Protection method and system for preventing file leakage in cloud space

Abstract

The invention discloses a protection method and system for preventing file leakage in a cloud space, and the method comprises the steps: encrypting a file stored in the cloud space by a user in the cloud space, and enabling the user to remotely log in and access the cloud space to carry out the cloud file operation of the file. The access trace of the user for accessing the cloud space last time needs to be provided for decrypting the file. A user private key is protected by a symmetric key associated with a user name, a user password HASH and an access trace, a file encryption key is decrypted by using the user private key obtained by decryption, all files stored in a cloud space by a user are encrypted and stored, and the key is subjected to multiple protection, so that all files are encrypted and stored by an internal attacker, a manager or an external attacker. Even if the user name and the password and even all private information of the user stored in the system are obtained, the file stored in the cloud space by the user cannot be decrypted.

Description

Technical Field

[0001] This invention relates to the field of file encryption protection and access control technology in cloud storage space under the Internet environment, and in particular to a protection method and system for preventing file leakage in cloud space. Background Technology

[0002] In the internet environment, users typically access cloud storage using a browser / server (B / S) model. Users store numerous files of various types, such as images, videos, and documents, in cloud storage. Typically, cloud storage systems provide access control via usernames and passwords, allowing only verified, authorized users to access their stored files. Currently, ordinary cloud storage systems and their access control mechanisms generally face four main threats: First, the usernames and passwords of registered users may be leaked or brute-forced, leading to the leakage of files stored in the cloud; second, the username and password information stored in the cloud system may be leaked, resulting in the leakage of files stored in the cloud; third, internal administrators within the cloud system may be able to access files stored by registered users without authorization; and fourth, improper disposal of storage devices due to obsolescence or obsolescence may lead to the leakage of files stored on obsolete devices.

[0003] This invention proposes a protection method and system for preventing file leakage in cloud space. Targeting the main leakage threats to user-stored files in cloud space, it employs access tracking technology to track and control user access to cloud space. Summary of the Invention

[0004] In response to the main threats of data leakage to user-stored files in the cloud, this invention proposes a protection method and system for preventing file leakage in the cloud.

[0005] To achieve the above objectives, the present invention provides the following technical solution: A method for protecting files from leakage in cloud space is characterized by encrypting and storing user-stored files in the cloud space. When a user remotely logs in to access the cloud space to perform cloud file operations, the user must provide access history from their last visit to the cloud space to decrypt the file.

[0006] Furthermore, when a user remotely logs in to access cloud files, the process of providing the user's previous access history to decrypt the files includes the following steps: Users log in to access cloud space using the username and password created during new user registration. The system verifies the username and password. If the verification is successful, the login process continues; if the verification fails, the login process is terminated. The system automatically retrieves the user's last access trace™ to the cloud space from the user's terminal device. If the retrieval is successful, the login process continues; if the retrieval fails, the access trace loss handling process is initiated. The system generates a new access trace™ for the user's current login access, and the system automatically saves the new access trace™ to the user's terminal device; The system uses username + password HASH + access trace TM to generate a symmetric encryption key TMK; The system uses the symmetric encryption key TMK to decrypt the user's private key, which is encrypted and stored in the user list; The system uses the decrypted user's private key to decrypt the encrypted file encryption key of that user stored in the user list; The system uses username + password HASH + current access trace TM' to generate a symmetric encryption key TMK', uses the symmetric encryption key TMK' to encrypt the user's private key and replaces it, and saves it to the user list; The system uses the decrypted file encryption key to decrypt the file the user wants to access, and presents the decrypted plaintext file to the user to complete the cloud file operation; If a user needs to save the results after completing a file operation in the cloud, the system will encrypt the file using a file encryption key and save the encrypted file in the user's cloud space.

[0007] Furthermore, new user registration for cloud storage includes the following steps: Create a new user's username and password, and save the username and password hash to the user list; The system automatically assigns a public-private key pair to new users and generates a public key certificate for the user's public key, which is then saved to the user list. The system automatically generates root traces for new users, and the users themselves save the root traces to their devices. The system uses username + password HASH + root trace to generate a symmetric encryption key RTMK. The system uses the symmetric encryption key RTMK to encrypt the user's private key and saves it to the user list as a user backup private key. The user backup private key is activated when the user's access trace is lost. The system randomly generates a symmetric encryption key as the user's file encryption key, encrypts the user's file encryption key using the user's public key, and saves it to the user list; The system automatically generates an access trace TM' for the user's current visit. The access trace TM' is automatically saved to the user's device by the system. The system uses the username + password HASH + access trace TM' to generate a symmetric encryption key TMK'. The system uses the symmetric encryption key TMK' to encrypt the user's private key and saves it to the user list.

[0008] Furthermore, the process for handling lost access traces includes the following steps: If the system fails to automatically retrieve the user's last access trace to the cloud space from the user's terminal device, the user will be required to provide the root trace. The system uses username + password hash + root trace to generate the root symmetric encryption key RTMK; The user's backup private key, which is encrypted and saved in the user list, is decrypted using the symmetric encryption key RTMK. If decryption is successful, the user is allowed to continue accessing the cloud space to perform cloud file operations. If decryption fails, the user's access to the cloud space is terminated. The system uses the decrypted user's private key to decrypt the encrypted file encryption key of that user stored in the user list; The system generates a new access trace TM' for the user's current login access, and the system automatically saves the access trace TM' to the user's terminal device; The system uses username + password HASH + current access trace TM' to generate a symmetric encryption key TMK', uses the symmetric encryption key TMK' to encrypt the user's private key and replaces it in the user list; The system uses the decrypted file encryption key to decrypt the file the user wants to access, and presents the decrypted plaintext file to the user to complete the cloud file operation; If a user needs to save the results after completing a file operation in the cloud, the system will encrypt the file using a file encryption key and save the encrypted file in the user's cloud space.

[0009] Furthermore, the access trace TM is a 128-bit random value that is automatically saved on the user's device as a browser cookie.

[0010] Furthermore, in the step of generating the symmetric encryption key TMK using username + password HASH + access trace TM, the DES algorithm is used to generate the symmetric encryption key TMK, and the length of the symmetric encryption key TMK is 56 bits.

[0011] Furthermore, in the next step, the system automatically assigns a public-private key pair to the new user and generates a public key certificate for the user's public key, which is then saved to the user list. The system also uses the asymmetric encryption algorithm RSA to assign a public-private key pair to the new user.

[0012] A protection system for preventing file leaks in a cloud environment includes an authentication server, a file server, client access software, and several registered users; The authentication server is used to register new users in the cloud space and generate a user list record for each new user; the user list record includes the user's private key encrypted with the symmetric encryption key TMK; The authentication server is used to implement access control for users logging into the cloud space to perform cloud file operations; and generates a symmetric encryption key TMK using username + password HASH + user's last access trace TM to the cloud space, and uses the decrypted user private key to decrypt the file encryption key. The client access software is used by users to remotely access user files stored on the cloud space file server, including logging into the cloud space and sending new user registration requests to the cloud space; The file server, acting as a cloud space file server, stores all files of registered users. When a user performs file operations, the file is first decrypted using a file encryption key, and when a user saves a file, the file is encrypted using the file encryption key.

[0013] Furthermore, after a new user successfully registers, a user list record of the registered user is saved in the user list stored on the authentication server. The user list record includes at least the username, user password HASH, user public key certificate, file encryption key encrypted with the user public key, user private key encrypted with the symmetric encryption key TMK, and user backup private key encrypted with the root symmetric encryption key RTMK.

[0014] Furthermore, the authentication server randomly generates its own private key and public key. The authentication server uses its own private key to sign the public key certificate of the registered user, and uses its own public key to verify the public key certificate of the registered user, in order to ensure the authenticity of the public key of the registered user.

[0015] In the above technical solution, the present invention has the following beneficial effects: This invention proposes a method and system for preventing file leakage in cloud storage. Addressing the main threats to user-stored files in current cloud storage, the system automatically saves access traces on the user's device each time a registered user accesses the cloud storage. The user's private key is protected using a random symmetric key associated with the username, password hash, and access traces. This eliminates the hassle and risk of private key leakage for users or administrators. Even if an attacker obtains the registered user's username and password, the lack of access traces prevents them from accessing the user's files stored in the cloud storage. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0017] Figure 1 This is a flowchart illustrating the cloud file operation process for remote login access to cloud space, as described in a specific embodiment of the present invention. Figure 2 This is a flowchart illustrating the cloud space new user registration process according to a specific embodiment of the present invention; Figure 3 This is a flowchart illustrating the process of handling lost access traces according to a specific embodiment of the present invention. Figure 4 This is a schematic diagram of a cloud-based protection system for preventing file leaks, as described in a specific embodiment of the present invention. Figure 5 This is a schematic diagram of the user list record structure stored on the authentication server in a specific embodiment of the present invention. Detailed Implementation

[0018] To enable those skilled in the art to better understand the technical solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings.

[0019] It should be noted that the terms "above," "one end," "up," etc., used herein indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the purpose of illustrative purposes and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting the present invention. In addition, the terms "part," "two parts," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0020] A method for preventing file leakage in cloud storage encrypts and stores user-contained files in the cloud. When a user remotely logs in to access the cloud and performs cloud-based file operations, they must provide their previous access history to decrypt the file. This method combines encryption and access control technologies. All files stored by users in the cloud are encrypted. After remotely logging in, users need to provide their previous access history to decrypt the file and complete the operation before they can read, write, modify, or download files.

[0021] The process of decrypting files by providing the user's previous access history when remotely logging into the cloud space includes the following steps: Users log in to access cloud space using the username and password created during new user registration. The system verifies the username and password. If the verification is successful, the login process continues; if the verification fails, the login process is terminated. The system automatically retrieves the user's last access trace™ to the cloud space from the user's terminal device. If the retrieval is successful, the login process continues; if the retrieval fails, the access trace loss handling process is initiated. The system generates a new access trace™ for the user's current login access, and the system automatically saves the new access trace™ to the user's terminal device; The system uses username + password HASH + access trace TM to generate a symmetric encryption key TMK; The system uses the symmetric encryption key TMK to decrypt the user's private key, which is encrypted and stored in the user list; The system uses the decrypted user's private key to decrypt the encrypted file encryption key of that user stored in the user list; The system uses username + password HASH + current access trace TM' to generate a symmetric encryption key TMK', uses the symmetric encryption key TMK' to encrypt the user's private key and replaces it, and saves it to the user list; The system uses the decrypted file encryption key to decrypt the file the user wants to access, and presents the decrypted plaintext file to the user to complete the cloud file operation; If a user needs to save the results after completing a file operation in the cloud, the system will encrypt the file using a file encryption key and save the encrypted file in the user's cloud space.

[0022] To address the main data leakage threats to user-stored files in cloud storage, this solution employs symmetric encryption to encrypt files, asymmetric encryption to protect the encryption key, and username, password, and access tracking technology to control user access to the cloud. Symmetric encryption ensures files exist in encrypted form on the storage device, protecting file content even if the cloud storage device becomes obsolete or is leaked due to other reasons. The symmetric encryption key is protected by a public key, decryption only possible with the user's private key, providing strong protection. While the user's public key is publicly stored in a public key certificate, it is signed and protected by the cloud system's private key, ensuring its authenticity and preventing decryption and data leakage due to public key spoofing. Each time a registered user accesses the cloud, the system automatically saves access traces on the user's device. The user's private key is protected using a random symmetric key linked to the username, password hash, and access trace. This eliminates the hassle and risk of private key leakage for users or administrators. Even if an attacker obtains the registered user's username and password, they cannot access the user's files stored in the cloud space because there is no record of the user's last access to the cloud space.

[0023] Specifically: Step S11: The user logs in to the cloud space using the username and password created during the new user registration. The system verifies the username and password. If the verification is successful, the login process continues; if the verification fails, the login process terminates.

[0024] In this embodiment, the user remotely logs into the cloud space using a common web browser to access the cloud space login webpage and enters their username and password. After receiving the username and password, the authentication server searches for the corresponding username record in its user list. If the search fails, it indicates an incorrect username or that the user does not exist, and login is denied. If the search is successful, the authentication server calculates the hash value of the user's password and compares it with the hash value of the user password stored in the user list. If they match, the user's password is correct, and the user is allowed to continue accessing the cloud space; otherwise, the user's password is incorrect, and login is denied.

[0025] Preferably, the user list is stored using a database table, with one user record generated for each user in the table.

[0026] Preferably, the international standard algorithm SHA-1 is used to calculate the hash value of the password.

[0027] Step S12: The system automatically retrieves the user's last access trace™ to the cloud space from the user's terminal device. If the retrieval is successful, the login process continues; if the retrieval fails, the access trace loss handling process is initiated.

[0028] In this embodiment, the access trace stored on the user's device is a 128-bit random value, which is automatically saved on the user's device as a browser cookie. In specific implementations, the number of bits in the access trace value can be determined based on the number of users, user access volume, and access frequency. In principle, it is required that the random value cannot be repeated within a relatively long period of time (such as more than 6 months).

[0029] Step S13: The system generates a new access trace TM' for the user's current login access, and the system automatically saves the access trace TM' to the user's terminal device.

[0030] In this embodiment, the new access trace TM' has the same implementation requirements as the previous access trace TM. The current access trace TM' is a 128-bit random value, which is automatically saved on the user's device as a browser cookie. In specific implementations, the number of bits in the access trace value can be determined based on the number of users, user access volume, and access frequency. In principle, it is required that the random value cannot be repeated within a relatively long period of time (such as more than 6 months).

[0031] Step S14: The system uses username + password HASH + access trace TM to generate a symmetric encryption key TMK.

[0032] In this embodiment, the symmetric encryption algorithm uses the international standard algorithm DES, and the generated symmetric encryption key is 56 bits long. In this embodiment, a random function is used to generate the symmetric encryption key, and the seed number of the random function is a combination of username + password hash + access trace TM.

[0033] Step S15: The system uses the symmetric encryption key TMK to decrypt the user's private key, which is encrypted and stored in the user list.

[0034] In this embodiment, the internationally standard asymmetric encryption algorithm RSA is used to randomly assign a public-private key pair to each registered user. The user's private key is assigned when a new user registers. The public key is stored in the user list record as a digital certificate, and the private key is encrypted using a symmetric encryption key TMK generated from the username, password hash, and access trace TM, and then stored in the user list record. Each time a user logs in, TMK must be recalculated to decrypt the user's private key.

[0035] Step S16: The system uses the decrypted user private key to decrypt the encrypted file encryption key of the user stored in the user list.

[0036] In this embodiment, all files stored by the user in the cloud space are encrypted using a file encryption key and then stored in ciphertext form in the cloud space. As an example, file encryption uses the international standard symmetric encryption algorithm DES. In other implementations, it is recommended to use domestic standard symmetric encryption algorithms or international standard algorithms with higher security.

[0037] The file encryption key is encrypted with the user's public key and stored in the user list record. Only the user's private key can be used to decrypt the file encryption key.

[0038] Step S17: The system generates a symmetric encryption key TMK' using username + password HASH + access trace TM', encrypts the user's private key using the symmetric encryption key TMK', and replaces and saves it to the user list.

[0039] In this embodiment, each time a user accesses the cloud space, a new symmetric encryption key associated with the current access trace TM' is generated to re-encrypt the user's private key, replacing the previously encrypted user private key stored in the user list record. The advantage of this is that even if the username and password are leaked, an attacker using a legitimate username and password to log into the cloud space cannot access the user's previous access trace on their device, nor can they encrypt the user's private key, and therefore cannot decrypt the file encryption key. Consequently, the attacker cannot access the encrypted files stored in the cloud space.

[0040] Step S18: The system uses the decrypted file encryption key to decrypt the file the user wants to access, and presents the decrypted plaintext file to the user to complete the cloud file operation.

[0041] In this embodiment, after the system completes the file decryption operation, the form in which the plaintext file is presented to the user depends on the file's type and format. Users can directly open, read, write, and modify files, such as Word, Excel, and PDF files, using browser-supported plugins on a web page. Alternatively, users can download the plaintext file first and then re-upload it to the cloud space after completing their operations on the user's end.

[0042] Step S19: If the user needs to save the operation results after completing the cloud file operation, the system uses the file encryption key to encrypt the file to be saved and saves the encrypted file in the user's cloud space.

[0043] New user registration for cloud storage includes the following steps: creating a new user's username and password, and saving the username and password hash to the user list; The system automatically assigns a public-private key pair to new users and generates a public key certificate for the user's public key, which is then saved to the user list. The system automatically generates root traces for new users, and the users themselves save the root traces to their devices. The system uses username + password HASH + root trace to generate a symmetric encryption key RTMK. The system uses the symmetric encryption key RTMK to encrypt the user's private key and saves it to the user list as a user backup private key. The user backup private key is activated when the user's access trace is lost. The system randomly generates a symmetric encryption key as the user's file encryption key, encrypts the user's file encryption key using the user's public key, and saves it to the user list; The system automatically generates an access trace TM' for this user's visit. The access trace TM' is automatically saved to the user's device. The system uses the username + password hash + access trace TM' to generate a symmetric encryption key TMK'. The system then uses the symmetric encryption key TMK' to encrypt the user's private key before saving it to the user list. The process of registering new users for cloud storage, such as... Figure 2 As shown, the specific steps include: Step S21: Create a new user account and password, and save the new user's username and password hash in the user list; In this embodiment, the international standard algorithm SHA-1 is used to calculate the password's hash value. The user list record does not store the plaintext of the user password, only its hash value. This prevents passwords from being obtained by personnel within the cloud system and also prevents password leaks due to database attacks.

[0044] Step S22: The system automatically assigns a public-private key pair to the new user and generates a public key certificate for the user's public key, which is then stored in the user list.

[0045] In this embodiment, the internationally standard asymmetric encryption algorithm RSA is used to randomly assign a public-private key pair to each registered user. The public key is stored in the user list record as a digital certificate. This implements the protection of the file encryption key using the asymmetric encryption public key and the decryption of the file encryption symmetric key using the asymmetric encryption private key, thus employing an asymmetric encryption method to protect the file encryption key.

[0046] In this embodiment, the public key certificate is signed with the private key of the cloud system to protect and verify the authenticity of the user's public key and prevent spoofing attacks caused by the replacement of the user's public key.

[0047] In this embodiment, the public key certificate uses the certificate structure of international standard X.509 version 3.

[0048] Step S23: The system automatically generates a root trace RTM for the new user, and the root trace is saved by the user on the user's terminal device.

[0049] If a user accesses cloud space on a new device or is unable to provide the system with access history from their last visit to cloud space for other reasons, the user needs to provide root history.

[0050] In this embodiment, the root trace, like the access trace, is a random value of 128 bits. However, the user is required to actively save the root trace on the user's terminal device or a USB flash drive, and the user must keep it safe.

[0051] In this embodiment, the user's private key encrypted with root trace serves as a backup of the user's private key and is used when the user loses their last access trace, so that the user can continue to access encrypted files in the cloud space.

[0052] Step S24: The system generates a symmetric encryption key RTMK using username + password HASH + root trace. The system uses the symmetric encryption key RTMK to encrypt the user's private key and saves it in the user list. The system uses the symmetric encryption key RTMK to encrypt the user's private key and saves it in the user list as a backup private key for the user. The backup private key is activated in case the user's access trace is lost.

[0053] In this embodiment, the generation of RTMK uses the same cryptographic algorithm and generation method as the generation of TMK.

[0054] Step S25: The system randomly generates a symmetric encryption key as the user's file encryption key, encrypts the user's file encryption key using the user's public key, and then saves it in the user list.

[0055] In this embodiment, file encryption uses the internationally standard symmetric encryption algorithm DES. After the file encryption key is encrypted using the user's public key, it can only be decrypted using the user's private key, providing high-strength confidentiality.

[0056] Step S26: The system automatically generates an access trace TM' for this user's visit, which is automatically saved by the system on the user's device. The system uses the username + password HASH + access trace TM' to generate a symmetric encryption key TMK', and then uses the symmetric encryption key TMK' to encrypt the user's private key before saving it in the user list.

[0057] After implementing steps S21 to S26, new user records for registered users are added to the cloud space user list. The user record structure is as follows: Figure 5 As shown.

[0058] The process for handling lost access traces includes the following steps: If the system fails to automatically retrieve the user's last access trace to the cloud space from the user's terminal device, the user will be required to provide the root trace. The system uses username + password hash + root trace to generate the root symmetric encryption key RTMK; The user's backup private key, which is encrypted and saved in the user list, is decrypted using the symmetric encryption key RTMK. If decryption is successful, the user is allowed to continue accessing the cloud space to perform cloud file operations. If decryption fails, the user's access to the cloud space is terminated. The system uses the decrypted user's private key to decrypt the encrypted file encryption key of that user stored in the user list; The system generates a new access trace TM' for the user's current login access, and the system automatically saves the access trace TM' to the user's terminal device; The system uses username + password HASH + current access trace TM' to generate a symmetric encryption key TMK', uses the symmetric encryption key TMK' to encrypt the user's private key and replaces it in the user list; The system uses the decrypted file encryption key to decrypt the file the user wants to access, and presents the decrypted plaintext file to the user to complete the cloud file operation; If a user needs to save the results after completing a file operation in the cloud, the system will encrypt the file using a file encryption key and save the encrypted file in the user's cloud space.

[0059] Among them, the process of handling lost access traces, such as Figure 3 As shown, the specific steps include: Step S31: Since the system failed to automatically retrieve the user's last access trace™ from the user's terminal device, the user is required to provide the root trace RTM.

[0060] In this embodiment, the root trace is saved by the user on the user's terminal device or on the user's USB flash drive.

[0061] Step S32: The system generates a root symmetric encryption key RTMK using username + password HASH + root trace RTM. In this embodiment, the symmetric encryption, asymmetric encryption algorithms, and HASH algorithms in this step and subsequent steps are the same as described above and will not be repeated.

[0062] Step S33: Use the symmetric encryption key RTMK to decrypt the backup private key of the user stored in the user list; if the decryption is successful, allow the user to continue to access the cloud space to perform cloud file operations; if the decryption fails, terminate the user's access to the cloud space.

[0063] Step S34: The system uses the decrypted user private key to decrypt the encrypted file encryption key of the user stored in the user list.

[0064] Step S35: The system generates a new access trace TM' for the user's current login access, and the system automatically saves the access trace TM' to the user's terminal device.

[0065] In this embodiment, the previous access trace and the new access trace are the same as the aforementioned access trace generation method and storage method, and will not be described again.

[0066] Step S36: The system generates a symmetric encryption key TMK' using username + password HASH + access trace TM', encrypts the user's private key using the symmetric encryption key TMK', and replaces and saves it to the user list.

[0067] Step S37: The system uses the decrypted file encryption key to decrypt the file the user wants to access, and presents the decrypted plaintext file to the user to complete the cloud file operation.

[0068] Step S38: If the user needs to save the operation results after completing the cloud file operation, the system uses the file encryption key to encrypt the file to be saved and saves the encrypted file in the user's cloud space.

[0069] A protection system for preventing file leaks in cloud storage, such as... Figure 4 As shown, a cloud space file access system consists of an authentication server, a file server, client access software, and several registered users.

[0070] The authentication server accepts and completes new user registration requests for the cloud space, and generates a user list record for each new user. It also implements access control for users logging into the cloud space to perform file operations. Client access software allows users to remotely access user files stored on the cloud space file server, including logging into the cloud space and sending new user registration requests. The file server, acting as the cloud space file server, stores all files of registered users and decrypts files using a file encryption key before performing file operations and encrypts files using the same key before saving them.

[0071] In this embodiment, the client access software uses a common web browser and is used for users to remotely log in to access the cloud space and send new user registration requests for the cloud space.

[0072] For newly registered users, the authentication server generates a user list record. This user list record includes the user's private key encrypted with the symmetric encryption key TMK; specifically: Create a new user's username and password, and save the user's username and password hash to the user list; Automatically assign public and private key pairs to new users and generate public key certificates for users' public keys, saving them to the user list; Automatically generate root traces for new users; The symmetric encryption key RTMK is generated using username + password HASH + root trace. The user's private key is then encrypted using the symmetric encryption key RTMK and saved to the user list as a backup private key for the user. A random symmetric encryption key is generated as the user's file encryption key. The user's file encryption key is then encrypted using the user's public key and saved to the user list. Automatically generate an access trace TM' for the user's current visit, generate a symmetric encryption key TMK' using username + password HASH + access trace TM', encrypt the user's private key using the symmetric encryption key TMK' and save it to the user list.

[0073] Root traces are saved by the user to the user's device, while access traces™ are automatically saved by the authentication server to the user's device.

[0074] The authentication server implements access control for user access to cloud space and cloud file operations. It generates a symmetric encryption key TMK using the username + password hash + the user's previous access history TM. The decrypted user's private key is then used to decrypt the file encryption key. Specifically: After a user logs in to the cloud space using the username and password created during new user registration through the client access software, the authentication server verifies the username and password. If the verification is successful, the login process continues; if the verification fails, the login process is terminated. The authentication server automatically retrieves the user's last access trace™ to the cloud space from the user's terminal device. If the retrieval is successful, the login process continues; if the retrieval fails, the access trace loss handling process is initiated. The authentication server generates a new access trace™ for the user's current login access and automatically saves the new access trace™ to the user's device. The authentication server uses username + password hash + access trace™ to generate a symmetric encryption key TMK; The authentication server uses the symmetric encryption key TMK to decrypt the user's private key, which is encrypted and stored in the user list; The authentication server uses the decrypted user's private key to decrypt the encrypted file encryption key of that user stored in the user list; The authentication server uses username + password HASH + access history TM' to generate a symmetric encryption key TMK', uses the symmetric encryption key TMK' to encrypt the user's private key and replaces it in the user list; The authentication server uses the decrypted file encryption key to decrypt the file the user wants to access, and presents the decrypted plaintext file to the user to complete the cloud file operation. If a user needs to save the results after completing a file operation in the cloud, the authentication server will encrypt the file using the file encryption key and save the encrypted file in the user's cloud space.

[0075] The process for handling lost access traces includes the following steps: If the authentication server fails to automatically retrieve the user's last access trace to the cloud space from the user's device, the user will be required to provide the root trace. The authentication server uses username + password hash + root trace to generate the root symmetric encryption key RTMK; The user's backup private key, which is encrypted and saved in the user list, is decrypted using the symmetric encryption key RTMK. If decryption is successful, the user is allowed to continue accessing the cloud space to perform cloud file operations. If decryption fails, the user's access to the cloud space is terminated. The authentication server uses the decrypted user's private key to decrypt the encrypted file encryption key of that user stored in the user list; The authentication server generates a new access trace TM' for the user's current login access, and the authentication server automatically saves the access trace TM' to the user's terminal device; The authentication server uses username + password HASH + access history TM' to generate a symmetric encryption key TMK', uses the symmetric encryption key TMK' to encrypt the user's private key and replaces it in the user list; The authentication server uses the decrypted file encryption key to decrypt the file the user wants to access, and presents the decrypted plaintext file to the user to complete the cloud file operation.

[0076] If a user needs to save the results after completing a file operation in the cloud, the authentication server will encrypt the file using the file encryption key and save the encrypted file in the user's cloud space.

[0077] In this embodiment, the authentication server uses a database table to store all registered user information. Each registered user occupies one record in the database table, forming a user list.

[0078] The authentication server randomly generates its own private key and public key. The authentication server uses its own private key to sign the public key certificate of the registered user, and uses its own public key to verify the public key certificate of the registered user, thereby ensuring the authenticity of the public key of the registered user. In this embodiment, the authentication server generates a private key and a public key for an asymmetric encryption algorithm, using the international standard algorithm RSA.

[0079] The file server, acting as a cloud space file server, stores all files of registered users. When users read, write, modify, or download files, the file encryption key is used to decrypt the files first. When users save (upload) files, the file encryption key is used to encrypt the files.

[0080] In this embodiment, the APIs of the file server operating system, including file reading, writing, modification, downloading, uploading, and saving, are hooked to enable encryption and decryption operations before and after file operations.

[0081] After a user successfully registers, a user list record is saved in the user list stored on the authentication server. The user list record includes: username, user password HASH, user public key certificate, file encryption key encrypted with user public key, user private key encrypted with symmetric encryption key TMK, and a backup of user private key encrypted with root symmetric encryption key RTMK. The user list is stored in a database table, and the user list records are in the form of rows in the database table. In this implementation, the HASH algorithm, public key certificate format, symmetric encryption algorithm, and asymmetric encryption algorithm are the same as described above, and will not be repeated here.

[0082] To address the main data leakage threats to user-stored files in cloud space, the cloud space data leakage prevention protection system employs symmetric encryption to encrypt stored files, uses asymmetric encryption to protect the file encryption key, and uses username, login password, and access tracking technology to track and control user access to cloud space.

[0083] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0084] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0085] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0086] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0087] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0088] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

[0089] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A method for preventing file leakage in cloud space, characterized in that, Files stored in the cloud space by users are encrypted and stored in the cloud space. When users remotely log in to access the cloud space to perform cloud file operations, they need to provide the user's last access history to the cloud space to decrypt the file. The user's private key is protected by a symmetric key associated with the username, user password hash, and access history. The decrypted user private key is used to decrypt the file encryption key.

2. The method for preventing file leakage in cloud space according to claim 1, characterized in that, When a user remotely logs in to access cloud files, they need to provide their previous access history to the cloud space for file decryption. The user's private key is protected by a symmetric key associated with the username, password hash, and access history. The process of decrypting the file encryption key using the decrypted user private key includes the following steps: Users log in to access cloud space using the username and password created during new user registration. The system verifies the username and password. If the verification is successful, the login process continues; if the verification fails, the login process is terminated. The system automatically retrieves the user's last access trace™ to the cloud space from the user's terminal device. If the retrieval is successful, the login process continues; if the retrieval fails, the access trace loss handling process is initiated. The system generates a new access trace™ for the user's current login access, and the system automatically saves the new access trace™ to the user's terminal device; The system uses username + password HASH + access trace TM to generate a symmetric encryption key TMK; The system uses the symmetric encryption key TMK to decrypt the user's private key, which is encrypted and stored in the user list; The system uses the decrypted user's private key to decrypt the encrypted file encryption key of that user stored in the user list; The system uses username + password HASH + current access trace TM' to generate a symmetric encryption key TMK', uses the symmetric encryption key TMK' to encrypt the user's private key and replaces it, and saves it to the user list; The system uses the decrypted file encryption key to decrypt the file the user wants to access, and presents the decrypted plaintext file to the user to complete the cloud file operation; If a user needs to save the results after completing a file operation in the cloud, the system will encrypt the file using a file encryption key and save the encrypted file in the user's cloud space.

3. The method for preventing file leakage in cloud space according to claim 2, characterized in that, New user registration for cloud storage includes the following steps: Create a new user's username and password, and save the username and password hash to the user list; The system automatically assigns a public-private key pair to new users and generates a public key certificate for the user's public key, which is then saved to the user list. The system automatically generates root traces for new users, and the users themselves save the root traces to their devices. The system uses username + password HASH + root trace to generate a symmetric encryption key RTMK. The system uses the symmetric encryption key RTMK to encrypt the user's private key and saves it to the user list as a user backup private key. The user backup private key is activated when the user's access trace is lost. The system randomly generates a symmetric encryption key as the user's file encryption key, encrypts the user's file encryption key using the user's public key, and saves it to the user list; The system automatically generates an access trace TM' for the user's current visit. The access trace TM' is automatically saved to the user's device by the system. The system uses the username + password HASH + access trace TM' to generate a symmetric encryption key TMK'. The system uses the symmetric encryption key TMK' to encrypt the user's private key and saves it to the user list.

4. The method for preventing file leakage in cloud space according to claim 3, characterized in that, The process for handling lost access traces includes the following steps: If the system fails to automatically retrieve the user's last access trace to the cloud space from the user's terminal device, the user will be required to provide the root trace. The system uses username + password hash + root trace to generate the root symmetric encryption key RTMK; The user's backup private key, which is encrypted and saved in the user list, is decrypted using the symmetric encryption key RTMK. If decryption is successful, the user is allowed to continue accessing the cloud space to perform cloud file operations. If decryption fails, the user's access to the cloud space is terminated. The system uses the decrypted user's private key to decrypt the encrypted file encryption key of that user stored in the user list; The system generates a new access trace TM' for the user's current login access, and the system automatically saves the access trace TM' to the user's terminal device; The system uses username + password HASH + current access trace TM' to generate a symmetric encryption key TMK', uses the symmetric encryption key TMK' to encrypt the user's private key and replaces it in the user list; The system uses the decrypted file encryption key to decrypt the file the user wants to access, and presents the decrypted plaintext file to the user to complete the cloud file operation; If a user needs to save the results after completing a file operation in the cloud, the system will encrypt the file using a file encryption key and save the encrypted file in the user's cloud space.

5. A method for preventing file leakage in cloud space according to claim 2, characterized in that, Access trace TM is a 128-bit random value that is automatically saved on the user's device as a browser cookie.

6. The method for preventing file leakage in cloud space according to claim 4, characterized in that, In the process of generating the symmetric encryption key TMK using username + password HASH + access trace TM, the DES algorithm is used to generate the symmetric encryption key TMK, and the length of the symmetric encryption key TMK is 56 bits.

7. The method for preventing file leakage in cloud space according to claim 4, characterized in that, In the steps, the system automatically assigns a public-private key pair to new users and generates a public key certificate for the user's public key, which is then saved to the user list. The system uses the asymmetric encryption algorithm RSA to assign a public-private key pair to new users.

8. A cloud-based file leakage prevention system based on the protection method for preventing file leakage in cloud space according to any one of claims 1-7, characterized in that, This includes an authentication server, a file server, client access software, and several registered users; The authentication server is used to register new users in the cloud space and generate a user list record for each new user. The user list record includes the user's private key encrypted with the symmetric encryption key TMK. The authentication server is used to implement access control for users logging into the cloud space to perform cloud file operations, and generates a symmetric encryption key TMK using username + password HASH + user's last access trace TM of the cloud space, and uses the decrypted user private key to decrypt the file encryption key. The client access software is used by users to remotely access user files stored on the cloud space file server, including logging into the cloud space and sending new user registration requests to the cloud space; The file server, acting as a cloud space file server, stores all files of registered users. When a user performs file operations, the file is first decrypted using a file encryption key, and when a user saves a file, the file is encrypted using the file encryption key.

9. A protection system for preventing file leakage in cloud space according to claim 8, characterized in that, After a new user successfully registers, a user list record of the registered user is saved in the user list stored on the authentication server. The user list record includes the username, user password HASH, user public key certificate, file encryption key encrypted with the user public key, user private key encrypted with the symmetric encryption key TMK, and user backup private key encrypted with the root symmetric encryption key RTMK.

10. A protection system for preventing file leakage in cloud space according to claim 8, characterized in that, The authentication server randomly generates its own private key and public key. The authentication server uses its own private key to sign the public key certificate of the registered user, and uses its own public key to verify the public key certificate of the registered user, so as to ensure the authenticity of the public key of the registered user.

Images