A user information encryption method and system applied to a cloud platform

Abstract

This invention relates to the field of data encryption technology and provides a user information encryption method and system for cloud platforms, comprising the following steps: collecting multi-dimensional environmental characteristics of the user's current environment, combining the user's login password and a random perturbation factor issued by the server to generate an environmental fingerprint hash value; generating a data encryption key for the user data to be encrypted; determining the dynamic trust level index corresponding to the current environment based on the multi-dimensional environmental characteristics and historical environmental profiles; calculating and generating a packaged key using a one-way function based on the environmental fingerprint hash value, the data encryption key, and the dynamic trust level index; encrypting the user data with the data encryption key to obtain ciphertext, storing the ciphertext and the packaged key together on the cloud platform, and destroying the data encryption key. By dynamically generating the trust level index and embedding it into the key packaging process, decryption is smooth in high-trust environments and impossible in low-trust environments, ensuring security and efficiency.

Description

Technical Field

[0001] This invention relates to the field of data encryption technology, specifically to a method and system for encrypting user information applied to a cloud platform. Background Technology

[0002] With the popularization of cloud computing technology, more and more users are storing their personal privacy data on cloud platforms. Traditional cloud platform user information encryption methods mainly adopt the following two modes: 1. Encryption based on user password: User passwords are used to generate encryption keys through key derivation functions to encrypt user data. This method is simple and easy to implement, but it has obvious drawbacks: once a user's password is leaked (e.g., through phishing attacks or database breaches), attackers can decrypt all historical and future data. Furthermore, if a user uses the same password on different devices, data on all devices faces the same risk.

[0003] 2. Static Key Encryption: The cloud platform generates a static master key for each user to encrypt user data. The master key is typically stored in a hardware security module or key management service. While this method is more secure than passwords, a stolen static key can still lead to large-scale data breaches. Furthermore, static keys cannot differentiate between the security of the user's login environment; for example, data can still be decrypted on public Wi-Fi and insecure devices.

[0004] Existing technologies have attempted to enhance security using multi-factor authentication or attribute-based encryption, but these schemes often introduce complex key management overhead, impacting user experience and making it difficult to achieve fine-grained, dynamic, and environment-aware protection. For example, attribute-based encryption requires complex attribute management and key distribution, making it unsuitable for large-scale real-time access scenarios. Therefore, there is a need to provide a user information encryption method and system for cloud platforms, aiming to address the aforementioned issues. Summary of the Invention

[0005] In view of the shortcomings of the existing technology, the purpose of this invention is to provide a user information encryption method and system applied to cloud platforms to solve the problems existing in the background technology.

[0006] This invention is implemented as follows: a user information encryption method applied to a cloud platform, the method comprising the following steps: Collect the user's current multidimensional environmental characteristics, combine them with the user's login password and the random perturbation factor issued by the server, and generate an environmental fingerprint hash value; Generate data encryption keys for user data that needs to be encrypted; The dynamic trust level index corresponding to the current environment is determined based on multi-dimensional environmental characteristics and historical environmental profiles. Based on the environmental fingerprint hash value, the data encryption key, and the dynamic trust level index, a one-way function is used to calculate and generate the packaged key. The user data is encrypted using a data encryption key to obtain ciphertext. The ciphertext is then associated with the packaged key and stored on the cloud platform, and the data encryption key is destroyed.

[0007] As a further aspect of the present invention, the step of generating the environmental fingerprint hash value specifically includes: Collect hardware fingerprints and network features of user terminal devices to obtain multi-dimensional environmental features; The key derivation function is called to process the user's login password and obtain the user's secret fragment; The user's environmental fingerprint hash value is obtained by performing a one-way hash operation on the multidimensional environmental feature vector, random perturbation factor, and user secret fragment.

[0008] As a further aspect of the present invention, the step of determining the dynamic trust level index corresponding to the current environment specifically includes: The currently collected multi-dimensional environmental features are compared with the historical environmental profiles stored on the cloud platform to calculate the environmental similarity score. Get real-time user behavior data in the current session, match it with a pre-built user behavior baseline, and calculate the behavior anomaly score; The environmental similarity score and behavioral anomaly score are input into a preset trust assessment model to obtain the dynamic trust level index of the current environment.

[0009] As a further aspect of the present invention, the step of generating the packaged key through a one-way function specifically includes: The data encryption key and the environmental fingerprint hash value are XORed bitwise to obtain an intermediate mixed value. Obtain a public base point on the elliptic curve, and perform scalar multiplication on the public base point on the elliptic curve with the dynamic trust level index as the power to obtain the first elliptic curve point. The intermediate mixed value is converted into a scalar coefficient on an elliptic curve, and the scalar coefficient is used to perform a dot product operation on the elliptic curve with the first elliptic curve point to obtain the second elliptic curve point. The packaged key is obtained by operating on the points of the second elliptic curve over a finite field of modular primes, expressed as: W=(K data ⊕H env •G Tl modP, K data H is the data encryption key. env Here, G represents the user environment fingerprint hash value, ⊕ indicates bitwise XOR, G is the public base point on the elliptic curve, and Tl is the dynamic trust level index.Tl denoted by scalar multiplication of base point G by itself Tl times on the elliptic curve, • denotes dot multiplication on the elliptic curve, modP denotes operation on a finite field modulo prime P, and W is the packaged key, which is a point on the elliptic curve.

[0010] As a further aspect of the present invention, the method further includes a decryption step when accessing user data: The user's current real-time environment characteristics are re-collected, and the real-time environment fingerprint hash value is calculated by combining the user's login password and the random perturbation factor issued by the server. Assess the dynamic trust level index of the current environment and read the packaged key from storage; Based on the real-time environmental fingerprint hash value, the dynamic trust level index, and the packaged key, the data encryption key is recovered through the inverse operation of a one-way function; The recovered data encryption key is used to decrypt the ciphertext to obtain the original user data.

[0011] As a further aspect of the present invention, when recovering the data encryption key through the inverse operation of a one-way function, the following formula is used: K′ data =(W•(G Tl′ ) -1 )⊕H′ env Tl′ represents the current dynamic trust level index, and G Tl′ Let H′ be the point on the elliptic curve based on the current trust level index. env K′ is the real-time environmental fingerprint hash value. data The encryption key for the recovered data.

[0012] Another object of the present invention is to provide a user information encryption system applied to a cloud platform, the system comprising: The environmental fingerprint determination module is used to collect the user's current multi-dimensional environmental characteristics, combine the user's login password and the random perturbation factor issued by the server, and generate an environmental fingerprint hash value. The data encryption key module is used to generate data encryption keys for user data that needs to be encrypted. The Trust Level Index module is used to determine the dynamic trust level index corresponding to the current environment based on multi-dimensional environmental characteristics and historical environmental profiles. The packaging key determination module is used to calculate and generate the packaged key using a one-way function based on the environmental fingerprint hash value, the data encryption key, and the dynamic trust level index. The key association storage module is used to encrypt the user data with the data encryption key to obtain the data ciphertext, associate the data ciphertext with the packaged key and store it on the cloud platform, and destroy the data encryption key.

[0013] As a further aspect of the present invention, the environmental fingerprint determination module includes: The multi-dimensional environmental feature unit is used to collect the hardware fingerprint and network features of the user terminal device to obtain multi-dimensional environmental features. The user secret fragment unit is used to call the key derivation function to process the user login password to obtain the user secret fragment; The environmental fingerprint determination unit is used to perform a one-way hash operation on the multidimensional environmental feature vector, random perturbation factor and user secret fragment to obtain the user's environmental fingerprint hash value.

[0014] As a further aspect of the present invention, the trust level index module includes: The environment similarity unit is used to compare the currently collected multi-dimensional environmental features with the historical environmental profiles stored on the cloud platform and calculate the environment similarity score. The behavior anomaly unit is used to acquire real-time behavior data of users in the current session, match it with a pre-built user behavior baseline, and calculate the behavior anomaly score. The trust level determination unit is used to input the environmental similarity score and the behavioral abnormality score into a preset trust assessment model to obtain the dynamic trust level index of the current environment.

[0015] As a further aspect of the present invention, the packaging key determination module includes: An intermediate mixed value unit is used to perform a bitwise XOR operation between the data encryption key and the environmental fingerprint hash value to obtain an intermediate mixed value; The first curve point unit is used to obtain a public base point on the elliptic curve. The public base point is multiplied on the elliptic curve by a power of the dynamic trust level index to obtain the first elliptic curve point. The second curve point unit is used to convert the intermediate mixed value into a scalar coefficient on an elliptic curve, and to perform a dot product operation on the elliptic curve with the first elliptic curve point using the scalar coefficient to obtain the second elliptic curve point. The packaging key determination unit is used to perform calculations on the second elliptic curve points over a finite field of modular primes to obtain the packaged key.

[0016] Compared with the prior art, the beneficial effects of the present invention are: This invention dynamically binds the encryption key to the user's current environmental characteristics and password, generating an environmental fingerprint hash value. Even if an attacker steals the user's password, they cannot decrypt the data in other environments. By evaluating environmental similarity and behavioral anomaly, a trust level index is dynamically generated and embedded in the key packaging process. This ensures smooth decryption in high-trust environments and inability to decrypt in low-trust environments, achieving a dynamic balance between security and convenience. The original data encryption key is destroyed immediately after encryption; the cloud platform only stores the packaged key, fundamentally eliminating the risk of mass leakage from key databases. Furthermore, the entire encryption and decryption process is completed automatically in the background; users only need to log in normally to access the data without additional operation, making it convenient and efficient. Attached Figure Description

[0017] Figure 1 This is a flowchart of a user information encryption method applied to a cloud platform.

[0018] Figure 2 This is a flowchart illustrating the generation of environmental fingerprint hash values ​​in a user information encryption method applied to a cloud platform.

[0019] Figure 3 This is a flowchart for determining a dynamic trust level index in a user information encryption method applied to a cloud platform.

[0020] Figure 4 This is a flowchart illustrating the calculation and generation of a packaged key in a user information encryption method applied to a cloud platform.

[0021] Figure 5 This is a flowchart illustrating the decryption process during data access in a user information encryption method applied to a cloud platform.

[0022] Figure 6 This is a schematic diagram of a user information encryption system applied to a cloud platform. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0024] The specific implementation of the present invention will be described in detail below with reference to specific embodiments.

[0025] like Figure 1 As shown, this embodiment of the invention provides a user information encryption method applied to a cloud platform, the method comprising the following steps: S100 collects the user's current multi-dimensional environmental characteristics, combines the user's login password and the random perturbation factor issued by the server, and generates an environmental fingerprint hash value. S200 generates a data encryption key for user data that needs to be encrypted; S300 determines the dynamic trust level index corresponding to the current environment based on multi-dimensional environmental characteristics and historical environmental profiles. S400, based on the environmental fingerprint hash value, the data encryption key, and the dynamic trust level index, a one-way function is used to calculate and generate the packaged key; S500 encrypts the user data with a data encryption key to obtain ciphertext, associates the ciphertext with the packaged key, stores it on the cloud platform, and destroys the data encryption key.

[0026] In this embodiment of the invention, firstly, by collecting hardware and network characteristics of the terminal device and combining them with a secret fragment derived from the user's login password and a random perturbation factor, a fixed-length, irreversible hash value is obtained through hashing. This hash value serves as the user's unique fingerprint in the current environment and is used for subsequent key packaging. For each piece of data uploaded or generated by the user, a high-strength symmetric encryption key (such as an AES-256 key) is randomly generated specifically for encrypting that data. This key is temporary and will be packaged and destroyed later to ensure that the key itself is not stored in plaintext anywhere. Next, the security and trustworthiness of the user's current environment are assessed. By comparing the environmental characteristics collected in real time with the user's historical environmental profile stored on the cloud platform, and combining the deviation of the user's real-time behavior from the historical behavior baseline, a dynamic trust level index (such as an integer value from 1 to 10) is calculated. This index reflects the trustworthiness of the environment; the more familiar the environment and the more normal the behavior, the higher the index. Then, a one-way function needs to be designed to bind the data encryption key, environmental fingerprint, and trust level index to generate a packaged key that cannot be reversed. This function, based on elliptic curve cryptography, ensures that even if an attacker obtains the packaged key, they cannot recover the original data key without the correct environment and trust level. Then, the original user data is symmetrically encrypted using the data encryption key to obtain ciphertext. This ciphertext is stored in association with the packaged key in the same metadata record. Finally, the original data encryption key is immediately and securely destroyed from memory, ensuring that only the ciphertext and the packaged key are retained in the cloud platform, preventing any usable decryption key from being directly obtained even if the storage system is compromised.

[0027] like Figure 2 As shown, in a preferred embodiment of the present invention, the step of generating the environmental fingerprint hash value specifically includes: S101, collects the hardware fingerprint and network characteristics of user terminal devices to obtain multi-dimensional environmental characteristics; S102, call the key derivation function to process the user login password to obtain the user secret fragment; S103, perform a one-way hash operation on the multidimensional environmental feature vector, random perturbation factor and user secret fragment to obtain the user's environmental fingerprint hash value.

[0028] In this embodiment of the invention, the hardware fingerprint includes: the number of CPU cores, memory size, screen resolution, graphics card renderer information, etc.; network features include: network IP, TCP / IP protocol stack fingerprint, Wi-Fi access point BSSID list, etc. This information is quantized to form a multi-dimensional feature vector, used to uniquely identify the user's physical and network environments. To avoid directly using the user's password and prevent it from being directly used for calculations in case of password leakage, a key derivation function (such as PBKDF2, bcrypt) is called to stretch and transform the user's input login password, generating a fixed-length "user secret fragment." This fragment is different from the password itself but uniquely determined by the password, used to bind the user's identity to the physical environment. In addition, the server issues a unique random perturbation factor R for this session. R is a highly random temporary value (usually a 128-bit or 256-bit random number) generated by the cloud platform security server for each user session or each sensitive operation. The random perturbation factor can prevent replay attacks. Then, the multi-dimensional environmental feature vector, the random perturbation factor, and the user's secret fragment are concatenated into a string, and a cryptographic hash function (such as SHA-256) is used to calculate a fixed-length hash value. This hash value is the user's unique fingerprint in the current environment, which is irreversible and unique. Any slight change in the input parameters will lead to a completely different output.

[0029] like Figure 3 As shown in the preferred embodiment of the present invention, the step of determining the dynamic trust level index corresponding to the current environment specifically includes: S301, compare the currently collected multi-dimensional environmental features with the historical environmental profiles stored on the cloud platform, and calculate the environmental similarity score; S302, Obtain real-time behavior data of the user in the current session, match it with the pre-built user behavior baseline, and calculate the behavior anomaly score; S303, input the environmental similarity score and behavioral anomaly score into the preset trust assessment model to obtain the dynamic trust level index of the current environment.

[0030] In this embodiment of the invention, the cloud platform maintains one or more historical environment profiles for each user. These historical environment profiles can be environmental fingerprints and their feature vectors recorded during previous successful logins or operations. The currently collected environmental feature vectors are compared with the historical profiles using multi-dimensional similarity calculations (such as Euclidean distance and cosine similarity) to obtain an environment similarity score between 0 and 1. This embodiment of the invention continuously learns user behavior patterns and establishes user behavior baselines, such as click speed, access patterns, and operation frequency. During the current session, user behavior is monitored in real time and compared with the baseline to calculate a behavior anomaly score, where 0 represents completely normal and 1 represents extreme anomaly. The environment similarity score and behavior anomaly score are then input into a preset trust assessment model. This trust assessment model can be a weighted scoring model, where the environment similarity score and behavior anomaly score are weighted and summed, then rounded to obtain a dynamic trust level index (e.g., 1-10). This index comprehensively reflects the security and trustworthiness of the current environment and is used to dynamically adjust encryption strength during subsequent key packaging.

[0031] like Figure 4 As shown, in a preferred embodiment of the present invention, the step of generating the packaged key through a one-way function specifically includes: S401, Perform a bitwise XOR operation between the data encryption key and the environmental fingerprint hash value to obtain an intermediate mixed value; S402, obtain a public base point on the elliptic curve, and perform scalar multiplication on the public base point on the elliptic curve with the dynamic trust level index as the power to obtain the first elliptic curve point. S403, convert the intermediate mixed value into a scalar coefficient on an elliptic curve, and use the scalar coefficient to perform a dot product operation on the elliptic curve with the first elliptic curve point to obtain the second elliptic curve point; S404, the packaged key is obtained by operating on the second elliptic curve points over a finite field of modular primes, expressed as: W=(K data ⊕H env •G Tl modP, K data H is the data encryption key. env Here, G represents the user environment fingerprint hash value, ⊕ indicates bitwise XOR, G is the public base point on the elliptic curve, and Tl is the dynamic trust level index. Tl denoted by scalar multiplication of base point G by itself Tl times on the elliptic curve, • denotes dot multiplication on the elliptic curve, modP denotes operation on a finite field modulo prime P, and W is the packaged key, which is a point on the elliptic curve.

[0032] In this embodiment of the invention, the data encryption key K will be... data and environmental fingerprint hash value Henv Treating them as binary strings of the same length, performing a bitwise XOR operation yields the intermediate mixed value M=K. data ⊕H env This step will K data Information and H env The mixture is made so that subsequent calculations require knowledge of both to recover K. data In this embodiment of the invention, the system pre-defines an elliptic curve (e.g., secp256k1) and its public base point globally. Using the dynamic trust level index Tl as a scalar, a scalar multiplication operation is performed on the public base point G on the elliptic curve to obtain the first elliptic curve point Q1. This operation is unidirectional. Next, the intermediate mixed value M is mapped to an integer as a scalar coefficient. Q2 = scalar coefficient × Q1 is calculated to obtain the second elliptic curve point Q2. This step combines M with the trust level-based elliptic curve point, embedding M into the elliptic curve point. Finally, the second elliptic curve point is operated on in a finite field of a prime modulus to obtain the packaged key. The entire operation is performed in a finite field of a prime modulus P, ensuring the result falls within a secure range. W is an elliptic curve point that can be securely stored on a cloud platform. This formula integrates symmetric keys, environmental fingerprints, and dynamic trust levels. Forward calculation is easy, while reverse solving requires simultaneous satisfaction of H. env The conditions for Tl.

[0033] like Figure 5 As shown, in a preferred embodiment of the present invention, the method further includes a decryption step when accessing user data: S601, re-collect the user's current real-time environment characteristics, combine the user's login password and the random disturbance factor issued by the server, and calculate the real-time environment fingerprint hash value; S602, assess the dynamic trust level index of the current environment and read the packaged key from storage; S603, Based on the real-time environmental fingerprint hash value, the dynamic trust level index, and the packaged key, the data encryption key is recovered through the inverse operation of a one-way function; S604, use the recovered data encryption key to decrypt the data ciphertext to obtain the original user data.

[0034] In this embodiment of the invention, when a user accesses the data again, the current real-time environmental characteristics are collected, and a new real-time environmental fingerprint hash value H′ is obtained. env It will also assess the current dynamic trust level index Tl′ based on the current real-time environmental characteristics and behavioral data. Simultaneously, it will read the packaged key W associated with the target data from cloud storage. Then, the data encryption key can be recovered through the inverse operation of a one-way function, specifically using the following inverse operation formula: K′ data=(W•(G Tl′ ) -1 )⊕H′ env Tl′ represents the current dynamic trust level index, and G Tl′ Let H′ be the point on the elliptic curve based on the current trust level index. env K′ is the real-time environmental fingerprint hash value. data The key used to recover the encrypted data. Recovery is successful if the current environment matches the environment at the time of encryption; otherwise, the recovered encryption key will be garbled. Finally, the correct key is used to recover the encrypted data. data The stored encrypted data is symmetrically decrypted to obtain the original user data, which is then returned to the user. It is important to emphasize that the random perturbation factor issued by the server at this point is the same as the random perturbation factor used when encrypting the encrypted data. In other words, when the encrypted data is stored on the cloud platform along with the packaged key, the corresponding random perturbation factor is also stored synchronously.

[0035] In this embodiment of the invention, if the correct data encryption key cannot be recovered, the system will not directly refuse access, but will trigger a downgraded access process: for example, sending a verification code to the user's registered email or mobile phone, requiring the user to answer preset security questions, and authorizing access by scanning a QR code through a trusted device.

[0036] like Figure 6 As shown in the figure, this embodiment of the invention also provides a user information encryption system applied to a cloud platform, the system comprising: The environmental fingerprint determination module 100 is used to collect the user's current multi-dimensional environmental characteristics, combine the user's login password and the random perturbation factor issued by the server, and generate an environmental fingerprint hash value. The data encryption key module 200 is used to generate data encryption keys for user data that needs to be encrypted. Trust Level Index Module 300 is used to determine the dynamic trust level index corresponding to the current environment based on multi-dimensional environmental characteristics and historical environmental profiles. The packaging key determination module 400 is used to calculate and generate the packaged key through a one-way function based on the environmental fingerprint hash value, the data encryption key, and the dynamic trust level index. The key association storage module 500 is used to encrypt the user data with the data encryption key to obtain the data ciphertext, associate the data ciphertext with the packaged key and store it on the cloud platform, and destroy the data encryption key.

[0037] In a preferred embodiment of the present invention, the environmental fingerprint determination module 100 includes: The multi-dimensional environmental feature unit is used to collect the hardware fingerprint and network features of the user terminal device to obtain multi-dimensional environmental features. The user secret fragment unit is used to call the key derivation function to process the user login password to obtain the user secret fragment; The environmental fingerprint determination unit is used to perform a one-way hash operation on the multidimensional environmental feature vector, random perturbation factor and user secret fragment to obtain the user's environmental fingerprint hash value.

[0038] In a preferred embodiment of the present invention, the trust level index module 300 includes: The environment similarity unit is used to compare the currently collected multi-dimensional environmental features with the historical environmental profiles stored on the cloud platform and calculate the environment similarity score. The behavior anomaly unit is used to acquire real-time behavior data of users in the current session, match it with a pre-built user behavior baseline, and calculate the behavior anomaly score. The trust level determination unit is used to input the environmental similarity score and the behavioral abnormality score into a preset trust assessment model to obtain the dynamic trust level index of the current environment.

[0039] In a preferred embodiment of the present invention, the packaging key determination module 400 includes: An intermediate mixed value unit is used to perform a bitwise XOR operation between the data encryption key and the environmental fingerprint hash value to obtain an intermediate mixed value; The first curve point unit is used to obtain a public base point on the elliptic curve. The public base point is multiplied on the elliptic curve by a power of the dynamic trust level index to obtain the first elliptic curve point. The second curve point unit is used to convert the intermediate mixed value into a scalar coefficient on an elliptic curve, and to perform a dot product operation on the elliptic curve with the first elliptic curve point using the scalar coefficient to obtain the second elliptic curve point. The packaging key determination unit is used to perform calculations on the second elliptic curve points over a finite field of modular primes to obtain the packaged key.

[0040] The above description only details the preferred embodiments of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0041] It should be understood that although the steps in the flowcharts of the various embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the various embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0042] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the disclosure in the specification and embodiments. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

Claims

1. A method for encrypting user information applied to a cloud platform, characterized in that, The method includes the following steps: Collect the user's current multidimensional environmental characteristics, combine them with the user's login password and the random perturbation factor issued by the server, and generate an environmental fingerprint hash value; Generate data encryption keys for user data that needs to be encrypted; The dynamic trust level index corresponding to the current environment is determined based on multi-dimensional environmental characteristics and historical environmental profiles. Based on the environmental fingerprint hash value, the data encryption key, and the dynamic trust level index, a one-way function is used to calculate and generate the packaged key. The user data is encrypted using a data encryption key to obtain ciphertext. The ciphertext is then associated with the packaged key and stored on the cloud platform, and the data encryption key is destroyed.

2. The user information encryption method applied to a cloud platform according to claim 1, characterized in that, The step of generating the environmental fingerprint hash value specifically includes: Collect hardware fingerprints and network features of user terminal devices to obtain multi-dimensional environmental features; The key derivation function is called to process the user's login password and obtain the user's secret fragment; The user's environmental fingerprint hash value is obtained by performing a one-way hash operation on the multidimensional environmental feature vector, random perturbation factor, and user secret fragment.

3. The user information encryption method applied to a cloud platform according to claim 1, characterized in that, The step of determining the dynamic trust level index corresponding to the current environment specifically includes: The currently collected multi-dimensional environmental features are compared with the historical environmental profiles stored on the cloud platform to calculate the environmental similarity score. Get real-time user behavior data in the current session, match it with a pre-built user behavior baseline, and calculate the behavior anomaly score; The environmental similarity score and behavioral anomaly score are input into a preset trust assessment model to obtain the dynamic trust level index of the current environment.

4. The user information encryption method applied to a cloud platform according to claim 1, characterized in that, The steps for generating the packaged key using a one-way function specifically include: The data encryption key and the environmental fingerprint hash value are XORed bitwise to obtain an intermediate mixed value. Obtain a public base point on the elliptic curve, and perform scalar multiplication on the public base point on the elliptic curve with the dynamic trust level index as the power to obtain the first elliptic curve point. The intermediate mixed value is converted into a scalar coefficient on an elliptic curve, and the scalar coefficient is used to perform a dot product operation on the elliptic curve with the first elliptic curve point to obtain the second elliptic curve point. The packaged key is obtained by operating on the points of the second elliptic curve over a finite field of modular primes, expressed as: W=(K data ⊕H env )•G Tl modP, K data H is the data encryption key. env Here, G represents the user environment fingerprint hash value, ⊕ indicates bitwise XOR, G is the public base point on the elliptic curve, and Tl is the dynamic trust level index. Tl denoted by scalar multiplication of base point G by itself Tl times on the elliptic curve, • denotes dot multiplication on the elliptic curve, modP denotes operation on a finite field modulo prime P, and W is the packaged key, which is a point on the elliptic curve.

5. The user information encryption method applied to a cloud platform according to claim 4, characterized in that, The method also includes a decryption step when accessing user data: The user's current real-time environment characteristics are re-collected, and the real-time environment fingerprint hash value is calculated by combining the user's login password and the random perturbation factor issued by the server. Assess the dynamic trust level index of the current environment and read the packaged key from storage; Based on the real-time environmental fingerprint hash value, the dynamic trust level index, and the packaged key, the data encryption key is recovered through the inverse operation of a one-way function; The recovered data encryption key is used to decrypt the ciphertext to obtain the original user data.

6. The user information encryption method applied to a cloud platform according to claim 5, characterized in that, When recovering the data encryption key through the inverse operation of a one-way function, the following formula is used: K′ data =(W•(G Tl′ ) -1 )⊕H′ env Tl′ represents the current dynamic trust level index, and G Tl′ Let H′ be the point on the elliptic curve based on the current trust level index. env K′ is the real-time environmental fingerprint hash value. data The encryption key for the recovered data.

7. A user information encryption system applied to a cloud platform, characterized in that, The system includes: The environmental fingerprint determination module is used to collect the user's current multi-dimensional environmental characteristics, combine the user's login password and the random perturbation factor issued by the server, and generate an environmental fingerprint hash value. The data encryption key module is used to generate data encryption keys for user data that needs to be encrypted. The Trust Level Index module is used to determine the dynamic trust level index corresponding to the current environment based on multi-dimensional environmental characteristics and historical environmental profiles. The packaging key determination module is used to calculate and generate the packaged key using a one-way function based on the environmental fingerprint hash value, the data encryption key, and the dynamic trust level index. The key association storage module is used to encrypt the user data with the data encryption key to obtain the data ciphertext, associate the data ciphertext with the packaged key and store it on the cloud platform, and destroy the data encryption key.

8. The user information encryption system applied to a cloud platform according to claim 7, characterized in that, The environmental fingerprint determination module includes: The multi-dimensional environmental feature unit is used to collect the hardware fingerprint and network features of the user terminal device to obtain multi-dimensional environmental features. The user secret fragment unit is used to call the key derivation function to process the user login password to obtain the user secret fragment; The environmental fingerprint determination unit is used to perform a one-way hash operation on the multidimensional environmental feature vector, random perturbation factor and user secret fragment to obtain the user's environmental fingerprint hash value.

9. The user information encryption system applied to a cloud platform according to claim 7, characterized in that, The trust level index module includes: The environment similarity unit is used to compare the currently collected multi-dimensional environmental features with the historical environmental profiles stored on the cloud platform and calculate the environment similarity score. The behavior anomaly unit is used to acquire real-time behavior data of users in the current session, match it with a pre-built user behavior baseline, and calculate the behavior anomaly score. The trust level determination unit is used to input the environmental similarity score and the behavioral abnormality score into a preset trust assessment model to obtain the dynamic trust level index of the current environment.

10. The user information encryption system applied to a cloud platform according to claim 7, characterized in that, The packaging key determination module includes: An intermediate mixed value unit is used to perform a bitwise XOR operation between the data encryption key and the environmental fingerprint hash value to obtain an intermediate mixed value; The first curve point unit is used to obtain a public base point on the elliptic curve. The public base point is multiplied on the elliptic curve by a power of the dynamic trust level index to obtain the first elliptic curve point. The second curve point unit is used to convert the intermediate mixed value into a scalar coefficient on an elliptic curve, and to perform a dot product operation on the elliptic curve with the first elliptic curve point using the scalar coefficient to obtain the second elliptic curve point. The packaging key determination unit is used to perform calculations on the second elliptic curve points over a finite field of modular primes to obtain the packaged key.

Images