure destruction module securely deletes the data and its keys using multiple random data overwriting algorithms (such as the DoD5220.22-M standard) or cryptographic erasure (making the data unrecoverable by deleting the key). The destruction result is verified via hash checksum. ; in, This is the data storage area. After successful verification, a destruction log is recorded to ensure compliance.

[0036] Example 2: This invention also provides a computer cloud storage data lifecycle encryption protection system, which includes a data ingestion module, a context analysis module, an encryption policy engine, a key management module, an encryption execution module, a secure transmission module, a secure storage module, a secure processing module, an access control module, a lifecycle management module, and a secure destruction module. All modules are connected via a central control bus to achieve collaborative management of data flow and control flow. The system adopts a microservice architecture, with modules communicating through API interfaces, supporting elastic scaling and fault isolation.

[0037] In summary, this invention achieves refined management of data security through a context-aware dynamic encryption mechanism and full lifecycle monitoring. This method not only improves the confidentiality, integrity, and availability of cloud-stored data but also reduces system overhead through adaptive optimization, making it suitable for fields with stringent data security requirements, such as finance, healthcare, and government.

[0038] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0039] It should be noted that the components mentioned in the above embodiments are all general standard parts or components known to those skilled in the art. Their structures and principles can be learned by those skilled in the art through technical manuals or conventional experimental methods.

[0040] This invention has illustrated its principles and implementation methods using specific examples. The descriptions of these embodiments are merely illustrative of the method and its core ideas; furthermore, those skilled in the art will recognize that modifications may be made to the specific implementation methods and application scope based on the principles of this invention. Therefore, the content of this specification should not be construed as limiting the invention.

Claims

1. A method for full lifecycle encryption protection of computer cloud storage data, characterized in that, Includes the following steps: S1. Receive raw data through the data ingestion module and extract metadata, which includes data type, data size, data source, data owner and timestamp; S2. Based on the metadata, the context analysis module calculates the data sensitivity score using a machine learning model, wherein the machine learning model employs a logistic regression algorithm, and the formula is: ； in, These are feature vectors, derived from metadata. For the weight vector, This is the transpose of the weight vector. For bias terms; S3. The encryption strategy engine dynamically selects the encryption algorithm and the number of encryption rounds based on the data sensitivity score, wherein the formula for calculating the number of encryption rounds is: ； in, To minimize the number of encryption rounds, The maximum number of encryption rounds, Indicates rounding down; S4. The data encryption key is derived from the master key and context parameters through the key management module, wherein the context parameters include the data identifier, timestamp, and data sensitivity score, and the derivation formula is: ； in, Master key For context parameters; S5. The original data is encrypted using the data encryption key and the number of encryption rounds by the encryption execution module to generate encrypted data. The encryption process includes block processing, initial permutation, and encryption round loop. The encryption round loop includes byte replacement, row shifting, column mixing, and round key addition operation. S6. The encrypted data is transmitted to the secure storage module via the secure transmission module, and the TLS / SSL protocol is used to ensure secure transmission. S7. The encrypted data is distributed and stored through a secure storage module, and metadata and access logs are recorded. S8. Access control is performed on the encrypted data based on user attributes and permissions through the access control module, wherein the access decision formula is: ； in, The access authorization result is 1, indicating that access is allowed, and 0, indicating that access is denied. For user attributes, As weight, For the threshold; S9. Monitor data status through the lifecycle management module and trigger re-encryption or secure destruction operations according to the policy; S10. Securely delete the data and its key through the secure destruction module, using multiple overwrite or cryptographic erasure methods, and verify the destruction result through hash verification.

2. The method for full lifecycle encryption protection of computer cloud storage data according to claim 1, characterized in that, In step S2, the training methods for the machine learning model include: Using a labeled dataset, the loss function is optimized using gradient descent, as shown in the formula: ； in, For the sample size, For the first The true label of each sample For the first The prediction sensitivity score for each sample.

3. The method for full lifecycle encryption protection of computer cloud storage data according to claim 1, characterized in that, In step S3, dynamically selecting the encryption algorithm includes: When S < 0.3, use the AES-128 algorithm; The AES-192 algorithm is used when 0.3 ≤ S < 0.7; The AES-256 algorithm is used when S ≥ 0.

7.

4. The method for full lifecycle encryption protection of computer cloud storage data according to claim 1, characterized in that, In step S5, the initial permutation uses a permutation table P, which is dynamically generated based on the data sensitivity score. The generation function formula is: ； in, The function generates random permutations using the data sensitivity score as a seed.

5. The method for full lifecycle encryption protection of computer cloud storage data according to claim 1, characterized in that, In step S7, distributed storage includes storing encrypted data in blocks across multiple cloud storage nodes and dynamically adjusting the backup frequency based on the probability of corruption statistics, which are calculated through historical data analysis and mathematical models.

6. The method for full lifecycle encryption protection of computer cloud storage data according to claim 1, characterized in that, In step S8, the access control module uses homomorphic encryption. The algorithm performs encrypted data calculations, and the encryption formula is as follows: ； in, As part of the public key, For plain text, It is a random number. This is the public key.

7. The method for full lifecycle encryption protection of computer cloud storage data according to claim 1, characterized in that, In step S9, the data status includes creation, active, archived and destruction status, and the status transition is based on time strategy and access frequency strategy.

8. The method for full lifecycle encryption protection of computer cloud storage data according to claim 1, characterized in that, In step S10, secure deletion includes repeatedly overwriting data at the storage location using random methods, and verifying the data using a secure deletion verification formula. The secure deletion verification formula is as follows: ； in, This is the data storage area.

9. A computer cloud storage data lifecycle encryption protection system, characterized in that, The system is used to implement the computer cloud storage data lifecycle encryption protection method as described in any one of claims 1-8, the system comprising: The data ingestion module is used to receive raw data and extract metadata; The context analysis module is used to calculate the data sensitivity score S based on metadata; The encryption strategy engine is used to dynamically select the encryption algorithm and the number of encryption rounds based on the data sensitivity score S; The key management module is used to generate, store, and manage data encryption keys; The encryption execution module is used to encrypt data using a data encryption key and a number of encryption rounds; A secure transmission module is used to ensure the security of encrypted data during transmission; A secure storage module is used for distributed storage and management of encrypted data; A security processing module is used to support homomorphic encryption computation; The access control module is used to control data access based on user permissions; The lifecycle management module is used to monitor data status and trigger encryption or destruction operations; The secure destruction module is used to securely delete data and its keys.

10. The computer cloud storage data lifecycle encryption protection system according to claim 9, characterized in that, The modules in the system are connected through a central control bus to achieve coordinated management of data flow and control flow.

Images