Image cloud data intelligent encryption storage protection realization method

Abstract

The invention discloses a data intelligent encryption storage protection implementation method for image cloud, and relates to the technical field of data security, and the method comprises the steps: obtaining an image service data set, distributing a data identifier for each piece of image service data, summarizing the image service data set and the corresponding data identifier, and forming a to-be-encrypted list; generating a random seed and a timestamp for each piece of image service data in the to-be-encrypted list, combining the random seed and the timestamp according to a splicing rule to form a data key of the current image service data, and summarizing the data identifier, the random seed and the timestamp to form a key metadata set; and based on the data key corresponding to each data identifier in the key metadata set, performing symmetric encryption operation on the corresponding image service data to generate initial encrypted data. According to the invention, the independent and unique data key is generated for each piece of image service data, so that the permeability resistance and disaster tolerance of the image cloud data storage system are improved.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a method for intelligent encrypted storage and protection of image cloud data. Background Technology

[0002] With the advent of the information age, data storage and protection technologies have gradually become an important part of information security. To effectively prevent information leakage, unauthorized access, or data tampering, data encryption has been widely adopted. In data encryption storage protection methods, traditional encryption methods often rely on fixed keys and encryption algorithms. Especially in file storage, common symmetric encryption algorithms such as AES and DES are widely used. These methods encrypt sensitive information using keys to ensure data security.

[0003] Existing methods have several shortcomings. They rely on a single, fixed key to encrypt the entire dataset. Once the key is leaked, the security of all encrypted data is completely exposed, significantly reducing security. In addition, the key is usually unchanged during encryption and lacks a dynamic update mechanism. Once an attacker obtains the key, they can decrypt large amounts of sensitive data for a long time, compromising the independent security of the data structure. Especially in image cloud environments, image business data is characterized by large data volume, long storage period, dynamic changes in access frequency, and extremely high privacy requirements. Traditional static key management methods are difficult to implement fine-grained security control and adaptive protection strategies, and cannot meet the increasingly high standards of data security required in such scenarios. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a method for intelligent encrypted storage protection of image cloud data to solve the problems of key leakage risk and insufficient encryption strength.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: This invention provides a method for intelligent encrypted storage protection of image cloud data, comprising: acquiring an image service dataset, merging it to assign a data identifier to each image service data item, summarizing the image service data set and the corresponding data identifiers to form a list to be encrypted; generating a random seed and a timestamp for each image service data item in the list to be encrypted, combining the random seed and timestamp according to a concatenation rule to form a data key for the current image service data, and summarizing the data identifier, random seed, and timestamp to form a key metadata dataset; performing symmetric encryption operations on the corresponding image service data based on the data key corresponding to each data identifier in the key metadata dataset to generate initial encrypted data, and embedding the random seed into at least one embedding position in the initial encrypted data according to a mixing rule to form the target encrypted data. The system encrypts data and writes the timestamp into the timestamp field associated with the data identifier to form a target encrypted dataset. The mixing rule is generated from the current data identifier and timestamp and is updated synchronously when the key is updated. Key update conditions are set for each data identifier. When a data identifier in the target encrypted dataset meets the corresponding key update conditions, a new random seed, a new timestamp, and a new data key for the corresponding image service data are generated. Re-encryption is performed using the new data key, and the mixing rule and timestamp field are updated to generate an updated encrypted dataset. Upon receiving a read request, the system parses the new random seed and new timestamp from the updated encrypted data according to the data identifier and reconstructs them into a new data key. The system then performs decryption operations on the updated encrypted data based on the new data key to generate plaintext image service data.

[0007] As a preferred embodiment of the intelligent encrypted storage protection method for image cloud data described in this invention, the steps of acquiring image service datasets, merging them into data identifiers for each image service data item, and summarizing the image service data set with the corresponding data identifiers to form a list to be encrypted are as follows. Retrieve the image business data set from the image business database, and read the unique record number field of the image business data set one by one; Use the unique record number field as the data identifier, and perform uniqueness verification on the data identifier within the image business data set; According to the order of the image business data set, the uniquely verified data identifiers are paired with the corresponding image business data to generate a data identifier-image business data record; All data identification and image business data records are aggregated to form a list to be encrypted.

[0008] As a preferred embodiment of the intelligent encrypted storage protection method for image cloud data described in this invention, the specific steps for generating a random seed and timestamp for each image service data item in the encryption list are as follows: For the current data identifier, an entropy pool is constructed based on the system entropy source and a secure random number generator is called to output a random byte sequence from the entropy pool as a random seed; Read the computer clock and obtain millisecond-level Unix time values ​​to generate timestamps; Update the entropy pool and regenerate the random seed and timestamp until the uniqueness check passes; If the number of consecutive retries reaches the preset limit and still fails, the record corresponding to the current data identifier is marked as a generation failure and removed.

[0009] As a preferred embodiment of the intelligent encrypted storage and protection method for image cloud data described in this invention, the steps of combining a random seed and a timestamp according to a concatenation rule to form a data key for the current image service data, and summarizing the data identifier, random seed, and timestamp to form a key metadata dataset, are as follows: Convert the uniqueness-validated random seed and timestamp into a random seed string and a timestamp string; According to the splicing rules, the random seed string and the timestamp string are combined to generate the data key for the current image business data; The data identifier and its corresponding random seed and timestamp are used as a key metadata record. All key metadata records are integrated to form a key metadata dataset.

[0010] As a preferred embodiment of the intelligent encrypted storage and protection method for image cloud data described in this invention, the step of performing symmetric encryption operations on the corresponding image service data based on the data keys corresponding to each data identifier in the key metadata set to generate initial encrypted data includes the following specific steps: The corresponding image service data is obtained from the list to be encrypted based on the data identifier in the key metadata set; Using the data key as a key parameter, the image service data is encrypted through symmetric encryption operations to generate initial encrypted data.

[0011] As a preferred embodiment of the intelligent encrypted storage and protection method for image cloud data described in this invention, the method involves: embedding a random seed into at least one embedding position of the initial encrypted data according to a mixing rule to form target encrypted data, and writing a timestamp into a timestamp field associated with the data identifier to form a target encrypted dataset. The mixing rule is generated from the current data identifier and timestamp, and is updated synchronously when the key is updated. The specific steps are as follows. The random seed string is converted into a random seed byte sequence, and the random seed byte sequence and the initial encrypted data are concatenated according to the mixing rules to form the target encrypted data. Write the timestamp into the timestamp field associated with the current data identifier, and associate the current data identifier with the target encrypted data to form a data identifier-target encrypted data record; Integrate all data identifiers and target encrypted data records to form a target encrypted dataset.

[0012] As a preferred embodiment of the intelligent encrypted storage protection method for image cloud data described in this invention, the specific steps for setting key update conditions for each data identifier are as follows: Key update conditions are set for each data identifier by defining time period thresholds and access count thresholds; The key update conditions include time period conditions and access count conditions.

[0013] As a preferred embodiment of the intelligent encrypted storage protection method for image cloud data described in this invention, the step of generating a new random seed, a new timestamp, and a new data key for the corresponding image service data when a data identifier in the target encrypted dataset meets the corresponding key update condition is as follows: The event-driven mechanism periodically checks whether each data identifier in the target encrypted dataset meets the corresponding key update conditions. When a data identifier meets the corresponding key update condition, a new random seed and a new timestamp are generated, and the new random seed and the new timestamp are combined according to the concatenation rules to generate a new data key.

[0014] As a preferred embodiment of the intelligent encrypted storage protection method for image cloud data described in this invention, the steps of performing re-encryption with a new data key, updating the mixing rules and timestamp fields, and generating an updated encrypted dataset are as follows. Parse the target encrypted data to generate image service data corresponding to the data identifier; The corresponding image business data is re-encrypted using the new data key to generate updated initial encrypted data. The new random seed is embedded and the corresponding timestamp field is updated to form a data identifier-updated encrypted data record. Integrate all data identifiers and update encrypted data records to form an updated encrypted dataset.

[0015] As a preferred embodiment of the intelligent encrypted storage protection method for image cloud data described in this invention, the specific steps for generating plaintext image service data by performing decryption operations on the updated encrypted data according to the new data key are as follows: Receive data read requests, extract the data identifier to be queried, and obtain the corresponding updated encrypted data from the updated encrypted dataset based on the data identifier to be queried; The new random seed is parsed from the corresponding updated encrypted data according to the mixing rules, the new timestamp is extracted from the timestamp field, and the new random seed and the new timestamp are reconstructed into a new data key according to the splicing rules. The new data key is used to update the initial encrypted data and perform decryption operations to generate plaintext image service data.

[0016] The beneficial effects of this invention are as follows: By dynamically generating an independent and unique data key for each piece of image business data, the risk of batch data being decrypted due to the leakage of a single key is eliminated, thereby establishing fine-grained isolation in complex attack environments. It is particularly suitable for the secure storage of massive image business data in image clouds, improving the anti-penetration and disaster recovery capabilities of the data storage system. By establishing a key update mechanism linked to data activity, intelligent adaptation of security policies to business scenarios is achieved. It can dynamically adjust protection strategies according to the clinical value and usage frequency of image business data, avoiding resource waste caused by fixed update cycles on low-frequency access data, while also protecting highly sensitive data, optimizing overall energy efficiency while continuously ensuring security. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating the method for intelligent encrypted storage and protection of image cloud data.

[0019] Figure 2 A flowchart for forming a key element dataset.

[0020] Figure 3 A flowchart for setting key update conditions.

[0021] Figure 4 A flowchart for generating plaintext image service data. Detailed Implementation

[0022] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0023] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0024] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0025] Reference Figures 1-4 As one embodiment of the present invention, this embodiment provides a method for intelligent encrypted storage protection of image cloud data, including the following steps: S1. Obtain the image business dataset, merge it, assign a data identifier to each image business data, and summarize the image business data set and the corresponding data identifier to form a list to be encrypted.

[0026] S1.1 Obtain the image business data set from the image business database, read the unique record number field of the image business data set one by one, use the unique record number field as the data identifier, and perform uniqueness verification on the data identifier within the image business data set.

[0027] It should be noted that the persistent data storage location where image business data has been written during normal business processing is used as the business database, such as the Image Archiving and Communication Network (PACS) in the image cloud environment or a storage server that conforms to the DICOM standard, and the image business data table in the business database is used as the reading object; the "unique record number field is not null" is used as a fixed query condition to filter the business data table and output the image business data set.

[0028] Read the unique record number field (e.g., the SOP instance UID in the DICOM file header) from the image service data set one by one and write the unique record number field into the data identifier list to form a data identifier candidate set. Perform uniqueness verification on the data identifier candidate set within the image service data set. Specifically, initialize an empty "existing data identifier set" and an empty "duplicate data identifier list". Read the data identifier candidate values ​​one by one in the order of the data identifier candidate set and perform two types of judgments: the first judgment is a non-empty verification. When an empty value or empty string is encountered, the corresponding data identifier candidate value is recorded in the duplicate data identifier list. The second judgment is a duplicate verification. Compare the current data identifier candidate value with the existing data identifiers. The system performs element judgment on the data identifier set. If an identical candidate data identifier exists in the existing data identifier set, the current candidate data identifier is added to the duplicate data identifier list and marked as failing the uniqueness check. If no identical candidate data identifier exists in the existing data identifier set, the current candidate data identifier is written to the existing data identifier set and the system continues to read the next candidate data identifier. After traversal, the system outputs the uniqueness check result based on whether the duplicate data identifier list is empty. If the duplicate data identifier list is empty, the system determines that the candidate data identifier set is unique within the image business data set, and the uniqueness check result is passed. If the duplicate data identifier list is not empty, the system determines that duplicate data identifiers exist, and the uniqueness check result is failed.

[0029] When the uniqueness verification result is passed, the candidate set of data identifiers is determined as the data identifiers and maintains a corresponding relationship with the image business data set. When the uniqueness verification result is failed, the image business data corresponding to the first occurrence of the data identifier is retained, the image business data corresponding to the repeated occurrence of the data identifier is removed, and the data identifiers corresponding to the repeated data identifiers are removed from the candidate set of data identifiers.

[0030] S1.2. Pair the uniquely verified data identifiers with the corresponding image business data according to the order of the image business data set to generate a data identifier-image business data record. Summarize all data identifier-image business data records to form a list to be encrypted.

[0031] It should be noted that an empty data identifier-image service data record list is initialized as a summary container. The current image service data (e.g., a single DICOM file and its associated metadata) is read one by one in the record order of the image service data set, and the data identifiers at the same position are read synchronously. The data identifiers are paired with the current image service data to generate a data identifier-image service data record and written to the data identifier-image service data record list. This process is repeated until all image service data and data identifiers are paired and written. The data identifier-image service data record list is then used as a list to be encrypted.

[0032] S2. Generate a random seed and timestamp for each image service data in the encryption list, and combine the random seed and timestamp according to the splicing rules to form the data key of the current image service data. Then, summarize the data identifier, random seed and timestamp to form a key meta dataset.

[0033] S2.1. For the current data identifier, construct an entropy pool based on the system entropy source and call a secure random number generator. Output a random byte sequence from the entropy pool as a random seed, read the computer clock and obtain the millisecond-level Unix time value to generate a timestamp.

[0034] It should be noted that the data identifiers in the list to be encrypted are read one by one in the order of records, and an empty random seed list and timestamp list are created. At the same time, an entropy pool is established to aggregate randomness. For each current data identifier, the following operations are performed: randomness input is collected from the system entropy source and written into the entropy pool to construct or update the entropy pool; a secure random number generator is called to output a random byte sequence from the entropy pool, and the random byte sequence is determined as the random seed corresponding to the current data identifier; the computer clock is read to obtain the millisecond-level Unix time value of the current moment, and the millisecond-level Unix time value is determined as the timestamp; the random seed is written into the random seed list and the timestamp is written into the timestamp list, while ensuring that the random seed list, timestamp list and current data identifier are in the same order; after the random seed and timestamp corresponding to the current data identifier are generated, the random seed and timestamp generation process for the next data identifier begins, until the list to be encrypted is traversed completely.

[0035] It should also be noted that the system entropy source is used to provide random input, including at least one or more of the random sources provided by the operating system, hardware noise sources, or external random sources; the entropy pool is used to aggregate and maintain the state of random input, and serves as the input source for the secure random number generator; the secure random number generator is used to output a random byte sequence from the entropy pool; the random seed is output by the secure random number generator as a fixed-length random byte sequence, preferably 32 bytes; the timestamp is a millisecond-level Unix time value output by the computer clock, represented by 13 decimal digits.

[0036] S2.2 Update the entropy pool and regenerate the random seed and timestamp until the uniqueness verification passes. If the number of consecutive retries reaches the preset limit and still fails, mark the current data identifier corresponding to the record as a failed generation and remove it.

[0037] It should be noted that an empty set of already occurring combinations and an empty list of duplicate combinations are created, and a preset upper limit is set for the number of consecutive retries. The current random seed and the current timestamp are retrieved one by one in the index order of the random seed list and the timestamp list, and combined to form the current seed time combination. The current seed time combination is compared with the set of already occurring combinations. If there is no completely identical current seed time combination in the set of already occurring combinations, the current seed time combination is written into the set of already occurring combinations, and the next seed time combination is read.

[0038] If an identical current seed time combination already exists in the set of combinations, a retry process is initiated using the data identifier corresponding to the current seed time combination as the object: the number of consecutive retries is initialized to 0; in each retry, the entropy pool is updated first, and then a random seed and timestamp are regenerated. Specifically, random input is collected from the system entropy source and written to the entropy pool to update the entropy pool state; a secure random number generator is called to output a new random byte sequence from the updated entropy pool as a new random seed; the computer clock is read to obtain the millisecond-level Unix time value of the current moment to generate a new timestamp; the new random seed and the new timestamp are replaced and written to the original index positions corresponding to the data identifier in the random seed list and the timestamp list, and a new seed time combination is formed based on the replaced new random seed and the new timestamp, and the elements are judged again with the set of combinations that have already appeared; if the elements are determined to be non-duplicate, the new seed time combination that is non-duplicate at this time is written to the set of combinations that have already appeared and the retry process for the data identifier ends; if the elements are determined to be non-duplicate, the number of consecutive retries is incremented by 1 and the next retry is initiated, until the elements are determined to be non-duplicate or the number of consecutive retries reaches the preset upper limit.

[0039] If duplicates still exist after the number of consecutive retries reaches the preset limit, record the data identifier and its corresponding seed time combination in the duplicate combination list, mark the record corresponding to the data identifier as a failed generation and remove it so that it does not enter the subsequent encryption process; removal includes at least: deleting the image business data corresponding to the data identifier from the list to be encrypted, or marking it as an invalid record and skipping its processing in subsequent steps; after the traversal is completed, output the uniqueness verification result based on whether the duplicate combination list is empty. If the duplicate combination list is empty, the uniqueness verification result is determined to be passed, and the updated random seed list and timestamp list are output.

[0040] It should also be noted that the preset upper limit is based on the fault tolerance requirement of repeated combinations of random seed and timestamp. The random seed is generated by a secure random number generator, and the timestamp is generated by a computer clock. Under normal circumstances, the occurrence of "repeated combinations of random seed and timestamp" is an occasional event, which allows regeneration after updating the entropy pool to obtain a new combination. However, if repetition still occurs multiple times in a row, it is more likely that the secure random number generator output is abnormal, the entropy pool update fails, or the computer clock stops, causing the timestamp to remain unchanged. In this case, continuing to retries indefinitely may not generate a new combination and may cause a loop risk. Therefore, a preset upper limit is set to limit the number of retries. An example value for the preset upper limit is 3 times. A value greater than 3 times will increase the overall processing time and waste computing resources, while a value less than 3 times will increase the probability of generation failure, thereby reducing the amount of image business data that can be used for subsequent encryption processing.

[0041] S2.3 Convert the random seed and timestamp that have passed the uniqueness check into a random seed string and a timestamp string.

[0042] It should be noted that the sequential correspondence between the random seed list, timestamp list, and data identifier remains unchanged. During the conversion, each record is processed separately: when converting the random seed to a string, the current random seed is treated as a fixed-length byte sequence. Each byte value of the current random seed is read in byte order, and the high 4 bits and low 4 bits are taken respectively. The high 4 bits and low 4 bits are mapped to the character table "0123456789ABCDEF" in sequence to obtain two hexadecimal characters, which are then concatenated in sequence to generate a random seed string of constant length.

[0043] First, start taking numbers from the last digit of the timestamp. Each time, divide by 10 to get the remainder of the current last digit. Map the last digit to the characters 0 to 9 and record them in order. Then, divide the timestamp by 10 to remove the last digit. Repeat the remainder and integer division operations until the remainder is 0. Since the order of the numbers in the repeated remainder and integer division operations is from the least significant digit to the most significant digit, reverse the order of the recorded numbers and concatenate them to get a decimal integer string from the most significant digit to the least significant digit, which is the timestamp string. If a fixed length is required for output (e.g., millisecond-level timestamps are often fixed at 13 digits), add 0 characters to the left of the timestamp string until the required number of digits is met.

[0044] S2.4. Combine the random seed string and the timestamp string according to the splicing rules to generate the data key for the current image service data.

[0045] It should be noted that the secure random number generator is called to output a random byte sequence of fixed length 32 bytes, which is determined as the root key; the root key is written to an independent key storage location and set to be non-exportable, and can only be called and used in key derivation operations with the key identifier.

[0046] Read the current data identifier one by one in the order of the records to be encrypted. At the same index position of the current data identifier, read the current random seed string and the current timestamp string simultaneously. According to the concatenation rules, place the current random seed string at the beginning and the current timestamp string at the end. Concatenate them sequentially without separators to obtain the key material string of the current image service data. Convert the key material string into byte sequence B using UTF-8 character encoding. Specifically, the key material string consists of hexadecimal characters (0-9, A-F) and decimal characters (0-9). Hexadecimal and decimal characters belong to the ASCII subset under UTF-8. Each character corresponds to 1 byte, and the byte value is the ASCII code of the corresponding character. Arrange all bytes in the original character order to form byte sequence B. Perform key derivation operation with the root key as the key and byte sequence B as the message input to obtain a 32-byte hash output. Determine the 32-byte hash output as the data key of the current image service data and establish a correspondence between the data key and the current data identifier.

[0047] The concatenation rule refers to: a random seed string is a fixed-length hexadecimal string used as a prefix, a timestamp string is a fixed-length decimal string used as a suffix, and a key material string is formed without adding any separators, spaces or other characters. The key derivation operation refers to taking the UTF-8 byte sequence of the key material string as input and performing the key derivation operation with the help of the root key to obtain a 256-bit fixed-length output.

[0048] S2.5. Take the data identifier and the corresponding random seed and timestamp as a key metadata record, integrate all key metadata records to form a key metadata dataset.

[0049] It should be noted that, based on the data identifier, random seed string, and timestamp string, the records are traversed in their natural order. For each position in the sequence, the data identifier, the corresponding random seed string, and the corresponding timestamp string are bound together to form a complete key metadata record. This key metadata record is then added to an initially empty set. Once all records have been traversed, the key metadata dataset is formed.

[0050] By defining a timestamp field associated with the data identifier in the key metadata record, timestamp information related to the data identifier is stored, providing a time stamp for each data identifier. The timestamp field is usually a timestamp type field, which may include information such as year, month, day, hour, minute and second. More precise time units, such as milliseconds or microseconds, can also be set as needed to ensure that the time of data encryption operation can be accurately recorded.

[0051] It should be noted that existing technologies, by employing a unified symmetric encryption key to encrypt all sensitive data, achieve the advantages of simplicity in the encryption process and centralized key management. However, their drawback lies in the fact that the confidentiality of all data depends entirely on the reliability of a single key. If this single key is leaked or cracked, all encrypted information in the entire database can be easily decrypted, posing a security risk of large-scale data leakage. This solution, by independently generating random seeds and timestamps for each piece of image service data and combining them into a dynamic data key according to splicing rules, while performing strict uniqueness verification to ensure the uniqueness of each key, solves the security vulnerability caused by a single key. It achieves the goal of providing independent encryption protection for each piece of data, enhancing the overall resistance to attacks and the confidentiality strength of data storage.

[0052] S3. Perform symmetric encryption operation on the corresponding image service data using the data key to generate initial encrypted data. According to the mixing rule, embed a random seed into at least one embedding position of the initial encrypted data to form target encrypted data. Write the timestamp into the timestamp field associated with the data identifier to form the target encrypted dataset. The mixing rule is generated by the current data identifier and timestamp and is updated synchronously when the key is updated.

[0053] S3.1. Obtain the corresponding image service data from the list to be encrypted based on the data identifier in the key metadata set, use the data key as the key parameter, and encrypt the image service data through symmetric encryption operation to generate initial encrypted data.

[0054] It should be noted that, based on each key metadata record stored sequentially in the key metadata set, the data identifier and the corresponding random seed string and timestamp string are extracted from it, and a key material string is formed according to the concatenation rules. The key material string is then converted into a byte sequence using UTF-8 character encoding and a key derivation operation is performed to obtain the data key. Based on the extracted data identifier, the corresponding image business data is obtained by traversing and searching in the list to be encrypted.

[0055] Using the data key as the encryption key parameter, a one-time initialization vector is generated for the current data identifier. An authenticated symmetric encryption algorithm (AES-256-GCM algorithm) is invoked to perform encryption calculations on the acquired image service data. The data identifier is used as additional authentication data in the authentication calculation. A ciphertext segment and an authentication tag are output. The one-time initialization vector, ciphertext segment, and authentication tag are concatenated sequentially to obtain the initial encrypted data. The expression for the symmetric encryption algorithm's encryption calculation is as follows: ; in, Indicates the initial encrypted data; Indicates a ciphertext segment; This represents the encryption function of the AES-256-GCM algorithm; Indicates the data key; This represents image service data; Indicates certification label; Represents a one-time initialization vector; This indicates additional authentication data.

[0056] S3.2. Convert the random seed string into a random seed byte sequence, and concatenate the random seed byte sequence and the initial encrypted data according to the mixing rules to form the target encrypted data.

[0057] It should be noted that the corresponding random seed string is read according to the current data identifier, and the corresponding initial encrypted data is read as the object to be concatenated; the random seed string is taken out in pairs, and the two hexadecimal characters in each pair are mapped to the first four bits and the last four bits of a byte respectively. The first four bits and the last four bits are combined according to the bit segments to restore the random seed byte. The random seed byte sequence is obtained by writing it continuously in the order of the random seed string.

[0058] According to the preset mixing rules, a random seed byte sequence is appended as a prefix to the beginning of the initial encrypted data, while keeping the relative order of each byte inside the initial encrypted data unchanged, forming the target encrypted data. So that when reading or updating, the random seed byte sequence is extracted from the beginning of the target encrypted data at a fixed length and removed to restore the initial encrypted data.

[0059] The mixing rule refers to writing a random seed byte sequence at a fixed length to the front of the initial encrypted data to form the target encrypted data, so that when reading or updating, the random seed byte sequence is taken out from a specified position of the target encrypted data at a fixed length and removed from the target encrypted data to restore the initial encrypted data.

[0060] S3.3 Write the timestamp into the timestamp field associated with the current data identifier, associate the current data identifier with the target encrypted data, and form a data identifier-target encrypted data record.

[0061] It should be noted that the process involves extracting the current data identifier and its corresponding target encrypted data from the key metadata dataset; obtaining the current device time and writing the timestamp used to generate the data key into the timestamp field associated with the current data identifier; using the current data identifier as the key and the target encrypted data as the value to form a key-value pair, thus completing the association between the data identifier and the target encrypted data, forming a data identifier-target encrypted data record. The timestamp field records the encryption time and serves as the public input for key derivation operations. The data key is not directly determined by the random seed byte sequence and the timestamp, but rather by concatenating the random seed string and the timestamp string according to a specific rule. After the key material string is generated, a root key, which is stored only in an independent key storage area, is introduced to participate in the derivation operation to obtain a fixed-length data key. The root key is a fixed-length key generated during initialization and is not written into the target encrypted data, timestamp field, or key meta-dataset. The root key is not stored in the same place as the target encrypted data, so that even if a random seed byte sequence, timestamp field, and target encrypted data are obtained, the data key cannot be reconstructed and the image service data cannot be decrypted without the root key. The data identifier is stored or updated together with the corresponding target encrypted data to ensure that each data identifier-target encrypted data record can be traced back to the specific encryption time and encrypted data.

[0062] S3.4 Integrate all data identifiers and target encrypted data records to form a target encrypted dataset.

[0063] It should be noted that each data identifier-target encrypted data record is read one by one, and each data identifier and its corresponding target encrypted data are checked to ensure that they are correct. All data identifier-target encrypted data records are then integrated in the order of the data identifiers to form the target encrypted dataset.

[0064] It should also be noted that existing technologies use fixed keys to directly encrypt data. While this is simple to implement, it has drawbacks because the keys are static and centrally stored. If the keys are leaked, all data will be decrypted in batches. This solution uses dynamic keys and key components to store separately. A random seed is mixed into the ciphertext, and the timestamp is stored in an independent field. This makes the encryption key for each piece of data invalid in real time and cannot be obtained from a single location. This reduces the risk of data being cracked, increases the difficulty of brute-force attacks, improves data security, and reduces maintenance complexity and security operation and maintenance costs.

[0065] S4. Set key update conditions for each data identifier. When a data identifier in the target encrypted dataset meets the corresponding key update conditions, generate a new random seed, a new timestamp, and a new data key for the corresponding image business data. Perform re-encryption with the new data key, update the mixing rules and timestamp fields, and generate an updated encrypted dataset.

[0066] S4.1 Set key update conditions for each data identifier by defining time period thresholds and access count thresholds; monitor whether each data identifier in the target encrypted dataset meets the corresponding key update conditions through an event-driven mechanism.

[0067] It should be noted that the time period threshold is defined based on the key lifecycle management and is determined according to the access frequency, sensitivity, and industry compliance requirements of the encrypted data. For example, in the image cloud scenario, an exemplary value for the time period threshold is 12 months. If the time period threshold is greater than 12 months, it will increase the probability of being cracked or leaked, reducing the overall data security. If the value is less than 12 months, it will lead to increased maintenance costs, unnecessary operation and security burdens, and affect efficiency.

[0068] The access frequency threshold is defined based on the frequency of key usage to prevent attacks due to potential leakage risks during frequent key use. The access frequency threshold is defined according to the frequency of encrypted data usage, load, and data security requirements, and is set according to the number of key calls and the importance of the data in actual operation. An example value for the access frequency threshold is 1000 times. If the access frequency threshold is greater than 1000 times, the data key will not be updated for a long time under frequent access, increasing the risk of key exposure or abuse. If the actual value is less than 1000 times, it will lead to frequent data key updates, affecting performance and business continuity.

[0069] The time period threshold defines the maximum validity period of the data key, and the access count threshold specifies the maximum number of times the data key can be used. The triggering rule for key update conditions is "update is triggered if either condition is met": An event-driven mechanism calculates the time period condition and access count condition for each data identifier. The time period condition uses the last update time recorded in the timestamp field of the data identifier as the starting point and compares it with the current device time to determine if it has expired. The access count condition accumulates the number of read requests corresponding to the data identifier to determine if it has exceeded the limit. When both conditions are met simultaneously in the same check, only one key update is triggered. Key updates are implemented to avoid repeated re-encryption. When a key update is triggered, the data identifier is first marked as "updating". If it is already "updating", the update will not be triggered again. After both re-encryption and write update are successful, the access count of the data identifier is cleared to zero, and the timestamp field is updated to the newly generated timestamp to restart the time cycle. If re-encryption or write fails during the update process, the original data identifier-target encrypted data record remains unchanged and the "updating" mark is cleared, so that the update can be retried in the next check, thereby ensuring the uniqueness, consistency and recoverability of the update operation.

[0070] S4.2 When a data identifier meets the corresponding key update condition, a new random seed and a new timestamp are generated, and the new random seed and the new timestamp are combined according to the splicing rules to generate a new data key.

[0071] It should be noted that when the event-driven mechanism triggers a key update event, it calls a secure random number generator to generate a new random seed of fixed length 16 bytes, synchronously reads the computer clock, obtains the current millisecond-level Unix time value, and generates a new 13-digit decimal timestamp. According to the concatenation rules, the new random seed and the new timestamp are combined to form a new key material string. The new key material string is then converted into a byte sequence using UTF-8 character encoding and a key derivation operation is performed to obtain a new data key. The new data key is used for subsequent data encryption and decryption operations.

[0072] S4.3. Parse the image service data corresponding to the data identifier from the target encrypted data, re-encrypt the corresponding image service data using the new data key, generate updated initial encrypted data, embed the new random seed and update the corresponding timestamp field to form a data identifier-updated encrypted data record.

[0073] It should be noted that, based on the data identifier, the target encrypted data associated with the current data identifier is extracted from the target encrypted dataset. The old random seed is extracted from the target encrypted data, and combined with the old timestamp in the timestamp field, the old data key is reconstructed. The target encrypted data is decrypted using the old data key to obtain the original image service data. The original image service data is then re-encrypted using a symmetric encryption algorithm with the new data key to generate new encrypted data, which is the updated initial encrypted data. The new random seed is then embedded into the updated initial encrypted data according to the mixing rules to generate the updated encrypted data.

[0074] The timestamp in the corresponding timestamp field is updated to a new timestamp to reflect the time when the image business data was last encrypted, ensuring the consistency between the updated encrypted data and the new timestamp; the data identifier and the updated encrypted data are integrated to form a data identifier-updated encrypted data record.

[0075] S4.4 Integrate all data identifiers - update encrypted data records to form an updated encrypted dataset.

[0076] It should be noted that the process involves obtaining all generated data identifier-update encrypted data records, with each record containing a data identifier and its corresponding updated encrypted data; arranging all data identifier-update encrypted data records in the order of the data identifiers; merging all the arranged records to form an updated encrypted dataset; and storing or updating the updated encrypted dataset to the target storage medium to ensure that all data identifiers remain associated with the updated encrypted data.

[0077] S5. After receiving the read request, parse the new random seed and new timestamp from the updated encrypted data according to the data identifier, and reconstruct them into a new data key; perform decryption operation on the updated encrypted data according to the new data key to generate plaintext image service data.

[0078] S5.1 Receive data read request, extract the data identifier to be queried, and obtain the corresponding updated encrypted data from the updated encrypted dataset according to the data identifier to be queried.

[0079] It should be noted that the system receives query requests from users, parses the query requests, and extracts the specific data identifier and access credentials. Based on the access credentials, it performs identity verification of the requester and performs access authorization verification using the data identifier as the authorization object. The authorization verification includes at least determining whether the requester has the permission to read the encrypted data corresponding to the data identifier. When the authorization verification fails, it refuses to return the updated encrypted data and timestamp field content associated with the data identifier. When the authorization verification passes, it iterates and matches in the updated encrypted dataset according to the data identifier to find the data identifier-updated encrypted data record associated with the data identifier, and extracts the updated encrypted data for subsequent key reconstruction and authentication decryption. This forms a constraint of "authentication and authorization first, then data retrieval" at the reading entry point, reducing the risk of ciphertext exposure and misuse caused by unauthorized reading.

[0080] S5.2 After the authorization verification is passed, the new random seed is parsed from the updated encrypted data according to the mixing rules, the new timestamp is extracted from the timestamp field, and the new random seed and the new timestamp are reconstructed into a new data key according to the splicing rules. The authentication and decryption operation is performed on the updated initial encrypted data using the new data key to generate plaintext image business data.

[0081] It should be noted that, according to the mixing rules, a new random seed is extracted from the specified embedding position of the updated encrypted data and removed to obtain the updated initial encrypted data; a new timestamp is extracted from the timestamp field associated with the current data identifier, and the new random seed and the new timestamp are combined according to the concatenation rules to obtain the key material string; a new data key is obtained through key derivation operation; the data identifier is used as additional authentication data to participate in authentication and decryption; the authentication and decryption function is called with the new data key to decrypt the ciphertext segment and perform consistency verification on the authentication tag; when the authentication tag verification fails, it is determined that the updated initial encrypted data or related fields have been tampered with or the key does not match, and the plaintext image service data is rejected and a decryption failure flag is returned; when the authentication tag verification passes, the plaintext image service data corresponding to the data identifier is output.

[0082] The expression for the authentication and decryption operation is: ; in, This represents plaintext image service data; This represents the authentication and decryption function of the AES-256-GCM algorithm; This indicates the new data key.

[0083] In summary, this invention eliminates the risk of batch data decryption due to the leakage of a single key by dynamically generating an independent and unique data key for each piece of image business data. This establishes fine-grained isolation in complex attack environments, making it particularly suitable for the secure storage of massive image business data in image clouds and improving the data storage system's resistance to penetration and disaster recovery capabilities. By establishing a key update mechanism linked to data activity, it achieves intelligent adaptation of security policies to business scenarios. It can dynamically adjust protection strategies based on the clinical value and usage frequency of image business data, avoiding resource waste caused by fixed update cycles on low-frequency access data, while also protecting highly sensitive data. This optimizes overall energy efficiency while continuously ensuring security.

[0084] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for intelligent encrypted storage and protection of image cloud data, characterized in that: include, The image business dataset is acquired, merged, and assigned a data identifier to each image business data item. The image business data set and the corresponding data identifiers are then aggregated to form a list to be encrypted. For each image service data in the encryption list, a random seed and timestamp are generated, and the random seed and timestamp are combined according to the splicing rules to form the data key of the current image service data. The data identifier, random seed and timestamp are summarized to form a key meta dataset. Based on the data keys corresponding to each data identifier in the key metadata set, symmetric encryption operations are performed on the corresponding image service data to generate initial encrypted data. According to the mixing rules, a random seed is embedded into at least one embedding position of the initial encrypted data to form target encrypted data. The timestamp is written into the timestamp field associated with the data identifier to form the target encrypted dataset. The mixing rules are generated by the current data identifier and timestamp and are updated synchronously when the key is updated. Set key update conditions for each data identifier. When a data identifier in the target encrypted dataset meets the corresponding key update conditions, generate a new random seed, a new timestamp, and a new data key for the corresponding image business data. Perform re-encryption with the new data key, update the mixing rules and timestamp fields, and generate an updated encrypted dataset. Upon receiving a read request, the new random seed and new timestamp are parsed from the updated encrypted dataset according to the data identifier and reconstructed into a new data key; Based on the new data key, the updated encrypted data is decrypted to generate plaintext image service data.

2. The method for intelligent encrypted storage and protection of image cloud data as described in claim 1, characterized in that: The process involves acquiring image service datasets, merging them into individual image service data entries, assigning each entry a data identifier, and then summarizing the image service data sets and their corresponding data identifiers to form a list to be encrypted. The specific steps are as follows: Retrieve the image business data set from the image business database, and read the unique record number field of the image business data set one by one; Use the unique record number field as the data identifier, and perform uniqueness verification on the data identifier within the image business data set; According to the order of the image business data set, the uniquely verified data identifiers are paired with the corresponding image business data to generate a data identifier-image business data record; All data identification and image business data records are aggregated to form a list to be encrypted.

3. The method for intelligent encrypted storage and protection of image cloud data as described in claim 2, characterized in that: The process of generating a random seed and timestamp for each image service data item in the list to be encrypted is as follows: For the current data identifier, an entropy pool is constructed based on the system entropy source and a secure random number generator is called to output a random byte sequence from the entropy pool as a random seed; Read the computer clock and obtain millisecond-level Unix time values ​​to generate timestamps; Update the entropy pool and regenerate the random seed and timestamp until the uniqueness check passes; If the number of consecutive retries reaches the preset limit and still fails, the record corresponding to the current data identifier is marked as a generation failure and removed.

4. The method for intelligent encrypted storage and protection of image cloud data as described in claim 3, characterized in that: The steps for combining the random seed and timestamp according to the splicing rules to form the data key for the current image service data, and summarizing the data identifier, random seed, and timestamp to form a key metadata dataset, are as follows: Convert the uniqueness-validated random seed and timestamp into a random seed string and a timestamp string; According to the splicing rules, the random seed string and the timestamp string are combined to generate the data key for the current image business data; The data identifier and its corresponding random seed and timestamp are used as a key metadata record. All key metadata records are integrated to form a key metadata dataset.

5. The method for intelligent encrypted storage and protection of image cloud data as described in claim 4, characterized in that: The initial encrypted data is generated by performing symmetric encryption operations on the corresponding image service data based on the data keys corresponding to each data identifier in the key metadata set. The specific steps are as follows: The corresponding image service data is obtained from the list to be encrypted based on the data identifier in the key metadata set; Using the data key as a key parameter, the image service data is encrypted through symmetric encryption operations to generate initial encrypted data.

6. The method for intelligent encrypted storage and protection of image cloud data as described in claim 5, characterized in that: The process involves embedding a random seed into at least one embedding position in the initial encrypted data according to a mixing rule to form the target encrypted data, and writing a timestamp into a timestamp field associated with the data identifier to form the target encrypted dataset. The mixing rule is generated from the current data identifier and timestamp and is updated synchronously when the key is updated. The specific steps are as follows. The random seed string is converted into a random seed byte sequence, and the random seed byte sequence and the initial encrypted data are concatenated according to the mixing rules to form the target encrypted data. Write the timestamp into the timestamp field associated with the current data identifier, and associate the current data identifier with the target encrypted data to form a data identifier-target encrypted data record; Integrate all data identifiers and target encrypted data records to form a target encrypted dataset.

7. The method for intelligent encrypted storage and protection of image cloud data as described in claim 6, characterized in that: The specific steps for setting key update conditions for each data identifier are as follows. Key update conditions are set for each data identifier by defining time period thresholds and access count thresholds; The key update conditions include time period conditions and access count conditions.

8. The method for intelligent encrypted storage and protection of image cloud data as described in claim 7, characterized in that: When a data identifier in the target encrypted dataset meets the corresponding key update condition, a new random seed, a new timestamp, and a new data key for the corresponding image service data are generated. The specific steps are as follows. The event-driven mechanism periodically checks whether each data identifier in the target encrypted dataset meets the corresponding key update conditions. When a data identifier meets the corresponding key update condition, a new random seed and a new timestamp are generated, and the new random seed and the new timestamp are combined according to the concatenation rules to generate a new data key.

9. The method for intelligent encrypted storage and protection of image cloud data as described in claim 8, characterized in that: The steps for re-encrypting with the new data key, updating the mixing rules and timestamp fields, and generating an updated encrypted dataset are as follows. Parse the target encrypted data to generate image service data corresponding to the data identifier; The corresponding image business data is re-encrypted using the new data key to generate updated initial encrypted data. The new random seed is embedded and the corresponding timestamp field is updated to form a data identifier-updated encrypted data record. Integrate all data identifiers and update encrypted data records to form an updated encrypted dataset.

10. The method for intelligent encrypted storage and protection of image cloud data as described in claim 9, characterized in that: The specific steps for generating plaintext image service data by performing decryption operations on the updated encrypted data based on the new data key are as follows. Receive data read requests, extract the data identifier to be queried, and obtain the corresponding updated encrypted data from the updated encrypted dataset based on the data identifier to be queried; The new random seed is parsed from the corresponding updated encrypted data according to the mixing rules, the new timestamp is extracted from the timestamp field, and the new random seed and the new timestamp are reconstructed into a new data key according to the splicing rules. The new data key is used to update the initial encrypted data and perform decryption operations to generate plaintext image service data.

Images