Data security storage and access control method and system in cloud computing environment

Abstract

The invention provides a data security storage and access control method and system in a cloud computing environment, and the method comprises a step of obtaining and storing to-be-stored data, and a step of accessing target data according to a data access instruction of a user. The step of obtaining and storing the to-be-stored data comprises the steps of randomly splitting the to-be-stored data into a plurality of data blocks after the to-be-stored data is received, encrypting the data blocks, adding filling data into each data block to obtain a reconstructed data block, and randomly storing the reconstructed data block on a plurality of physical nodes, therefore, the stored data cannot be read from a single physical node, the stored data can be prevented from being leaked, and the security of data storage is improved; and data in each reconstructed data block is encrypted, and filling data is set to increase interference, so that the security of data storage can be further improved.

Description

Technical Field

[0001] This invention relates to the field of data security storage technology, and in particular to a data security storage and access control method and system in a cloud computing environment. Background Technology

[0002] Cloud servers provide simple, efficient, secure, reliable, and scalable computing services. Their management is simpler than that of physical servers, allowing users to create and release data efficiently. This can significantly reduce server maintenance costs and improve operational efficiency.

[0003] Since cloud servers are virtual computers running on the Internet, they are vulnerable to hacking and data leaks. Therefore, improving the data security of cloud servers is a technical problem that the data stored in the cloud computing environment needs to address. Summary of the Invention

[0004] This invention provides a data security storage and access control method and system in a cloud computing environment, which is used to improve the security of data storage in a cloud computing environment.

[0005] Specifically, in a first aspect, the present invention provides a data security storage and access control method in a cloud computing environment, including the steps of acquiring data to be stored and storing it, and the steps of accessing the target data according to the user's data access instructions; The step of acquiring and storing the data to be stored includes: The data to be stored is split into multiple data blocks of different sizes. A sequence number is generated for each data block according to the order of the data blocks. Each sequence number is added to its corresponding data block. The multiple data blocks are then randomly sorted. Obtain the identity information of the user corresponding to the data to be stored, and generate a key for each data block according to the identity information and the random sorting, and encrypt the corresponding data block using each key; Each data block is split into multiple valid sub-data blocks, and padding data is added between the valid sub-data blocks to transform each data block into a reconstructed data block. The storage data blocks are randomly stored on different physical nodes of the server, and the storage address of each valid sub-data block is obtained. The storage information of the data to be stored is constructed based on the physical node where each storage data block is located and the storage address. The step of accessing the stored data according to the user's data access instructions includes: Obtain target storage information according to the data access instruction, and read valid sub-data blocks of each storage data block according to the target storage information; The target data block is constructed based on the valid sub-data blocks, and the target data block is sent to the user's client according to the random sorting.

[0006] Furthermore, before the step of obtaining the target storage information according to the data access instruction, the method further includes: obtaining user information corresponding to the data access instruction, and determining whether the data access instruction is valid based on the user information; If so, then obtain the timestamp of the data access instruction, and if the timestamp falls within a set working time period, execute the step of obtaining the target storage information according to the data access instruction; If the timestamp is not within the set working time period, it is determined that the user corresponding to the data access instruction is abnormal.

[0007] Furthermore, after the step of determining that the user corresponding to the data access instruction is abnormal, the method further includes: if the user corresponding to the data access instruction is determined to be abnormal a set number of times consecutively, then biometric authentication of the user is triggered.

[0008] Furthermore, after the step of accessing the target data according to the user's data access instruction, the method further includes: generating an access log for the target data and storing the access log using a blockchain.

[0009] Furthermore, after the step of accessing the target data according to the user's data access instruction, the method further includes: obtaining the access frequency of each stored data, and adjusting the corresponding redundant backup amount of the stored data according to each access frequency.

[0010] Furthermore, after the step of acquiring and storing the data to be stored, the following is also included: In response to receiving a data modification instruction, the system obtains the identity information of the user corresponding to the data modification instruction and the target data corresponding to the data modification instruction, and verifies whether the user has the permission to modify the target data based on the identity information. If so, the corresponding target data is modified according to the data modification instruction.

[0011] Further at the end of the month, after the step of modifying the corresponding target data according to the data modification instruction, the method further includes: obtaining the historical users who accessed the target data, and sending the modified target data to the historical users.

[0012] Furthermore, after the step of accessing the target data according to the user's data access instructions, the method further includes: generating a behavioral profile of the user based on the user's access records, and adjusting the user's permission threshold based on the behavioral profile.

[0013] Furthermore, after the step of acquiring and storing the data to be stored, the method further includes: acquiring the sensitivity of the stored data, and periodically updating the key of the stored data based on the sensitivity.

[0014] Secondly, the present invention also provides a data security storage and access control system in a cloud computing environment, including a processor and a memory, wherein the memory stores a computer program, and the processor is used to execute the computer program to implement the steps of the data security storage and access control method described above.

[0015] In the technical solution of this invention, after receiving the data to be stored, the data to be stored is randomly split into multiple data blocks and encrypted. Padding data is added to each data block to obtain a reconstructed data block, and the reconstructed data block is randomly stored on multiple physical nodes. Therefore, the stored data cannot be read from a single physical node, thus preventing the stored data from being leaked and improving the security of data storage. Furthermore, the data in each reconstructed data block is not only encrypted, but also padded with data to increase interference, which can further enhance the security of data storage.

[0016] The above and other objects, advantages and features of the present invention will become more apparent to those skilled in the art from the following detailed description of specific embodiments of the invention in conjunction with the accompanying drawings. Attached Figure Description

[0017] The following sections will describe some specific embodiments of the invention in a detailed manner by way of example and not limitation, with reference to the accompanying drawings. The same reference numerals in the drawings denote the same or similar parts or portions. Those skilled in the art should understand that these drawings are not necessarily drawn to scale. In the drawings: Figure 1 This is a flowchart illustrating a data security storage and access control method in a cloud computing environment according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating the process of obtaining and storing data to be stored in a cloud computing environment according to an embodiment of the present invention. Figure 3 This is a flowchart illustrating the process of accessing stored data according to a user's data access instruction in a cloud computing environment, according to an embodiment of the present invention. Figure 4This is a schematic diagram of a data security storage and access control system in a cloud computing environment according to an embodiment of the present invention. Detailed Implementation

[0018] The following reference Figures 1 to 4 This invention describes a data security storage and access control method and system in a cloud computing environment, according to embodiments of the present invention. In this description, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first" and "second" may explicitly or implicitly include at least one of that feature, that is, include one or more of that feature. In the description of this invention, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified. When a feature "includes or contains" one or more of the features it encompasses, unless otherwise specifically described, this indicates that other features are not excluded and may be further included.

[0019] In the description of this embodiment, the terms "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0020] Specifically, please refer to Figure 1 , Figure 2 and Figure 3 ,in Figure 1 This is a flowchart illustrating a data security storage and access control method in a cloud computing environment according to an embodiment of the present invention. The method improves data security by controlling the storage and access of data on a cloud server.

[0021] Specifically, the data security storage and access control method of this embodiment includes the following steps: Step S101: Obtain the data to be stored and store it; Step S102: Access the stored data according to the user's data access instruction.

[0022] The method for obtaining and storing the data to be stored in step S101 is as follows: Figure 2 As shown, it includes the following steps: Step S111: Randomly split the data to be stored into multiple data blocks of different sizes, and set the sequence number of each data block. Step S112 adds each data block to its corresponding data block and randomly sorts the data blocks. Step S113: Obtain the identity information of the user corresponding to the data to be stored, and generate a key for each data block according to the random sorting of the data blocks based on the identity information, and encrypt the corresponding data block using each key. Step S114: Each data block is split into multiple valid sub-data blocks of the same size, and padding data is added between adjacent valid sub-data blocks to transform each data block into a corresponding reconstructed data block. Step S115: Randomly store the reconstructed data blocks on different physical nodes of the server, and obtain the storage address of each valid sub-data block; Step S116: Construct storage information for the data to be stored based on the physical node where each reconstructed data block is located and the storage address of each valid sub-data block.

[0023] In step S111 above, assuming the length of the data to be stored is N and its value is set to P, and given that the number of data blocks must be greater than N / P, a random function can be used to randomly select a positive integer within the range greater than N / P and less than 2N / P as the number of data blocks. Let the selected positive integer be n, meaning the data to be stored needs to be split into n data blocks. Then, the size of each data block is randomly obtained, and let the size of the i-th data block be L. i Then the following conditions must be met: In step S112 above, after splitting the data to be stored into n data blocks, where the sequence number of the i-th data block is i, the required value is converted into a character and added to the beginning of the i-th data block.

[0024] In step S113 above, when the client sends the data to be stored to the cloud server, it also sends the timestamp of the data to be stored and the client's client number to the cloud server. Therefore, a preset key generation model can be used to generate n keys based on the user's identity information, the timestamp of the data to be stored, and the client's client number, where the i-th key is the key corresponding to the i-th data block. Then, a preset encryption algorithm is used to encrypt the corresponding data block with each key to obtain the encrypted data block.

[0025] In this embodiment, the preset key generation model includes multiple key sub-models based on RNN neural networks. After inputting the timestamp of the data to be stored, the user's identity information, and the client's number into one of the key sub-models, the key sub-model can generate a key in a set format. Furthermore, the same RNN neural network can be trained using different training datasets to obtain multiple key sub-models, so that each key sub-model can obtain different keys based on the same input data.

[0026] Assume the number of key sub-models in the key generation model is . After splitting the data to be stored into n data blocks, the i-th data block and the n-th data block... Each key sub-model corresponds to a preset encryption algorithm, which is used to encrypt the corresponding data blocks according to different key sub-models. The preset encryption algorithm is a symmetric encryption algorithm, such as the AES encryption algorithm. Since this encryption algorithm is existing technology, it will not be described in detail in this embodiment.

[0027] In step S114 above, a set character can be used to construct padding data, and this padding data can be randomly filled into the data block to obtain the reconstructed data block. Taking the i-th data block as an example, suppose this data block is split into m valid sub-data blocks, where the length of the set character is... l The first valid sub-data block is padded with h0 specified characters, and the j-th valid sub-data block is padded with h characters between it and the (j+1)-th valid sub-data block. j There are m valid sub-data blocks, and h is padded after the m-th valid sub-data block. m+1 If there are 1 valid sub-data block, then randomly generate h0 to h... m+1 And it must meet the following conditions: After filling each data block with data, n reconstructed data blocks can be obtained.

[0028] In step S115 above, the cloud server has multiple physical nodes in a distributed configuration, and each physical node is a physical device used to store data. Each reconstructed data block is randomly assigned to a physical node, and the storage address of each valid sub-data block on its corresponding physical node is obtained.

[0029] Taking the i-th reconstructed data block as an example, after storing the reconstructed data block in one of the physical nodes, the reconstructed data block can be divided into multiple sub-data blocks and stored in the physical node, and then the storage address of the valid sub-data blocks can be obtained.

[0030] In step S116 above, the constructed storage information includes the number of reconstructed data blocks constructed from the data to be stored, the physical node where each data block is located, and the storage address of the valid sub-data blocks in each reconstructed data block, and constructs a query index for the data to be stored, such as the name, type or ID of the data to be stored.

[0031] In step S102 above, the method for accessing stored data according to the user's data access instruction is as follows: Figure 3 As shown, the specific steps include the following: Step S121: Obtain target storage information according to the user's data access instruction, and read valid sub-data blocks from the physical node according to the target index; Step S122: Construct target data blocks based on the read valid sub-databases, and obtain target data that matches the data access instructions according to the arrangement order of the target data blocks.

[0032] In step S121 above, the query index of the target data can be obtained first according to the data access instruction, and the stored data can be shrunk according to the query index to obtain the storage information corresponding to the query index, which is the target storage information. Then, the physical node where each reconstructed data block is located and the storage address of the valid sub-data blocks in each reconstructed data block are obtained according to the target storage information, and the valid sub-data blocks in the target data are read according to the storage address. Then, the valid sub-data blocks in each reconstructed data block are arranged in order and combined to obtain the target data block corresponding to each reconstructed data block.

[0033] In step S122 above, after the user's client sends the data to be stored to the cloud server, it uses a preset key generation model to generate n keys based on the user's identity information, the timestamp of the data to be stored, and the client's IP address. Since the target data block sent to the client is encrypted, after receiving the target data block, the client uses the generated keys to decrypt each target data block to obtain the sequence number and plaintext of each target data block. Then, the plaintext is sorted according to the sequence number to obtain the target data that matches the data access command.

[0034] As can be seen from the above, in this embodiment, after receiving the data to be stored, the data to be stored is randomly split into multiple data blocks and encrypted. Padding data is added to each data block to obtain a reconstructed data block, and the reconstructed data block is randomly stored on multiple physical nodes. Therefore, the stored data cannot be read from a single physical node, thus preventing the stored data from being leaked and improving the security of data storage. Furthermore, the data in each reconstructed data block is not only encrypted, but also padded with data to increase interference, which can further enhance the security of data storage.

[0035] In some embodiments of the present invention, before obtaining the target storage information according to the user's data access instruction, step S121 further includes: Obtain user information corresponding to the data access command, and determine whether the data access command is valid based on the user information; If it is invalid, it is determined that the user corresponding to the data access command is abnormal; If valid, obtain the timestamp of the data access instruction and determine whether the timestamp is within the set working time period; If present, continue with the step of obtaining the target storage information according to the data access instruction; If not, it is determined that the user corresponding to the data access command is abnormal.

[0036] In this embodiment, after obtaining the user information corresponding to the data access instruction, the access permissions of the target data can be obtained according to the data access instruction, and the corresponding user permissions can be obtained according to the user information. It is then determined whether the user permissions meet the access permissions required by the target data. If they do not meet the requirements, the data access instruction is deemed invalid; if they do meet the requirements, the data access instruction is deemed valid.

[0037] For example, if the access permission of the target data corresponding to the data access instruction is: personnel of Department A; then if the user information shows that the user belongs to personnel of Department A, the data access instruction is deemed to be legal; otherwise, the data access instruction is deemed to be illegal.

[0038] In this embodiment, the set working time period can be set to 8:00 to 20:00 every day. If a data access instruction is received within the set working time period, that is, if the timestamp of the data access instruction is within the set working time period, it can be determined that the user is not abnormal; otherwise, it can be determined that the user is abnormal.

[0039] In this embodiment, before obtaining the target storage information according to the user's data access instruction, the user information and timestamp of the data access instruction are verified to prevent unauthorized users or access to the stored data during illegal time periods, thereby further improving the security of data storage.

[0040] In some embodiments of the present invention, if it is determined that the user corresponding to the data access instruction is abnormal, it is further determined whether the user has been judged to be abnormal for a consecutive number of times. If so, then biometric authentication for that user will be triggered.

[0041] In this embodiment, biometric authentication of the user is triggered by fingerprint authentication, facial recognition authentication, or retinal authentication. Specifically, fingerprint, facial, and retinal feature information for each user can be pre-stored. After biometric authentication is triggered, the user's fingerprint, facial recognition, or retinal authentication is collected again, and it is determined whether the collected fingerprint, facial recognition, or retinal authentication matches the stored fingerprint, facial recognition, and retinal authentication. If they match, the user is deemed a legitimate user; otherwise, the user is deemed an illegitimate user, and their access permissions are frozen. Access permissions are restored after the user's biometric authentication is successful.

[0042] In this embodiment, if an abnormality is detected in a user multiple times in a row, the user may be an unauthorized user. Therefore, biometric authentication is initiated to re-verify the user's identity information, thereby further improving the security of data storage.

[0043] In some embodiments of the present invention, after accessing the stored data according to the user's data access instruction in step S102, the method further includes: generating an access log of the target data and storing the access log using a blockchain.

[0044] In this embodiment, the blockchain includes multiple nodes, and these nodes jointly maintain a log list. The nodes in the log list are used to store data access logs. The generated access log for the target data includes the time the target data was accessed, as well as the username of the user accessing the target data, the client ID of the client used, and the access time. A new node is generated in the log list based on this access log and maintained in the blockchain.

[0045] In this embodiment, blockchain is used to record access logs, which can prevent the access logs from being tampered with and improve the security of data storage.

[0046] In some embodiments of the present invention, after accessing the target data according to the user's data access instruction in step S102, the method further includes: Obtain the access frequency of each stored data item, and adjust the redundant backup amount of the corresponding stored data item according to each access frequency.

[0047] In this embodiment, a correspondence between access frequency and redundant backup amount can be pre-established. This correspondence indicates that the higher the access frequency of the stored data, the larger the corresponding redundant backup amount. After obtaining the access frequency of the stored data, the redundant backup amount of the stored data is obtained according to the access frequency and the correspondence, and the redundant backup of the stored data is performed according to the redundant backup amount.

[0048] For example, if the access frequency of one of the stored data is v, then the stored data is stored in v copies on the cloud server. Multiple data blocks of each copy of the stored data are randomly stored on different physical nodes, and the storage information of the stored data is regenerated. The storage information includes the amount of redundant backups of the stored data, as well as the physical node where each data block in each copy of the stored data is located.

[0049] This embodiment sets the redundancy backup amount according to the access frequency of the stored data, which can improve the efficiency of data access.

[0050] In some embodiments of the present invention, after obtaining and storing the data to be stored in step S101, the method further includes: If a data modification instruction is received, the identity information of the user corresponding to the data modification instruction and the target data corresponding to the data modification instruction are obtained, and the user is verified to have the permission to modify the target data based on the identity information. If so, the target data will be modified according to the data modification instructions.

[0051] For example, in this embodiment, after receiving the data to be stored, the identity information of the user corresponding to the data can be obtained, and the user's department and job level can be obtained based on the identity information; after obtaining the identity information of the user corresponding to the data modification instruction, the user's department and job level can be obtained based on the identity information. If the department of the user corresponding to the data modification instruction is the same as the department of the user corresponding to the data to be stored, and the job level of the user corresponding to the data to be stored is not higher than the job level of the user corresponding to the data modification instruction, then it is determined that the user corresponding to the data modification instruction has the authority to modify the target data.

[0052] In this embodiment, the method for modifying target data according to the data modification instruction includes: reading the target data according to the data modification instruction, modifying the target data, storing the modified target data as new data to be stored, and finally deleting the original target data.

[0053] In this embodiment, after receiving a data modification instruction, the system first verifies whether the user has the permission to modify the target data, thereby preventing the stored data from being illegally tampered with and improving the security of data storage.

[0054] In some embodiments of the present invention, after modifying the target data according to the data modification instruction, the method further includes: obtaining the historical users who accessed the target data, and sending the target data to the historical users.

[0055] After receiving the target data that matches the data access instruction, the client stores the target data for later use. However, after modifying the stored data, there will be differences between the stored data and the data on the client. Therefore, after modifying the target data according to the data modification instruction, the client also sends the target data to its historical users.

[0056] For example, if user A is a previous user of the target data, after modifying the target data according to the data modification instruction, the target data will also be sent to user A; after receiving the target data, user A's client will decrypt and store it, as well as delete the original target data.

[0057] In this embodiment, after modifying the data, the modified data is also sent to its historical access users to ensure that the modification is consistent with the data on the client, thereby improving the reliability and accuracy of data access.

[0058] In some embodiments of the present invention, after the step of accessing the stored data, the method further includes: generating a behavioral profile of the user based on the user's access records, and adjusting the user's permission threshold based on the behavioral profile.

[0059] In this embodiment, the user's historical access data type, the client number of commonly used clients, and the access time period can be obtained from the user's access records to obtain the user's behavior profile. Based on the behavior profile, the user type can be obtained, and based on the user type, the user's permission threshold can be determined.

[0060] For example, in this embodiment, multiple user types, permission thresholds, and behavioral profiles can be pre-set, and the access data type, client encoding change frequency, and access time period corresponding to each behavioral profile can be set. After obtaining the user's historical access data type, the client number of commonly used clients, and the access time period, the user type can be obtained based on the user's historical access data type, the change frequency of the client number, and the access time period, and the permission threshold corresponding to the user type can be used as the user's permission threshold.

[0061] In this embodiment, the user's permission threshold includes the user's operation permission on the data accessed. If the user's behavior profile indicates that the user frequently changes clients, has irregular access time periods, and has a large number of historical access data types, then the user's permission threshold is lowered. If the user's permission threshold is less than the first set threshold, then the user is prohibited from accessing the stored data. If the user's permission threshold is greater than the first set threshold but less than the second set threshold, then the user is allowed to access the data but is prohibited from modifying the stored data. If the user's permission threshold is greater than the second set threshold, then the user is allowed to access and modify the stored data.

[0062] In some embodiments of the present invention, after the step of obtaining and storing the data to be stored in step S101 above, the method further includes: obtaining the sensitivity of the stored data, and periodically updating the key of the stored data according to the sensitivity.

[0063] In this embodiment, a correspondence between sensitivity and update cycle can be pre-established. After obtaining the sensitivity of the stored data, the key update cycle of the stored data is obtained based on this correspondence and the sensitivity. The key of the stored data is updated once every key update cycle. Correspondingly, the key of the stored data is also periodically updated on the client to synchronize the client's key with the key on the cloud server.

[0064] Specifically, in this embodiment, a preset key generation model can be used to generate n keys based on the user's identity information, the IP address of the client whose data to be stored is to be stored, and the current time. The stored data can then be re-encrypted using these keys to complete the key update for the stored data.

[0065] In this embodiment, after storing the data, the key is periodically updated according to the sensitivity of the data, which can further improve the security of the stored data.

[0066] The flowcharts provided in this embodiment are not intended to indicate that the operations of the method will be performed in any particular order, or that all operations of the method are included in every case. Furthermore, the methods described above may include additional operations. Within the scope of the technical concept provided by the methods in this embodiment, additional variations can be made to the methods described above.

[0067] It should be understood that in some embodiments, the components may be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods may be implemented using software or firmware stored in memory and executed by a suitable instruction execution system.

[0068] This embodiment also provides a data security storage and access control system 30 in a cloud computing environment, such as Figure 4As shown, the data security storage and access control 30 in a cloud computing environment may include a memory 31, a processor 32, and a computer program 11 stored on the memory 31 and running on the processor 32. The processor 32 runs the computer program 11 to implement the steps of the data security storage and access control method in a cloud computing environment in any of the above embodiments.

[0069] Data security storage and access control 30 in a cloud computing environment can be, for example, a server, desktop computer, laptop computer, tablet computer, or smartphone. In some examples, data security storage and access control system 30 in a cloud computing environment can be a cloud computing node. Data security storage and access control system 30 in a cloud computing environment can be described in the general context of computer system executable instructions (such as program modules) executed by a computer system. Typically, program modules can include routines, programs, object programs, components, logic, data structures, etc., that perform specific tasks or implement specific abstract data types. Data security storage and access control system 30 in a cloud computing environment can be implemented in a distributed cloud computing environment where tasks are performed on remote processing devices linked via a communication network. In a distributed cloud computing environment, program modules can reside on local or remote computing system storage media, including storage devices.

[0070] The data security storage and access control system 30 in a cloud computing environment may include a processor 32 adapted to execute storage instructions and a memory 31 that provides temporary storage space for the operation of said instructions during operation. The processor 32 may be a single-core processor, a multi-core processor, a computing cluster, or any other configuration. The memory 31 may include random access memory (RAM), read-only memory, flash memory, or any other suitable storage system.

[0071] The data security storage and access control system 30 in a cloud computing environment may also include network adapters / interfaces and input / output (I / O) interfaces. I / O interfaces allow external devices that can be connected to the computer to input and output data. Network adapters / interfaces provide communication between the computer device and a network, typically represented as a communication network.

[0072] Therefore, those skilled in the art should recognize that although numerous exemplary embodiments of the present invention have been shown and described in detail herein, many other variations or modifications conforming to the principles of the present invention can be directly determined or derived from the disclosure of the present invention without departing from the spirit and scope of the invention. Thus, the scope of the present invention should be understood and construed as covering all such other variations or modifications.

Claims

1. A method for secure data storage and access control in a cloud computing environment, characterized in that, This includes the steps of acquiring and storing the data to be stored, and the steps of accessing the target data according to the user's data access instructions; The step of acquiring and storing the data to be stored includes: The data to be stored is split into multiple data blocks of different sizes. A sequence number is generated for each data block according to the order of the data blocks. Each sequence number is added to its corresponding data block. The multiple data blocks are then randomly sorted. Obtain the identity information of the user corresponding to the data to be stored, and generate a key for each data block according to the identity information and the random sorting, and encrypt the corresponding data block using each key; Each data block is split into multiple valid sub-data blocks, and padding data is added between the valid sub-data blocks to transform each data block into a reconstructed data block. The storage data blocks are randomly stored on different physical nodes of the server, and the storage address of each valid sub-data block is obtained. The storage information of the data to be stored is constructed based on the physical node where each storage data block is located and the storage address. The step of accessing the stored data according to the user's data access instructions includes: Obtain target storage information according to the data access instruction, and read valid sub-data blocks of each storage data block according to the target storage information; The target data block is constructed based on the valid sub-data blocks, and the target data block is sent to the user's client according to the random sorting.

2. The data security storage and access control method according to claim 1, characterized in that, The method further includes the following steps before the step of obtaining the target storage information according to the data access instruction: Obtain user information corresponding to the data access instruction, and determine whether the data access instruction is valid based on the user information; If so, then obtain the timestamp of the data access instruction, and if the timestamp falls within a set working time period, execute the step of obtaining the target storage information according to the data access instruction; If the timestamp is not within the set working time period, it is determined that the user corresponding to the data access instruction is abnormal.

3. The data security storage and access control method according to claim 2, characterized in that, Following the step of determining that the user corresponding to the data access instruction has an anomaly, the method further includes: If the user corresponding to the data access command is determined to be abnormal after a set number of consecutive attempts, biometric authentication of the user will be triggered.

4. The data security storage and access control method according to claim 1, characterized in that, Following the step of accessing the target data according to the user's data access instructions, the method further includes: An access log for the target data is generated, and the access log is stored using a blockchain.

5. The data security storage and access control method according to claim 1, characterized in that, Following the step of accessing the target data according to the user's data access instructions, the method further includes: Obtain the access frequency of each stored data, and adjust the redundant backup amount of the corresponding stored data according to each access frequency.

6. The data security storage and access control method according to claim 1, characterized in that, Following the step of acquiring and storing the data to be stored, the following is also included: In response to receiving a data modification instruction, the system obtains the identity information of the user corresponding to the data modification instruction and the target data corresponding to the data modification instruction, and verifies whether the user has the permission to modify the target data based on the identity information. If so, the corresponding target data is modified according to the data modification instruction.

7. The data security storage and access control method according to claim 6, characterized in that, Following the step of modifying the corresponding target data according to the data modification instruction, the method further includes: The system retrieves the historical users who accessed the target data and sends the modified target data to those historical users.

8. The data security storage and access control method according to claim 1, characterized in that, Following the step of accessing the target data according to the user's data access instructions, the method further includes: Generate a behavioral profile of the user based on their access records, and adjust the user's permission thresholds based on the behavioral profile.

9. The data security storage and access control method according to claim 1, characterized in that, Following the step of acquiring and storing the data to be stored, the following is also included: The sensitivity of the stored data is obtained, and the key of the stored data is periodically updated based on the sensitivity.

10. A data security storage and access control system in a cloud computing environment, characterized in that, The method includes a processor and a memory, wherein a computer program is stored on the memory, and the processor is used to execute the computer program to implement the steps of the data security storage and access control method according to any one of claims 1-9.

Images