Cloud storage system, data read-write method, device, and storage medium

Abstract

Provided in the embodiments of the present disclosure are a cloud storage system, a data read-write method, a device, and a storage medium. Provided in the embodiments of the present disclosure is a general-purpose hierarchical encryption solution concerning cloud storage, which solution can uniformly meet the requirements in terms of data encryption and decryption and key management. By means of layering a cloud storage system, data encryption and decryption and key management processes are coordinated and unified; on a customer interaction layer and a storage service layer, a customer master key and a storage service key are used to cooperate with each other to perform key management, and on the storage service layer and a storage persistence layer, the storage service key and a data encryption key are used to cooperate with each other to control the data encryption and decryption process; and a key management function is decoupled from a data encryption and decryption function, thereby improving the flexibility and expandability. Furthermore, the storage service layer can directly reuse an encryption capability provided by a data persistence layer, such that it is not necessary to encrypt data multiple times on each layer, thereby reducing the encryption cost.

Description

Cloud storage system, data reading and writing method, device and storage medium

[0001] This disclosure claims priority to the Chinese patent application filed with the China Patent Office on November 7, 2023, with application number 202311471163.3 and application name “Cloud Storage System and Data Reading and Writing Methods, Devices and Storage Medium”, the entire contents of which are incorporated by reference into this disclosure. Technical Field

[0002] The present disclosure relates to the field of cloud storage technology, and in particular to a cloud storage system, a data reading and writing method, a device, and a storage medium. Background Art

[0003] With the explosive growth of user data, various distributed storage systems on the cloud, such as block storage, file systems, object storage, table storage, and databases, are taking on more and more user data. Supporting user data encryption is a common means of protecting user data security.

[0004] The more commonly used encryption and decryption scheme in cloud storage systems is as follows: the access layer of the storage system is responsible for managing user keys. When the user writes data, the data is encrypted according to the user key and then stored persistently; when the user reads data, the encrypted data is read from the persistent storage medium, decrypted according to the user key, and provided to the user.

[0005] The encryption and decryption schemes used in existing cloud storage systems are difficult to design and implement. When user keys need to be updated for security upgrades, the encrypted data needs to be decrypted and then re-encrypted, which is costly and has poor flexibility and scalability.

[0006] Summary of the Invention

[0007] Various aspects of the present disclosure provide a cloud storage system and a data reading and writing method, device, and storage medium to improve the flexibility and scalability of the cloud storage system and reduce the encryption cost of the cloud storage system.

[0008] An embodiment of the present disclosure provides a cloud storage system, comprising: a user interaction layer, a storage persistence layer, and at least one storage service layer located between the user interaction layer and the storage persistence layer; the user interaction layer comprises a key management node, which is used to manage user master keys and provide user master keys to storage service layers adjacent thereto; the storage service layer comprises a storage service node, which is used to generate storage service keys of this layer, and during data reading and writing, encrypt and decrypt the storage service keys of this layer according to the keys provided by the upper layer, and provide the storage service keys of this layer to the next layer so that the next layer can encrypt and decrypt its keys; the storage persistence layer comprises a storage persistence node, which is used to generate data encryption keys, and during data reading and writing, encrypt and decrypt the data encryption keys according to the storage service keys provided by the adjacent storage service layer, and encrypt and decrypt user data according to the data encryption keys.

[0009] An embodiment of the present disclosure also provides a cloud storage system, including: a user interaction layer and a storage persistence layer; the user interaction layer includes a key management node, which is used to manage user master keys and provide user master keys to the storage persistence layer; the storage persistence layer includes a storage persistence node, which is used to generate data encryption keys, and encrypt and decrypt user data according to the data encryption keys during data reading and writing, and encrypt and decrypt the data encryption keys according to the user master keys.

[0010] The disclosed embodiment also provides a data reading and writing method applicable to a key management node in a user interaction layer in a cloud storage system. The method includes: managing a user master key; providing the user master key to a storage service layer adjacent to the user interaction layer in the cloud storage system, so that the storage service layer and the storage persistence layer adjacent to the user interaction layer can cooperate with each other to realize encryption and decryption processing of user data.

[0011] The disclosed embodiment also provides a data reading and writing method, which is applicable to a storage service node in at least one storage service layer in a cloud storage system. The method includes: generating a storage service key for this layer, and encrypting and decrypting the storage service key for this layer according to a key provided by an upper layer during the data reading and writing process. The storage service key for this layer is a storage service key of a target storage service layer to which the storage service node belongs, and the key provided by the upper layer is a user master key or a storage service key of a layer above the target storage service layer; providing the storage service key for this layer to the next layer, which is implemented as a next storage service layer adjacent to the target storage service layer or a storage persistence layer in the cloud storage system.

[0012] An embodiment of the present disclosure also provides a data reading and writing method, which is applicable to a storage persistence node in a storage persistence layer in a cloud storage system. The method includes: receiving a storage service key provided by a storage service layer adjacent to the storage persistence layer in the cloud storage system; generating a data encryption key, and encrypting and decrypting user data according to the data encryption key during the data reading and writing process, and encrypting and decrypting the data encryption key according to the storage service key provided by the storage service layer adjacent to it.

[0013] The disclosed embodiment also provides a data reading and writing method applicable to a storage persistence node in a cloud storage system. The method includes: receiving a user master key provided by a key management node in a user interaction layer of the cloud storage system; generating a data encryption key, and during the data reading and writing process, encrypting and decrypting user data according to the data encryption key, and encrypting and decrypting the data encryption key according to the user master key.

[0014] An embodiment of the present disclosure also provides an electronic device, comprising: a memory and a processor; the memory is used to store a computer program; the processor is coupled to the memory and is used to execute the computer program to implement each step in the data reading and writing method provided in the embodiment of the present disclosure.

[0015] The embodiments of the present disclosure further provide a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor implements the steps of the data reading and writing method provided by the embodiments of the present disclosure.

[0016] In a sixth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program, which implements the method described in any of the above aspects when executed by a processor.

[0017] In the disclosed embodiments, a general layered encryption scheme for cloud storage is provided that can uniformly meet the needs of data encryption and decryption and key management. The cloud storage system is layered to coordinate and unify the data encryption and decryption and key management processes. The user interaction layer and the storage service layer use the user master key and the storage service key to cooperate with each other for key management. The storage service layer and the storage persistence layer use the storage service key and the data encryption key to cooperate with each other to control the data encryption and decryption process. This decouples the key management and data encryption and decryption functions, improving flexibility and scalability. Furthermore, the storage service layer can directly reuse the encryption capabilities provided by the data persistence layer, eliminating the need to encrypt data multiple times at each layer, thus saving encryption costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The exemplary embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation of the present disclosure. In the drawings:

[0019] FIG1 is a schematic structural diagram of a cloud storage system provided by an exemplary embodiment of the present disclosure;

[0020] FIG2 is a schematic diagram of an interactive process of writing data provided by an exemplary embodiment of the present disclosure;

[0021] FIG3 is a schematic diagram of an interactive process of reading data provided by an exemplary embodiment of the present disclosure;

[0022] FIG4 is a schematic structural diagram of another cloud storage system provided by an exemplary embodiment of the present disclosure;

[0023] 5a-5d are flowcharts of a data reading and writing method provided by an exemplary embodiment of the present disclosure;

[0024] 6a-6c are schematic structural diagrams of a data reading and writing device provided by an exemplary embodiment of the present disclosure;

[0025] FIG7 is a schematic structural diagram of an electronic device provided by an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] To make the objectives, technical solutions, and advantages of the present disclosure more clear, the technical solutions of the present disclosure will be clearly and completely described below in conjunction with the specific embodiments of the present disclosure and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present disclosure.

[0027] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0028] In response to the above technical problems, in the embodiments disclosed herein, a general layered encryption scheme for cloud storage is provided that can uniformly meet the needs of data encryption and decryption and key management. The cloud storage system is layered to coordinate and unify the data encryption and decryption and key management processes. The user master key and storage service key are used in the user interaction layer and storage service layer to cooperate with each other for key management. The storage service key and data encryption key are used in the storage service layer and storage persistence layer to cooperate with each other to control the data encryption and decryption process. The key management and data encryption and decryption functions are decoupled to improve flexibility and scalability. Furthermore, the storage service layer can directly reuse the encryption capabilities provided by the data persistence layer, eliminating the need to encrypt data multiple times at each layer, saving encryption costs.

[0029] The technical solutions provided by various embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0030] Figure 1 is a schematic diagram of the structure of a cloud storage system provided by an exemplary embodiment of the present disclosure. As shown in Figure 1, the system includes: a user interaction layer 10, a storage persistence layer 20, and at least one storage service layer A1-An located between the user interaction layer 10 and the storage persistence layer 20, where 1≤n and n is a positive integer. The hierarchical relationship in the cloud storage system can be expressed as: user interaction layer 10 -> storage service layer A1 -> storage service layer A2 -> ... -> storage service layer An -> storage persistence layer 20.

[0031] Among them, the user interaction layer 10 includes a key management node (Key Management Service, KMS) 101, which is used to manage the customer master key (Customer Master Key, CMK). The key management node 101 can be seamlessly integrated with most cloud products, which means that users can control the encryption of data stored in cloud products through the customer master key in KMS. With the help of KMS, users can control the access rights of the customer master key and determine the usage rights of the customer master key. The key management node 101 can provide the customer master key to the storage service layer adjacent to the user interaction layer to provide storage services through the customer master key. For example, the customer master key is provided to at least one storage service layer in advance, or when the storage service layer adjacent to the user interaction layer requests the customer master key during the process of reading or writing data, the customer master key is provided to the storage service node of the storage service layer.

[0032] Among them, the storage service layer An includes storage service nodes Bn, and each storage service layer An may include one or more storage service nodes. The storage service node Bn is used to generate the storage service key (SSK) of this layer, and to receive the key provided by the upper layer of the storage service layer. For each storage service node, the storage service key of the storage service layer to which it belongs is the storage service key of this layer, and the storage service key of the storage service layer above the storage service layer to which the storage node belongs is the storage service key of the upper layer. For the storage service layer A1, the upper layer is the user interaction layer 10, and the key provided by the upper layer is the user master key CMK; for the storage service layer An (n≠1), the upper layer is the storage service layer An-1, and the key provided by the upper layer is the storage service key SSKn-1 of the storage service layer An-1. The storage service node Bn can also encrypt and decrypt the storage service key of this layer according to the key provided by the upper layer during the data reading and writing process. For example, for storage service layer A1, storage service node B1 uses the user master key to encrypt and decrypt the storage service key of this layer. For example, it uses the user master key CMK to encrypt the storage service key SSK1 of this layer to obtain the encrypted storage service key (ESSK)1, and then uses the user master key CMK to decrypt the encrypted storage service key ESSK1 to obtain the storage service key SSK1 of this layer. For storage service layer An (n≠1), storage service node Bn uses the storage service key of storage service layer An-1 to encrypt and decrypt the storage service key of this layer. For example, storage service node Bn uses the storage service key SSKn-1 of storage service layer An-1 to encrypt the storage service key SSKn of this layer to obtain the encrypted storage service key ESSKn. Storage service node Bn uses the storage service key SSKn-1 of storage service layer An-1 to decrypt the encrypted storage service key ESSKn to obtain the storage service key SSKn of this layer. Storage service layer An can also provide the storage service key of this layer to the next layer for encryption and decryption of its key. The next layer below the storage service layer can be the storage service layer or the storage persistence layer.

[0033] Among them, the storage persistence layer 20 includes a storage persistence node 201. The storage persistence node 201 can generate a data encryption key (DEK) and encrypt and decrypt user data according to the data encryption key during the data reading and writing process. When the storage service layer An adjacent to the storage persistence layer 20 provides the storage service key of this layer to the storage persistence layer, the storage persistence layer 20 receives the storage service key provided by the storage service layer An. The storage persistence node 201 can also encrypt and decrypt the data encryption key according to the storage service key provided by the storage service layer An adjacent to it. Optionally, the storage persistence node 201 encrypts and decrypts user data according to the data encryption key during the data reading and writing process. Specifically, it can be: in the data writing process, the user data is encrypted using the data encryption key, and the encrypted user data is persistently stored; in the data reading process, the encrypted user data stored in the persistence layer is read, and the encrypted user data is decrypted using the data encryption key to obtain the user data.

[0034] In this embodiment, the storage service layer includes, in addition to the storage service nodes, a storage service management node. The storage service management node is responsible for managing the metadata of the cloud storage disk and for managing and controlling the cloud storage disk. For example, creating, deleting, mounting, and unmounting the cloud storage disk, and scheduling which storage service node of the storage service layer is responsible for processing the IO request of the cloud storage disk. For another example, specifying the data synchronization and layout strategy of the cloud storage disk, etc., the data synchronization and layout strategy can reflect the correspondence between the persistent files and the storage service nodes. In addition, the storage service node Bn can also provide data interaction services for the cloud storage disk, for example, it is responsible for processing IO requests from the cloud storage access node. Optionally, the storage service node Bn can also be responsible for the mapping management and switching scheduling of the logical address information of the corresponding cloud storage disk to the corresponding persistent file. For example, the storage service node stores the data to be stored in the user's IO request to the storage persistence layer of the cloud storage disk, and records the corresponding data mapping relationship for subsequent reading.

[0035] Among them, the storage persistence layer includes not only storage persistence nodes, but also persistence management nodes. The persistence management node is responsible for managing the metadata of the storage persistence layer, and optionally provides management and control services for persistent files, for example, responsible for the creation or deletion of persistent files, and for example, maintaining the correspondence between persistent files and storage service nodes Bn. Furthermore, the persistence management node can also persist data on the corresponding storage service node according to the data synchronization and layout strategy specified by the service layer. The storage service node is responsible for responding to the persistence operations and subsequent read access of the corresponding data. Furthermore, the storage persistence layer can provide a software development kit (SDK) to the storage service node of the storage service layer, so that the storage service node can create, delete, read and write files in the persistence layer to complete the read and write operations of the user IO.

[0036] In this embodiment, the cloud storage system can adopt different storage technologies, such as block storage, file storage, table storage or object storage. For different storage technologies, the storage service nodes in the storage service layer are different. For example, when the storage technology is implemented as block storage, the storage service node is implemented as a data server (Block Server, BS). For another example, when the storage technology is implemented as object storage, the storage service node is implemented as an object storage server (Object Storage Service, OSS). For another example, when the storage technology is implemented as file storage, the storage service node is implemented as a file storage server (File Storage Service). Different storage technologies are implemented using different storage service layers. Regardless of the storage technology, the storage persistence layer is universal. The storage persistence layer has a default encryption technology. For example, the data encryption key DEK is used by default to encrypt the data before storage. For example, the storage persistence node 201 can be implemented as a chunk server (Chunk Server, CS). In the disclosed embodiments, a general layered encryption scheme for cloud storage is provided that can uniformly meet the needs of data encryption and decryption and key management. The cloud storage system is layered to coordinate and unify the data encryption and decryption and key management processes. The user interaction layer and the storage service layer use the user master key and the storage service key to cooperate with each other for key management. The storage service layer and the storage persistence layer use the storage service key and the data encryption key to cooperate with each other to control the data encryption and decryption process. This decouples the key management and data encryption and decryption functions, improving flexibility and scalability. Furthermore, the storage service layer can directly reuse the encryption capabilities provided by the data persistence layer, eliminating the need to encrypt data multiple times at each layer, thus saving encryption costs.

[0037] In this embodiment, the cloud storage system can provide storage services for cloud computing instances (e.g., virtual machines or containers) on computing nodes. Optionally, the cloud storage system also includes a storage access layer 30, which includes a storage access node 301 deployed in the computing node. Storage access node 301 can be deployed on the computing node as a service process of the cloud storage system, and is used to provide access services to the cloud storage system to the cloud computing instances running on the computing node. Specifically, the storage access node can present a cloud storage disk provided by the cloud storage system to the cloud computing instance through virtualization technology. A user can send input / output (IO) requests (also known as read / write requests) to the cloud computing instance, and the cloud computing instance sends the read / write requests to storage access node 301. Storage access node 301 can receive the read / write requests from the cloud computing instance for the cloud storage disk and send the read / write requests to the backend storage cluster corresponding to the cloud storage disk. For example, it can send the read / write requests to the storage service node in the adjacent storage service layer, so that at least one storage service layer An and the storage persistence layer 20 can perform data read and write operations. After receiving the response from the storage cluster, storage access node 301 returns the response to the cloud computing instance. The storage access node can interact with the cloud computing instance through the virtualization manager on the compute node, which is responsible for managing the cloud computing instance. The virtualization manager can be a virtual machine monitor (VMM), also known as a hypervisor. Optionally, the hypervisor or VMM can be implemented as, but is not limited to, a virtual operating system emulator (Quick EMUlator, QEMU) or VMware.

[0038] Cloud storage disks can use Logical Block Addressing (LBA) for addressing. The entire storage space is divided into multiple LBA intervals, and a certain amount of data is stored in these LBA intervals. The size of the LBA interval is not limited; for example, it can be 4GB, 8GB, or 16GB. The LBA address information can be mapped to the physical address information of the storage persistence node to enable reading and writing to the cloud storage disk.

[0039] In an optional embodiment, the process of the user interaction layer, at least one storage service layer and the storage persistence layer cooperating with each other to implement data read and write operations is not limited. The following describes the implementation method of at least one storage service layer and the storage persistence layer performing data read and write operations in different situations.

[0040] Case B1: Write operation:

[0041] The storage service node Bn in the storage service layer can generate the storage service key of this layer and receive the key provided by the upper layer when the user writes the first data, wherein the upper layer is the user interaction layer 10 or the upper storage service layer adjacent to the storage service layer. The method of receiving the key provided by the upper layer is not limited. For example, when the user writes the first data, the key provided by the upper layer can be requested in real time, or the key can be requested from the upper layer during the power-on initialization process of the storage service node, and when the upper layer returns the key, the key provided by the upper layer is received. The storage service key of this layer is encrypted according to the key provided by the upper layer and the encrypted ciphertext of the storage service key of this layer is saved. The ciphertext is called the encrypted storage service layer key ESSK. For example, if the key provided by the upper layer of the storage service node in the storage service layer A1 is CMK, and the storage service key of the storage service layer A1 is SSK1, the storage service key SSK1 can be encrypted according to the key CMK provided by the upper layer to obtain the ciphertext ESSK1. For another example, if the key provided by the upper layer of the storage service node in storage service layer A2 is SSK1, and the storage service key of storage service layer A2 is SSK2, then the storage service key SSK2 can be encrypted using the key SSK1 provided by the upper layer to obtain the ciphertext ESSK2. The storage service node Bn in the storage service layer can send the first data and the storage service key of this layer to the next layer, which is the next storage service layer or storage persistence layer 20 adjacent to the storage service layer.

[0042] The storage persistence node 201 can generate a data encryption key when the user writes the first data, encrypt the first data according to the data encryption key and persistently store the encrypted data ciphertext, and encrypt the data encryption key according to the storage service key provided by the adjacent storage service layer and save the encrypted data encryption key ciphertext (Encrypted Data Encryption Key, EDEK).

[0043] Optionally, the storage service node Bn generates the storage service key for this layer as follows: when receiving the data to be stored, the data to be stored is divided into at least one data shard, and at least one storage service key for this layer is generated for the at least one data shard; wherein the data to be stored is the first data or the data shard sent by the upper storage service layer. Partitioning the data to be stored into one data shard means that the data to be stored is no longer subdivided into data shards. At least one data shard may share one storage service key SSK, or each data shard may use one storage service key SSK, or some data shards may share one storage service key, and there is no limitation on this. Specifically, the storage service key SSK may be determined based on the granularity of the user data. For example, for object storage, an SSK is assigned to each storage space (bucket); for block storage, an SSK is assigned to each disk (disk); and for table storage, an SSK is assigned to each table.

[0044] Optionally, the storage service node Bn encrypts the storage service key of this layer according to the key provided by the upper layer and saves the encrypted ciphertext of the storage service key of this layer. This can be achieved by: encrypting at least one storage service key of this layer according to the key corresponding to the data to be stored provided by the upper layer and saving the ciphertext of at least one storage service key of this layer, and establishing a first correspondence between the key corresponding to the data to be stored, the identifier of at least one data shard, and the ciphertext of at least one storage service key of this layer. Accordingly, the storage service node sends the first data and the storage service key of this layer to the next layer, which can be achieved by: sending at least one data shard, at least one storage service key of this layer, and the second correspondence between at least one data shard and at least one storage service key of this layer to the next layer.

[0045] Optionally, the storage persistence node 201 generates a data encryption key, which can be implemented as follows: receiving at least one data shard, at least one storage service key, and a second correspondence between at least one data shard and at least one storage service key corresponding to the first data sent by the storage service layer adjacent to it; for any data shard, dividing the data shard into multiple data blocks, and generating at least one data encryption key for the multiple data blocks; for example, a data encryption key DEK can be generated for each data block, or multiple data blocks can share one data encryption key DEK, or some data blocks can share one data encryption key DEK. The storage persistence node 201 encrypts the data encryption key according to the storage service key provided by the storage service layer adjacent to it and saves the ciphertext of the encrypted data encryption key, which can be implemented as follows: for any data shard, according to the second correspondence, using the storage service key corresponding to the data shard, encrypts at least one data encryption key to obtain the ciphertext of at least one data encryption key.

[0046] Optionally, the storage persistence node 201 encrypts the first data according to the data encryption key and persistently stores the encrypted data ciphertext, which is implemented as follows: encrypting the corresponding data chunks according to at least one data encryption key, and storing the encrypted ciphertext of multiple data chunks in at least one persistent file, and recording the identification information of the included data chunks and the ciphertext of the data encryption key used to encrypt the data chunks in the metadata of the at least one persistent file. Among them, the ciphertext of multiple data chunks can be stored in one persistent file, or the ciphertext of each data chunk can be stored in one persistent file, or the ciphertext of data chunks using the same data encryption key can be stored in one persistent file, without limitation. In addition, the identification information of the included data chunks and the ciphertext of the data encryption key used to encrypt the data chunks can also be recorded in the metadata of the persistent file. The following provides a flow chart of the interaction between the user interaction layer, storage service layer, and storage persistence layer corresponding to the data write process. In Figure 2, the cloud storage system is illustrated as an example including one storage service layer, but is not limited to this.

[0047] Step 21: The user initiates a write request to the cloud storage disk to the storage access node 301 through the cloud computing instance on the computing node, so as to write the first data.

[0048] Step 22: The storage access node 301 sends the first data to the storage service node B1 in the storage service layer A1.

[0049] Step 23: The key management node 101 of the user interaction layer provides the user master key CMK to the storage service node B1 of the storage service layer A1.

[0050] Step 24: The storage service node B1 receives the first data and the user master key CMK, and generates a local storage service key SSK1.

[0051] Optionally, storage service node B1 may divide the first data into at least one data shard and generate at least one local storage service key for the at least one data shard. For example, the first data may be divided into data shard segment1 and data shard segment2, and a storage service key may be assigned to each data shard. Data shard segment1 corresponds to storage service key SSK11, and data shard segment2 corresponds to storage service key SSK12.

[0052] Step 25: The storage service node B1 uses the user master key CMK to encrypt the storage service key SSK1, obtains the encrypted storage service key ESSK1, and saves it.

[0053] Optionally, when the first data is divided into at least one data shard, a first correspondence can be established between the key corresponding to the first data provided by the user interaction layer, the identifier of at least one data shard, and the ciphertext of at least one storage service key at this layer, so as to facilitate querying this first correspondence when subsequently reading data. For example, the storage service key SSK11 is encrypted using the key CMK to obtain the ciphertext ESSK11, and the storage service key SSK12 is encrypted using the CMK to obtain the ciphertext ESSK12. The first correspondence can be: segment1—>CMK—>ESSK11, segment2—>CMK—>ESSK12.

[0054] Step 26 : The storage service node B1 provides the storage service key SSK1 of the current layer and the first data to the storage persistence node 201 of the storage persistence layer 20 .

[0055] Optionally, at least one data shard into which the first data is divided, at least one local storage service key, and a second correspondence between the at least one data shard and the at least one local storage service key can be sent to the storage persistence layer. For example, the second correspondence can be segment1->SSK11 and segment2->SSK12.

[0056] Step 27: The storage persistence node 201 receives the storage service key SSK1 and generates a data encryption key DEK.

[0057] Optionally, the storage persistence node 201 receives at least one data shard, at least one storage service key, and a second correspondence between the at least one data shard and the at least one storage service key, corresponding to the first data sent by the storage service layer; for any data shard, the data shard is divided into multiple data chunks, and at least one data encryption key is generated for the multiple data chunks. For example, data shard segment1 is divided into data chunks chunk11 and data chunks chunk12, and data encryption key DEK1 is generated for data chunks chunk11 and data chunks chunk12; data shard segment2 is divided into data chunks chunk21 and data chunk22, and data encryption key DEK2 is generated for data chunks chunk21 and data chunk22.

[0058] Step 28: The storage persistence node 201 encrypts the first data using the data encryption key DEK to obtain data ciphertext.

[0059] Optionally, for any data shard, based on the second correspondence, at least one data encryption key is encrypted using the storage service key corresponding to the data shard to obtain a ciphertext of the at least one data encryption key. For example, if the second correspondence is segment1->SSK11 and segment2->SSK12, data encryption key DEK1 can be encrypted using storage service key SSK11 to obtain ciphertext EDEK1, and data encryption key DEK2 can be encrypted using storage service key SSK12 to obtain ciphertext EDEK2.

[0060] Step 29: The storage persistence node 201 encrypts the data encryption key DEK according to the storage service key SSK1, obtains the encrypted data encryption key EDEK, and saves it.

[0061] Optionally, the corresponding data blocks can be encrypted according to at least one data encryption key, and the ciphertext of the encrypted multiple data blocks can be stored in at least one persistent file, and the identification information of the included data blocks and the ciphertext of the data encryption key used to encrypt the data blocks can be recorded in the metadata of the at least one persistent file.

[0062] For example, data encryption key DEK1 is used to encrypt data chunks chunk11 and data chunk12 to obtain ciphertext (Encrypted Data, ED) 1; data encryption key DEK2 is used to encrypt data chunks chunk21 and data chunk22 to obtain ciphertext ED2; ciphertext ED1 is stored in a persistent file, and chunk11, chunk12 and ciphertext EDEK1 are recorded in metadata; ciphertext ED2 is stored in another persistent file, and chunk21, chunk22 and ciphertext EDEK2 are recorded in metadata.

[0063] Case B2: Read operation.

[0064] When the user reads the second data, the storage service node Bn in the storage service layer An obtains the key provided by the upper layer. The implementation method of obtaining the data key provided by the upper layer is not limited. Depending on the cloud storage technology adopted by the cloud storage system, the method of obtaining the key will also be different. For example, when the cloud storage system adopts block storage, when the computing node mounts the cloud storage disk provided by the cloud storage system, the storage service node in the storage service layer obtains the key provided by the upper layer and stores the key locally. For another example, when the cloud storage system adopts object storage, the storage service node in the storage service layer obtains the key provided by the upper layer in real time during the data reading and writing process. The storage service node Bn decrypts the ciphertext of the storage service key of this layer according to the key provided by the upper layer, obtains the storage service key of this layer, and sends the identification information of the second data and the storage service key of this layer to the next layer. The identification information of the second data is the LBA address of the second data in the cloud storage disk.

[0065] Accordingly, when a user reads the second data, the storage persistence node 201 receives the storage service key provided by the adjacent storage service layer, decrypts the ciphertext of the data encryption key based on the storage service key provided by the adjacent storage service layer to obtain the data encryption key; decrypts the data ciphertext corresponding to the second data based on the data encryption key to obtain the second data, and sends the second data to the adjacent storage service layer. Accordingly, the storage service node Bn can also receive the second data returned by the adjacent storage service layer or storage persistence layer and send it to the upper layer.

[0066] Optionally, the storage service node Bn decrypts the ciphertext of the storage service key of this layer according to the key provided by the previous layer to obtain the storage service key of this layer, which can be implemented as follows: querying the first correspondence according to the key provided by the previous layer to obtain the identification of at least one data shard corresponding to the second data and the ciphertext of at least one storage service key of this layer; decrypting the ciphertext of at least one storage service key of this layer according to the key provided by the previous layer to obtain at least one storage service key of this layer. The storage service node Bn sends the identification information of the second data and the storage service key of this layer to the next layer, which can be implemented as follows: sending the identification information of at least one data shard, at least one storage service key of this layer, and the third correspondence between the identification information of at least one data shard and at least one storage service key of this layer to the next layer.

[0067] Optionally, the storage persistence node 201 receives the storage service key provided by the adjacent storage service layer, which can be implemented as follows: receiving identification information of at least one data shard, at least one storage service key, and a third correspondence between the identification information of at least one data shard and at least one storage service key of the current layer, sent by the adjacent storage service layer An;

[0068] Optionally, the storage persistence node 201 decrypts the ciphertext of the data encryption key according to the storage service key provided by the storage service layer adjacent thereto to obtain the data encryption key. This can be implemented as follows: determining at least one persistent file according to the correspondence between at least one data shard contained in the second data and at least one persistent file, obtaining identification information of the data chunks contained therein and the ciphertext of the data encryption key used to encrypt the data chunks from the metadata of the at least one persistent file; decrypting the ciphertext of the data encryption key used to encrypt each data chunk according to the correspondence between the data chunks and the data shards and the third correspondence using at least one storage service key to obtain the data encryption key. The storage persistence node 201 decrypts the data ciphertext corresponding to the second data according to the data encryption key to obtain the second data, and sends the second data to the storage service layer adjacent thereto. This can be implemented as follows: decrypting the ciphertext of each data chunk according to the data encryption key corresponding to each data chunk to obtain at least one data shard, each data shard including multiple data chunks.

[0069] The following is a flow chart of the interaction between the user interaction layer, storage service layer, and storage persistence layer corresponding to the data reading process. In Figure 3, the cloud storage system includes a storage service layer as an example, but the present invention is not limited to this.

[0070] Step 31: The user initiates a read request for the cloud storage disk to the storage access node 301 through the cloud computing instance on the computing node. The read request includes identification information of the second data to be read.

[0071] Step 32: The storage access node 301 sends the identification information of the second data to the storage service node B1 in the storage service layer A1.

[0072] Step 33: The key management node 101 of the user interaction layer provides the user master key CMK to the storage service node B1 of the storage service layer A1.

[0073] Step 34: The storage service node B1 receives the user master key CMK and uses the user master key CMK to decrypt the ciphertext of the storage service key ESSK1 to obtain the storage service SSK1.

[0074] Optionally, based on the user master key CMK, the first corresponding relationship is queried to obtain the identifier of at least one data shard corresponding to the second data and the ciphertext of at least one storage service key at this layer; the ciphertext of at least one storage service key at this layer is decrypted based on the key provided by the upper layer to obtain at least one storage service key at this layer. For example, the first corresponding relationship is: segment1—>CMK—>ESSK11, segment2—>CMK—>ESSK12; through the identification information of the second data, the identification information of the data shards of the second data is obtained, which are: segment1 and segment2 respectively; through the user master key CMK and the identification information of the data shards of the second data, the first corresponding relationship can be queried to obtain the ciphertexts ESSK11 and ESSK12 of the storage service key at this layer; the ciphertexts ESSK11 and ESSK12 can be decrypted respectively based on the user master key CMK to obtain the storage service keys SSK11 and SSK12 at this layer.

[0075] It is to be noted that in this embodiment, during the data reading process, the key management node 101 of the user interaction layer provides the user master key CMK to the storage service node B1 of the storage service layer A1 as an example for explanation, but it is not limited to this. Depending on the storage technology adopted by the cloud storage system, the way in which the storage service node B1 obtains the user master key CMK will be different. In addition to being provided by the key management node 101, for example, the storage service node B1 can also store the user master key CMK locally during the data writing process, and can read it directly from the local during the data reading process. In addition, there is no limitation on the way in which the key management node 101 provides the user master key CMK to the storage service node B1, and the specific method can be determined according to the storage technology adopted, mainly based on compatibility with the adopted storage technology.

[0076] Step 35 : Provide the storage service SSK1 and the identification information of the second data to the storage persistence node 201 of the storage persistence layer 20 .

[0077] Optionally, the identification information of at least one data shard, at least one local storage service key, and a third correspondence between the identification information of at least one data shard and at least one local storage service key are sent to the next layer. For example, the third correspondence may be: segment1->SSK11, segment2->SSK12.

[0078] Step 36: The storage persistence node 201 receives the storage service SSK1 and the identification information of the second data, and uses the storage service SSK1 to decrypt the ciphertext of the data encryption key EDEK to obtain the data encryption key DEK.

[0079] Optionally, based on the correspondence between at least one data shard contained in the second data and at least one persistent file, at least one persistent file is determined, and identification information of the contained data blocks and the ciphertext of the data encryption key used to encrypt the data blocks are obtained from the metadata of the at least one persistent file; based on the correspondence between the data blocks and the data shards and the third correspondence, the ciphertext of the data encryption key used to encrypt each data block is decrypted using at least one storage service key to obtain the data encryption key.

[0080] Step 37: The storage persistence node 201 determines the ciphertext of the second data according to the identification information of the second data;

[0081] Step 38: Decrypt the ciphertext of the second data using the data encryption key DEK to obtain the second data.

[0082] Optionally, the ciphertext of each data block is decrypted according to the data encryption key corresponding to each data block to obtain at least one data slice, each data slice including a plurality of data blocks.

[0083] Step 39: The storage persistence node 201 sends the second data to the storage service node B1.

[0084] Step 40: The storage service node B1 returns the second data to the storage access node 301.

[0085] Step 41: The storage access node 301 provides the second data to the user through the cloud computing instance on the computing node.

[0086] In an optional embodiment, the user interaction layer can update the user master key if it changes and provide the updated user master key to the adjacent storage service layer An. For example, after a user creates a user master key, the user interaction layer 10 can enable rotation permissions for the user master key and periodically update the user master key. For another example, if the user master key is leaked, the user interaction layer can update the leaked user master key and provide the updated user master key to the adjacent storage service layer An.

[0087] Optionally, when the user master key changes, the storage service node in the storage service layer adjacent to the user interaction layer can also use the user master key before the change to decrypt the storage service key of this layer from the ciphertext of the storage service key of this layer, and use the user master key after the change to re-encrypt the storage service key of this layer to obtain the new ciphertext of the storage service key of this layer.

[0088] The Storage Service Key (SSK) is introduced between the user interaction layer and the storage persistence layer to provide more advanced data protection capabilities. For example, if the user master key (CMK) is leaked, the new user master key (CMK) can be quickly used to encrypt the storage service key (SSK) to replace the original ESSK. This prevents the original CMK from accessing user data without having to decrypt and re-encrypt the data in the storage persistence layer, thereby improving the flexibility and scalability of the cloud storage system.

[0089] In an optional embodiment, in order to ensure the security of the data, the data encryption key can be rotated regularly. The storage persistence node in the storage persistence layer can also update the data encryption key, use the data encryption key before the update to decrypt the user data from the data ciphertext obtained by encrypting the user data, and use the updated data encryption key to re-encrypt the user data to obtain a new data ciphertext; and encrypt the updated data encryption key according to the storage service key provided by the adjacent storage service layer to obtain the updated data encryption key ciphertext, and replace the data encryption key ciphertext before the update. Among them, when the data encryption key DEK needs to be rotated, the user master key CMK is not required to participate, and it is completed through cooperation with the storage service key SSK, so that the user's perception is minimized.

[0090] In the embodiment of the present disclosure, the cloud storage system is layered, encryption functions and roles are assigned to different layers, and multiple envelope encryption is used to enable the storage service layer and the storage persistence layer to work closely together to complete the data encryption process.

[0091] The main advantages are as follows:

[0092] 1) User data encryption is handled uniformly by the storage persistence layer, which not only simplifies the design and implementation of each storage service layer, but also facilitates unified encryption and decryption hardware offload for acceleration. For example, if the storage persistence layer supports hardware offload, and the storage persistence layer uses technologies such as hardware accelerator cards and field programmable gate arrays (FPGAs), the encryption and decryption process of the storage persistence layer can be offloaded by hardware to increase the speed of data encryption and decryption. The unified data encryption and decryption processing of the storage persistence layer strengthens the convergence of data security processes and simplifies operations and maintenance, facilitates the unification of security and encryption standards, and reviews and improves security levels. It also greatly improves the user's understanding of data security costs and experience.

[0093] 2) The storage service layer focuses on user key management and authentication, maximizing the flexibility and scalability of encryption. The storage service layer can directly reuse the encryption capabilities provided by the data persistence layer (requiring only one encryption, saving computing resources) while retaining the ability to customize upper-layer encryption within the storage service layer. However, the overall layer adheres to the processes and security specifications defined by layered encryption, ensuring fundamental data security services.

[0094] 3) Encryption collaboration between the storage service layer and the storage persistence layer is achieved using the principle of multi-envelope encryption. The user master key (CMK) and the storage service key (SSK) in at least one storage service layer form a multi-envelope encryption scheme. By inserting the storage service key (SSK) into the encryption process, the storage service layer and the storage persistence layer work together closely to ensure data security while minimizing coupling and exposure, reducing attack risks and implementation dependencies.

[0095] In addition to the cloud storage system shown in Figure 1, Figure 4 also provides another cloud storage system. The cloud storage system shown in Figure 4 differs from the cloud storage system shown in Figure 1 in that the cloud storage system shown in Figure 4 does not include a storage service layer. The embodiment shown in Figure 4 focuses on the cloud storage system's use of a layered structure for data encryption and decryption, decoupling key management functions from data encryption and decryption functions to enhance system flexibility and scalability. As shown in Figure 4, the cloud storage system includes a user interaction layer 10 and a storage persistence layer 20.

[0096] The user interaction layer 10 includes a key management node 101, which is used to manage the user master key (CMK) and provide the user master key (CMK) to the storage persistence layer.

[0097] The storage persistence layer 20 includes a storage persistence node 201, which is used to generate a data encryption key and encrypt and decrypt user data according to the data encryption key during data reading and writing, and encrypt and decrypt the data encryption key according to the user master key.

[0098] In an optional embodiment, the storage persistence layer includes a storage persistence node that can generate a data encryption key when a user writes first data, encrypt the first data according to the data encryption key to obtain a data ciphertext and store it persistently; encrypt the data encryption key according to the user master key to obtain a ciphertext of the data encryption key and store it persistently; when the user reads second data, decrypt the ciphertext of the data encryption key according to the user master key to obtain the data encryption key; decrypt the data ciphertext of the second data according to the data encryption key to obtain the second data, and send the second data to the user's computing node.

[0099] The detailed implementation and beneficial effects of each step in the system of this embodiment have been described in detail in the aforementioned embodiments and will not be elaborated here.

[0100] FIG5a is a flow chart of a data reading and writing method provided by an exemplary embodiment of the present disclosure. The method is applicable to a key management node in a user interaction layer of a cloud storage system. As shown in FIG5a , the method includes:

[0101] 501a. Manage user master keys;

[0102] 502a. Provide the user master key to the storage service layer adjacent to the user interaction layer in the cloud storage system, so that the storage service layer adjacent to the user interaction layer and the storage persistence layer can cooperate with each other to implement encryption and decryption processing of user data.

[0103] In an optional embodiment, managing the user master key includes: regularly updating the user master key, and when the user master key is updated, providing the updated user master key to a storage service layer adjacent to the user interaction layer.

[0104] FIG5 b is a flow chart of another data reading and writing method provided by an exemplary embodiment of the present disclosure. The method is applicable to a storage service node in at least one storage service layer in a cloud storage system. As shown in FIG5 b , the method includes:

[0105] 501b. Generate the storage service key for this layer and encrypt and decrypt it using the key provided by the previous layer during data reading and writing. The storage service key for this layer is the storage service key of the target storage service layer to which the storage service node belongs. The key provided by the previous layer is either the user master key or the storage service key of the layer above the target storage service layer.

[0106] 502b. Provide the storage service key of this layer to the next layer, which is implemented as the next storage service layer adjacent to the target storage service layer or the storage persistence layer in the cloud storage system.

[0107] In an optional embodiment, a storage service key for this layer is generated, and encryption and decryption processing is performed on the storage service key for this layer according to the key provided by the upper layer during the data writing process, including: when a user writes the first data, the storage service key for this layer is generated, and the key provided by the upper layer is received, and the upper layer is implemented as a user interaction layer in the cloud storage system, or as an upper storage service layer adjacent thereto; the storage service key for this layer is encrypted according to the key provided by the upper layer and the ciphertext of the encrypted storage service key for this layer is saved, and the first data and the storage service key for this layer are sent to the next layer, which is the next storage service layer or storage persistence layer adjacent thereto.

[0108] In an optional embodiment, during the data reading process, the storage service key of this layer is encrypted and decrypted according to the key provided by the upper layer, including: when the user reads the second data, obtaining the key provided by the upper layer; decrypting the ciphertext of the storage service key of this layer according to the key provided by the upper layer to obtain the storage service key of this layer; sending the identification information of the second data and the storage service key of this layer to the next layer; and receiving the second data returned by the adjacent next storage service layer or storage persistence layer and sending it to the upper layer.

[0109] Optionally, generating the storage service key of this layer includes: when receiving the data to be stored, dividing the data to be stored into at least one data shard; generating at least one storage service key of this layer for at least one data shard; wherein the data to be stored is the first data or the data shard sent by the upper storage service layer; accordingly, encrypting the storage service key of this layer according to the key provided by the upper layer and saving the ciphertext of the encrypted storage service key of this layer, including: encrypting at least one storage service key of this layer according to the key corresponding to the data to be stored provided by the upper layer and saving the ciphertext of at least one storage service key of this layer, and establishing a first correspondence between the key corresponding to the data to be stored, the identifier of at least one data shard and the ciphertext of at least one storage service key of this layer; accordingly, sending the first data and the storage service key of this layer to the next layer, including: sending at least one data shard, at least one storage service key of this layer and the second correspondence between at least one data shard and at least one storage service key of this layer to the next layer.

[0110] Further optionally, the ciphertext of the storage service key of this layer is decrypted according to the key provided by the upper layer to obtain the storage service key of this layer, including: querying the first correspondence according to the key provided by the upper layer to obtain the identification of at least one data shard corresponding to the second data and the ciphertext of at least one storage service key of this layer; decrypting the ciphertext of at least one storage service key of this layer according to the key provided by the upper layer to obtain at least one storage service key of this layer; accordingly, sending the identification information of the second data and the storage service key of this layer to the next layer, including: sending the identification information of at least one data shard, at least one storage service key of this layer, and the third correspondence between the identification information of at least one data shard and at least one storage service key of this layer to the next layer.

[0111] In an optional embodiment, the method provided by the embodiment of the present disclosure also includes: in the event that the user master key changes, using the user master key before the change to decrypt the current layer storage service key from the ciphertext of the current layer storage service key, and using the user master key after the change to re-encrypt the current layer storage service key to obtain a new ciphertext of the current layer storage service key.

[0112] FIG5c is a flow chart of another data reading and writing method provided by an exemplary embodiment of the present disclosure. The method is applicable to a storage persistence node in a storage persistence layer in a cloud storage system. As shown in FIG5c , the method includes:

[0113] 501c. Receive a storage service key provided by a storage service layer adjacent to the storage persistence layer in the cloud storage system;

[0114] 502c. Generate a data encryption key and encrypt and decrypt user data according to the data encryption key during data reading and writing;

[0115] 503c. Encrypt and decrypt the data encryption key according to the storage service key provided by the adjacent storage service layer.

[0116] In an optional embodiment, a data encryption key is generated, and during the data writing process, user data is encrypted and decrypted according to the data encryption key, and the data encryption key is encrypted and decrypted according to the storage service key provided by the storage service layer, including: generating a data encryption key when a user writes first data; encrypting the first data according to the data encryption key and persistently storing the encrypted data ciphertext; and encrypting the data encryption key according to the storage service key provided by the adjacent storage service layer and saving the encrypted data encryption key ciphertext.

[0117] In an optional embodiment, during the data reading process, user data is encrypted and decrypted according to the data encryption key, and the data encryption key is encrypted and decrypted according to the storage service key provided by the storage service layer, including: when the user reads the second data, receiving the storage service key provided by the adjacent storage service layer; decrypting the ciphertext of the data encryption key according to the storage service key provided by the adjacent storage service layer to obtain the data encryption key; decrypting the data ciphertext corresponding to the second data according to the data encryption key to obtain the second data, and sending the second data to the adjacent storage service layer.

[0118] Optionally, generating a data encryption key includes: receiving at least one data shard, at least one storage service key, and a second correspondence between at least one data shard and at least one storage service key corresponding to the first data sent by an adjacent storage service layer; for any data shard, dividing the data shard into multiple data chunks, and generating at least one data encryption key for the multiple data chunks; accordingly, encrypting the data encryption key according to the storage service key provided by the adjacent storage service layer and saving the ciphertext of the encrypted data encryption key, including: for any data shard, according to the second correspondence, using the storage service key corresponding to the data shard, encrypting at least one data encryption key to obtain the ciphertext of at least one data encryption key; accordingly, encrypting the first data according to the data encryption key and persistently storing the encrypted data ciphertext, including: encrypting the corresponding data chunk according to at least one data encryption key, and storing the encrypted ciphertext of the multiple data chunks in at least one persistent file, and recording the identification information of the included data chunks and the ciphertext of the data encryption key used to encrypt the data chunks in the metadata of the at least one persistent file.

[0119] In an optional embodiment, receiving a storage service key provided by an adjacent storage service layer includes: receiving identification information of at least one data shard, at least one storage service key, and a third correspondence between the identification information of at least one data shard and at least one storage service key of this layer sent by the adjacent storage service layer; accordingly, decrypting the ciphertext of the data encryption key according to the storage service key provided by the adjacent storage service layer to obtain the data encryption key, including: determining at least one persistent file according to the correspondence between at least one data shard contained in the second data and at least one persistent file, and obtaining the data encryption key from the metadata of the at least one persistent file. Obtain identification information of the included data chunks and the ciphertext of the data encryption key used to encrypt the data chunks; decrypt the ciphertext of the data encryption key used to encrypt each data chunk using at least one storage service key according to the correspondence between the data chunks and the data shards and a third correspondence to obtain the data encryption key; correspondingly, decrypt the data ciphertext corresponding to the second data according to the data encryption key to obtain second data, and send the second data to the storage service layer adjacent thereto, including: decrypting the ciphertext of each data chunk according to the data encryption key corresponding to each data chunk to obtain at least one data shard, each data shard including multiple data chunks.

[0120] In an optional embodiment, the method provided by the embodiment of the present disclosure also includes: updating the data encryption key, decrypting the user data from the data ciphertext obtained by encrypting the user data using the data encryption key before the update, and re-encrypting the user data using the updated data encryption key to obtain a new data ciphertext; and encrypting the updated data encryption key according to the storage service key provided by the adjacent storage service layer to obtain the ciphertext of the updated data encryption key, and replacing the ciphertext of the data encryption key before the update.

[0121] FIG5 d is a flow chart of another data reading and writing method provided by an exemplary embodiment of the present disclosure, which is applicable to a storage persistence node in a cloud storage system. As shown in FIG5 d , the method includes:

[0122] 501d. Receive a user master key provided by a key management node in a user interaction layer of the cloud storage system;

[0123] 502d. Generate a data encryption key, and encrypt and decrypt user data based on the data encryption key during data reading and writing, and encrypt and decrypt the data encryption key based on the user master key.

[0124] In an optional embodiment, a data encryption key is generated, and during the data reading and writing process, user data is encrypted and decrypted according to the data encryption key, and the data encryption key is encrypted and decrypted according to the user master key, including: when a user writes first data, a data encryption key is generated, and the first data is encrypted according to the data encryption key to obtain a data ciphertext and persistently store it; the data encryption key is encrypted according to the user master key to obtain a ciphertext of the data encryption key and persistently store it; when the user reads second data, the ciphertext of the data encryption key is decrypted according to the user master key to obtain the data encryption key; the data ciphertext of the second data is decrypted according to the data encryption key to obtain the second data, and the second data is sent to the user's computing node.

[0125] The detailed implementation and beneficial effects of each step in the method of this embodiment have been described in detail in the aforementioned embodiments and will not be elaborated here.

[0126] It should be noted that the execution entity of each step of the method provided in the above embodiment can be the same device, or the method can be executed by different devices. For example, the execution entity of steps 501a to 503a can be device A; for another example, the execution entity of steps 501a and 502a can be device A, and the execution entity of step 503a can be device B; and so on.

[0127] In addition, some of the processes described in the above embodiments and the accompanying drawings include multiple operations that appear in a specific order, but it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel. The sequence numbers of the operations, such as 501a, 502a, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to being different types.

[0128] Figure 6a is a structural diagram of a data reading and writing device provided by an exemplary embodiment of the present disclosure. The device corresponds to a key management node in the user interaction layer of the cloud storage system. As shown in Figure 6a, the device includes: a management module 61a and a providing module 62a.

[0129] Management module 61a, used to manage user master keys;

[0130] The providing module 62a is used to provide the user master key to the storage service layer adjacent to the user interaction layer in the cloud storage system, so that the storage service layer adjacent to the user interaction layer and the storage persistence layer can cooperate with each other to realize encryption and decryption of user data.

[0131] In an optional embodiment, the management module is specifically configured to: regularly update the user master key, and when the user master key is updated, provide the updated user master key to the storage service layer adjacent to the user interaction layer.

[0132] Figure 6b is a structural schematic diagram of another data reading and writing device provided by an exemplary embodiment of the present disclosure. The device corresponds to a storage service node in at least one storage service layer in a cloud storage system. As shown in Figure 6b, the device includes: a generation module 61b, an encryption and decryption module 62b and a first transceiver module 63b.

[0133] Generation module 61b, used to generate the storage service key of this layer; the storage service key of this layer is the storage service key of the target storage service layer to which the storage service node belongs;

[0134] The encryption and decryption module 62b is used to encrypt and decrypt the storage service key of this layer according to the key provided by the upper layer during the data reading and writing process. The key provided by the upper layer is the user master key or the storage service key of the layer above the target storage service layer;

[0135] The first transceiver module 63b is used to provide the storage service key of this layer to the next layer, which is implemented as the next storage service layer adjacent to the target storage service layer or the storage persistence layer in the cloud storage system.

[0136] In an optional embodiment, the generation module is specifically used to: generate the storage service key of this layer when the user writes the first data; the first transceiver module is also used to receive the key provided by the upper layer, and the upper layer is implemented as the user interaction layer in the cloud storage system, or as the upper storage service layer adjacent thereto; the encryption and decryption module is specifically used to encrypt the storage service key of this layer according to the key provided by the upper layer and save the ciphertext of the encrypted storage service key of this layer; the first transceiver module is specifically used to send the first data and the storage service key of this layer to the next layer, and the next layer is the next storage service layer or storage persistence layer adjacent thereto.

[0137] In an optional embodiment, the first transceiver module is specifically used to: obtain the key provided by the upper layer when the user reads the second data; the encryption and decryption module is specifically used to decrypt the ciphertext of the storage service key of this layer according to the key provided by the upper layer to obtain the storage service key of this layer; the first transceiver module is specifically used to: send the identification information of the second data and the storage service key of this layer to the next layer, and receive the second data returned by its adjacent next storage service layer or storage persistence layer and send it to the upper layer.

[0138] Optionally, the generation module is specifically used to: when receiving the data to be stored, divide the data to be stored into at least one data slice; generate at least one current-layer storage service key for at least one data slice; wherein the data to be stored is the first data or the data slice sent by the upper-layer storage service layer; the encryption and decryption module is specifically used to: according to the key corresponding to the data to be stored provided by the upper layer, encrypt at least one current-layer storage service key respectively and save the ciphertext of at least one current-layer storage service key, and establish a first correspondence between the key corresponding to the data to be stored, the identifier of at least one data slice and the ciphertext of at least one current-layer storage service key; the first transceiver module is specifically used to: send at least one data slice, at least one current-layer storage service key and the second correspondence between at least one data slice and at least one current-layer storage service key to the next layer.

[0139] Optionally, the encryption and decryption module is specifically used to: query the first correspondence according to the key provided by the upper layer to obtain the identification of at least one data shard corresponding to the second data and the ciphertext of at least one storage service key of this layer; decrypt the ciphertext of at least one storage service key of this layer according to the key provided by the upper layer to obtain at least one storage service key of this layer; the first transceiver module is specifically used to: send the identification information of at least one data shard, at least one storage service key of this layer, and the third correspondence between the identification information of at least one data shard and at least one storage service key of this layer to the next layer.

[0140] In an optional embodiment, the encryption and decryption module is also used to: when the user master key changes, use the user master key before the change to decrypt the current layer storage service key from the ciphertext of the current layer storage service key, and use the user master key after the change to re-encrypt the current layer storage service key to obtain the new ciphertext of the current layer storage service key.

[0141] Figure 6c is a structural diagram of another data reading and writing device provided by an exemplary embodiment of the present disclosure. The device corresponds to a storage persistence node in the storage persistence layer in the cloud storage system. The device includes: a second transceiver module 61c, a generation module 62c and an encryption and decryption module 63c.

[0142] The second transceiver module 61c is used to receive a storage service key provided by a storage service layer adjacent to the storage persistence layer in the cloud storage system;

[0143] A generating module 62c, configured to generate a data encryption key;

[0144] The encryption and decryption module 63c is used to encrypt and decrypt user data according to the data encryption key during the data reading and writing process, and to encrypt and decrypt the data encryption key according to the storage service key provided by the adjacent storage service layer.

[0145] In an optional embodiment, the generation module is specifically used to: generate a data encryption key when the user writes the first data; the encryption and decryption module is specifically used to: encrypt the first data according to the data encryption key and persistently store the encrypted data ciphertext, and encrypt the data encryption key according to the storage service key provided by the adjacent storage service layer and save the encrypted data encryption key ciphertext.

[0146] In an optional embodiment, the second transceiver module is specifically used to: receive the storage service key provided by the adjacent storage service layer when the user reads the second data; the encryption and decryption module is specifically used to: decrypt the ciphertext of the data encryption key according to the storage service key provided by the adjacent storage service layer to obtain the data encryption key; and decrypt the data ciphertext corresponding to the second data according to the data encryption key to obtain the second data, and send the second data to the adjacent storage service layer.

[0147] Optionally, the generation module is specifically used to: receive at least one data shard, at least one storage service key, and a second correspondence between at least one data shard and at least one storage service key corresponding to the first data sent by the storage service layer adjacent to it; for any data shard, divide the data shard into multiple data blocks, and generate at least one data encryption key for the multiple data blocks; the encryption and decryption module is specifically used to: for any data shard, according to the second correspondence, use the storage service key corresponding to the data shard to encrypt the at least one data encryption key to obtain the ciphertext of the at least one data encryption key; and according to the at least one data encryption key, encrypt the corresponding data block, and store the encrypted ciphertext of the multiple data blocks in at least one persistent file, and record the identification information of the included data blocks and the ciphertext of the data encryption key used to encrypt the data blocks in the metadata of the at least one persistent file.

[0148] Further optionally, the second transceiver module is specifically used to: receive identification information of at least one data shard, at least one storage service key, and a third correspondence between the identification information of at least one data shard and at least one storage service key of this layer sent by the storage service layer adjacent to it; the encryption and decryption module is specifically used to: determine at least one persistent file based on the correspondence between at least one data shard contained in the second data and at least one persistent file, obtain the identification information of the data blocks contained therein and the ciphertext of the data encryption key used to encrypt the data blocks from the metadata of the at least one persistent file; decrypt the ciphertext of the data encryption key used to encrypt each data block based on the correspondence between the data block and the data shard and the third correspondence to obtain the data encryption key; and decrypt the ciphertext of each data block based on the data encryption key corresponding to each data block to obtain at least one data shard, where each data shard includes multiple data blocks.

[0149] In an optional embodiment, the apparatus further includes: an update module and a replacement module. The update module is configured to update the data encryption key; the encryption / decryption module is configured to decrypt the user data from the data ciphertext obtained by encrypting the user data using the data encryption key before the update, and to re-encrypt the user data using the updated data encryption key to obtain new data ciphertext; and the replacement module is configured to replace the ciphertext of the data encryption key before the update.

[0150] The exemplary embodiment of the present disclosure also provides a structural schematic diagram of another data reading and writing device, which corresponds to a storage persistence node in a cloud storage system. The diagram of the device can be seen in Figure 6c. The device includes: a second transceiver module, a generation module and an encryption and decryption module.

[0151] The second transceiver module is used to receive the user master key provided by the key management node in the user interaction layer of the cloud storage system;

[0152] A generation module, used for generating a data encryption key;

[0153] The encryption and decryption module is used to encrypt and decrypt user data according to the data encryption key during the data reading and writing process, and to encrypt and decrypt the data encryption key according to the user master key.

[0154] In an optional embodiment, the generation module is specifically used to: generate a data encryption key when a user writes the first data; the encryption and decryption module is used to encrypt the first data according to the data encryption key to obtain the data ciphertext and store it persistently; encrypt the data encryption key according to the user master key to obtain the ciphertext of the data encryption key and store it persistently; and when the user reads the second data, decrypt the ciphertext of the data encryption key according to the user master key to obtain the data encryption key; decrypt the data ciphertext of the second data according to the data encryption key to obtain the second data; the second transceiver module is also used to: send the second data to the user's computing node.

[0155] Figure 7 is a structural diagram of an electronic device provided by an exemplary embodiment of the present disclosure 7, which corresponds to a key management node in a user interaction layer in a cloud storage system. As shown in Figure 7, the device includes: a memory 74 and a processor 75.

[0156] The memory 74 is used to store computer programs and can be configured to store various other data to support operations on the electronic device. Examples of such data include instructions for any application or method operating on the electronic device, contact data, phone book data, messages, pictures, videos, etc.

[0157] The memory 74 can be implemented by any type of volatile or non-volatile memory device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0158] The processor 75 is coupled to the memory 74 and is used to execute the computer program in the memory 74 to: manage the user master key; provide the user master key to the storage service layer adjacent to the user interaction layer in the cloud storage system, so that the storage service layer and the storage persistence layer adjacent to the user interaction layer can cooperate with each other to realize encryption and decryption processing of user data.

[0159] In an optional embodiment, when managing the user master key, the processor 75 is specifically configured to: regularly update the user master key, and when the user master key is updated, provide the updated user master key to the storage service layer adjacent to the user interaction layer.

[0160] Furthermore, as shown in FIG7 , the electronic device also includes other components such as a communication component 76, a display 77, a power supply component 78, and an audio component 79. FIG7 only schematically shows some components, which does not mean that the electronic device only includes the components shown in FIG7 . In addition, the components in the dotted box in FIG7 are optional components, not mandatory components, and the specific components may depend on the product form of the electronic device. The electronic device of this embodiment can be implemented as a terminal device such as a desktop computer, a laptop computer, a smart phone, or an IOT device, and can be implemented as a server-side device such as a conventional server, a cloud server, or a server array.

[0161] The disclosed embodiments also provide an electronic device, which corresponds to a storage service node in at least one storage service layer in a cloud storage system. The implementation structure of the electronic device is the same as or similar to the implementation structure of the electronic device shown in FIG7 , and can be implemented with reference to the structure of the electronic device shown in FIG7 . The difference between the electronic device provided by this embodiment and the electronic device in the embodiment shown in FIG7 mainly lies in that the functions implemented by the processor executing the computer program stored in the memory are different. For the electronic device provided by this embodiment, its processor executes the computer program stored in the memory, which can be used to: generate the storage service key of this layer, and encrypt and decrypt the storage service key of this layer according to the key provided by the upper layer during the data reading and writing process, the key provided by the upper layer is the user master key or the storage service key of the upper layer; provide the storage service key of this layer to the next layer, and the next layer is implemented as the next storage service layer or the storage persistence layer in the cloud storage system.

[0162] In an optional embodiment, when the processor generates the storage service key of this layer and encrypts and decrypts the storage service key of this layer according to the key provided by the upper layer during the data writing process, it is specifically used to: generate the storage service key of this layer when the user writes the first data, and receive the key provided by the upper layer, the upper layer is implemented as the user interaction layer in the cloud storage system, or as the upper storage service layer adjacent to it; encrypt the storage service key of this layer according to the key provided by the upper layer and save the ciphertext of the encrypted storage service key of this layer, and send the first data and the storage service key of this layer to the next layer, which is the next storage service layer or storage persistence layer adjacent to it.

[0163] In an optional embodiment, when the processor encrypts and decrypts the storage service key of this layer according to the key provided by the upper layer during the data reading process, it is specifically used to: obtain the key provided by the upper layer when the user reads the second data; decrypt the ciphertext of the storage service key of this layer according to the key provided by the upper layer to obtain the storage service key of this layer; send the identification information of the second data and the storage service key of this layer to the next layer; and receive the second data returned by its adjacent next storage service layer or storage persistence layer and send it to the upper layer.

[0164] In an optional embodiment, when the processor generates the storage service key of this layer, it is specifically used to: when receiving the data to be stored, divide the data to be stored into at least one data shard; generate at least one storage service key of this layer for at least one data shard; wherein the data to be stored is the first data or the data shard sent by the upper storage service layer; when the processor encrypts the storage service key of this layer according to the key provided by the upper layer and saves the ciphertext of the encrypted storage service key of this layer, it is specifically used to: according to the key corresponding to the data to be stored provided by the upper layer, encrypt at least one storage service key of this layer and save the ciphertext of at least one storage service key of this layer, and establish a first correspondence between the key corresponding to the data to be stored, the identifier of at least one data shard and the ciphertext of at least one storage service key of this layer; when the processor sends the first data and the storage service key of this layer to the next layer, it is specifically used to: send at least one data shard, at least one storage service key of this layer and the second correspondence between at least one data shard and at least one storage service key of this layer to the next layer.

[0165] In an optional embodiment, when the processor decrypts the ciphertext of the storage service key of this layer according to the key provided by the upper layer to obtain the storage service key of this layer, it is specifically used to: query the first correspondence according to the key provided by the upper layer to obtain the identification of at least one data shard corresponding to the second data and the ciphertext of at least one storage service key of this layer; decrypt the ciphertext of at least one storage service key of this layer according to the key provided by the upper layer to obtain at least one storage service key of this layer; when the processor sends the identification information of the second data and the storage service key of this layer to the next layer, it is specifically used to: send the identification information of at least one data shard, at least one storage service key of this layer, and the third correspondence between the identification information of at least one data shard and at least one storage service key of this layer to the next layer.

[0166] In an optional embodiment, the processor is also used to: when the user master key changes, use the user master key before the change to decrypt the current layer storage service key from the ciphertext of the current layer storage service key, and use the user master key after the change to re-encrypt the current layer storage service key to obtain a new ciphertext of the current layer storage service key.

[0167] The disclosed embodiment also provides an electronic device, which corresponds to a storage persistence node in a storage persistence layer in a cloud storage system. The implementation structure of the electronic device is the same as or similar to the implementation structure of the electronic device shown in FIG7 , and can be implemented with reference to the structure of the electronic device shown in FIG7 . The difference between the electronic device provided by this embodiment and the electronic device in the embodiment shown in FIG7 mainly lies in that the functions implemented by the processor executing the computer program stored in the memory are different. For the electronic device provided by this embodiment, its processor executes the computer program stored in the memory, which can be used to: receive a storage service key provided by a storage service layer adjacent to the storage persistence layer in the cloud storage system; generate a data encryption key, and encrypt and decrypt user data according to the data encryption key during the data reading and writing process, and encrypt and decrypt the data encryption key according to the storage service key provided by the storage service layer adjacent to it.

[0168] In an optional embodiment, when the processor generates a data encryption key and encrypts and decrypts user data according to the data encryption key during the data writing process, and encrypts and decrypts the data encryption key according to the storage service key provided by the storage service layer, it is specifically used to: generate a data encryption key when the user writes first data; encrypt the first data according to the data encryption key and persistently store the encrypted data ciphertext, and encrypt the data encryption key according to the storage service key provided by the adjacent storage service layer and save the encrypted data encryption key ciphertext.

[0169] In an optional embodiment, when the processor encrypts and decrypts user data according to the data encryption key during the data reading process, and encrypts and decrypts the data encryption key according to the storage service key provided by the storage service layer, it is specifically used to: receive the storage service key provided by the adjacent storage service layer when the user reads the second data; decrypt the ciphertext of the data encryption key according to the storage service key provided by the adjacent storage service layer to obtain the data encryption key; decrypt the data ciphertext corresponding to the second data according to the data encryption key to obtain the second data, and send the second data to the adjacent storage service layer.

[0170] In an optional embodiment, when the processor generates a data encryption key, it is specifically used to: receive at least one data shard, at least one storage service key, and a second correspondence between at least one data shard and at least one storage service key corresponding to the first data sent by the storage service layer adjacent to it; for any data shard, divide the data shard into multiple data chunks, and generate at least one data encryption key for the multiple data chunks; when the processor encrypts the data encryption key according to the storage service key provided by the storage service layer adjacent to it and saves the ciphertext of the encrypted data encryption key, it is specifically used to: for any data shard, use the storage service key corresponding to the data shard according to the second correspondence to encrypt the at least one data encryption key to obtain the ciphertext of the at least one data encryption key; when the processor encrypts the first data according to the data encryption key and persistently stores the encrypted data ciphertext, it is specifically used to: encrypt the corresponding data chunk according to at least one data encryption key, and store the encrypted ciphertext of the multiple data chunks in at least one persistent file, and record the identification information of the included data chunks and the ciphertext of the data encryption key used to encrypt the data chunks in the metadata of the at least one persistent file.

[0171] Optionally, when the processor receives the storage service key provided by the storage service layer adjacent to it, it is specifically used to: receive identification information of at least one data shard, at least one storage service key, and a third correspondence between the identification information of at least one data shard and at least one storage service key of this layer sent by the storage service layer adjacent to it; when the processor decrypts the ciphertext of the data encryption key according to the storage service key provided by the storage service layer adjacent to it to obtain the data encryption key, it is specifically used to: determine at least one persistent file according to the correspondence between at least one data shard contained in the second data and at least one persistent file, obtain the identification information of the data chunks contained therein and the ciphertext of the data encryption key used to encrypt the data chunks from the metadata of the at least one persistent file; decrypt the ciphertext of the data encryption key used to encrypt each data chunk according to the correspondence between the data chunks and the data shards and the third correspondence to obtain the data encryption key; the processor decrypts the data ciphertext corresponding to the second data according to the data encryption key, When obtaining the second data and sending the second data to the storage service layer adjacent to it, it is specifically used to: decrypt the ciphertext of each data block according to the data encryption key corresponding to each data block to obtain at least one data fragment, each data fragment including multiple data blocks.

[0172] In an optional embodiment, the processor is also used to: update the data encryption key, use the data encryption key before the update to decrypt the user data from the data ciphertext obtained by encrypting the user data, and use the updated data encryption key to re-encrypt the user data to obtain a new data ciphertext; and encrypt the updated data encryption key according to the storage service key provided by the adjacent storage service layer to obtain the ciphertext of the updated data encryption key, and replace the ciphertext of the data encryption key before the update.

[0173] The disclosed embodiment also provides an electronic device, which corresponds to a storage persistence node in a storage persistence layer in a cloud storage system. The implementation structure of the electronic device is the same as or similar to the implementation structure of the electronic device shown in FIG7 , and can be implemented with reference to the structure of the electronic device shown in FIG7 . The difference between the electronic device provided in this embodiment and the electronic device in the embodiment shown in FIG7 mainly lies in that the functions implemented by the processor executing the computer program stored in the memory are different. For the electronic device provided in this embodiment, its processor executes the computer program stored in the memory, which can be used to: receive the user master key provided by the key management node in the user interaction layer in the cloud storage system; generate a data encryption key, and in the process of reading and writing data, encrypt and decrypt the user data according to the data encryption key, and encrypt and decrypt the data encryption key according to the user master key.

[0174] In an optional embodiment, when the processor generates a data encryption key and encrypts and decrypts user data according to the data encryption key during data reading and writing, and encrypts and decrypts the data encryption key according to the user master key, it is specifically used to: when a user writes first data, generate a data encryption key, encrypt the first data according to the data encryption key to obtain a data ciphertext and store it persistently; encrypt the data encryption key according to the user master key to obtain a ciphertext of the data encryption key and store it persistently; when a user reads second data, decrypt the ciphertext of the data encryption key according to the user master key to obtain the data encryption key; decrypt the data ciphertext of the second data according to the data encryption key to obtain the second data, and send the second data to the user's computing node.

[0175] The detailed implementation and beneficial effects of the electronic device provided by the embodiments of the present disclosure have been described in detail in the aforementioned embodiments and will not be elaborated on here.

[0176] Accordingly, an embodiment of the present disclosure further provides a computer-readable storage medium storing a computer program, which, when executed, can implement the steps that can be executed by the electronic device in the method embodiments shown in Figures 5a to 5d above.

[0177] The above-mentioned memory can be implemented by any type of volatile or non-volatile memory device or a combination thereof, such as static random-access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0178] The above-mentioned communication component is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G / LTE, 5G and other mobile communication networks, or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0179] The above-mentioned display includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor can not only sense the boundary of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0180] The power supply assembly provides power to various components of the device in which the power supply assembly is located. The power supply assembly may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply assembly is located.

[0181] The above-mentioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), and when the device where the audio component is located is in an operating mode, such as call mode, recording mode, and voice recognition mode, the microphone is configured to receive external audio signals. The received audio signal can be further stored in a memory or sent via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0182] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present disclosure may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to magnetic disk storage, compact disc read-only memory (CD-ROM), optical storage, etc.) containing computer-usable program code.

[0183] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0184] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0185] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0186] In a typical configuration, a computing device includes one or more processors (Central Processing Unit, CPU), input / output interfaces, network interfaces, and memory.

[0187] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0188] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media such as modulated data signals and carrier waves.

[0189] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0190] The above are merely examples of the present disclosure and are not intended to limit the present disclosure. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure are intended to be included within the scope of the claims of the present disclosure.

Claims

1. A cloud storage system, wherein: include: A user interaction layer, a storage persistence layer, and at least one storage service layer located between the user interaction layer and the storage persistence layer; The user interaction layer includes a key management node, which is used to manage a user master key and provide the user master key to an adjacent storage service layer; The storage service layer includes a storage service node, which is used to generate a storage service key for this layer, and encrypt and decrypt the storage service key for this layer according to the key provided by the previous layer during data reading and writing, and provide the storage service key for this layer to the next layer for the next layer to encrypt and decrypt its key; The storage persistence layer includes a storage persistence node, which is used to generate a data encryption key. During the data reading and writing process, the data encryption key is encrypting and decrypting according to the storage service key provided by the adjacent storage service layer, and the user data is encrypting and decrypting according to the data encryption key.

2. The system according to claim 1, wherein: The storage service node in the storage service layer is specifically used to: generate a storage service key of this layer when a user writes the first data, encrypt the storage service key of this layer according to the key provided by the upper layer, so as to obtain and save the ciphertext of the storage service key of this layer; and sending the first data and the storage service key of the current layer to the next storage service layer or storage persistence layer adjacent thereto, so that the next storage service layer or storage persistence layer adjacent thereto continues to write the first data; The storage persistence node in the storage persistence layer is specifically used to: generate a data encryption key when a user writes first data, encrypt the first data according to the data encryption key to obtain data ciphertext and store it persistently; And according to the storage service key provided by the storage service layer adjacent to it, the data encryption key is encrypted to obtain the ciphertext of the data encryption key and store it persistently.

3. The system according to claim 2, wherein: The storage service node in the storage service layer is specifically used to: when a user reads the second data, decrypt the ciphertext of the storage service key of this layer according to the key provided by the previous layer to obtain the storage service key of this layer; send the identification information of the second data and the storage service key of this layer to the next storage service layer or storage persistence layer adjacent thereto, so that the next storage service layer or storage persistence layer adjacent thereto reads and processes the second data; and receiving the second data returned by the next storage service layer or storage persistence layer adjacent thereto, and returning the second data to the previous storage service layer adjacent thereto or the computing node of the user; The storage persistence node in the storage persistence layer is specifically used to: when a user reads the second data, decrypt the ciphertext of the data encryption key according to the storage service key provided by the adjacent storage service layer to obtain the data encryption key; decrypt the data ciphertext of the second data according to the data encryption key to obtain the second data, and send the second data to the adjacent storage service layer.

4. The system according to any one of claims 1 to 3, wherein: The storage service node in the storage service layer adjacent to the user interaction layer is further used to: when the user master key changes, use the user master key before the change to decrypt the encrypted storage service key of this layer to obtain the storage service key of this layer; And use the changed user master key to re-encrypt the storage service key of this layer; and / or The storage persistence node in the storage persistence layer is also used to: update the data encryption key, decrypt the user data using the data encryption key before the update, and re-encrypt the user data using the updated data encryption key; and encrypt the updated data encryption key according to the storage service key provided by the adjacent storage service layer, and replace the encryption result of the data encryption key before the update.

5. A cloud storage system, wherein: include: User interaction layer and storage persistence layer; The user interaction layer includes a key management node, which is used to manage a user master key and provide the user master key to the storage persistence layer; The storage persistence layer includes a storage persistence node, which is used to generate a data encryption key, and encrypt and decrypt user data according to the data encryption key during data reading and writing, and encrypt and decrypt the data encryption key according to the user master key.

6. A data reading and writing method, wherein: Applicable to a storage service node in at least one storage service layer in a cloud storage system, the method comprising: Generate the storage service key of this layer, and encrypt and decrypt the storage service key of this layer according to the key provided by the previous layer during the data reading and writing process. The storage service key of this layer is the storage service key of the target storage service layer to which the storage service node belongs, and the key provided by the previous layer is the user master key or the storage service key of the previous layer of the target storage service layer; The storage service key of this layer is provided to the next layer, and the next layer is implemented as the next storage service layer adjacent to the target storage service layer or the storage persistence layer in the cloud storage system.

7. The method according to claim 6, wherein: Generate the storage service key of this layer. During the data writing process, encrypt and decrypt the storage service key of this layer according to the key provided by the previous layer, including: When the user writes the first data, a storage service key of the current layer is generated, and a key provided by an upper layer is received, where the upper layer is implemented as a user interaction layer in the cloud storage system, or is implemented as an upper storage service layer adjacent to the target storage service layer; The storage service key of this layer is encrypted according to the key provided by the previous layer and the ciphertext of the storage service key of this layer obtained by encryption is saved, and the first data and the storage service key of this layer are sent to the next layer.

8. The method according to claim 7, wherein: During the data reading process, the storage service key of this layer is encrypted and decrypted according to the key provided by the previous layer, including: When the user reads the second data, the key provided by the previous layer is obtained; Decrypt the ciphertext of the storage service key of this layer according to the key provided by the previous layer to obtain the storage service key of this layer; Sending the identification information of the second data and the storage service key of the current layer to the next layer; and Receive the second data returned by the next adjacent storage service layer or storage persistence layer and send it to the previous layer.

9. The method according to claim 8, wherein: Generate the storage service key for this layer, including: When receiving the data to be stored, dividing the data to be stored into at least one data slice; Generate at least one storage service key for the at least one data shard; wherein the data to be stored is the first data or a data shard sent by the upper storage service layer; The storage service key of this layer is encrypted according to the key provided by the previous layer and the encrypted ciphertext of the storage service key of this layer is saved, including: According to the key corresponding to the data to be stored provided by the upper layer, the at least one storage service key of the current layer is encrypted respectively and the ciphertext of the at least one storage service key of the current layer is saved, and a first corresponding relationship is established among the key corresponding to the data to be stored, the identifier of the at least one data shard and the ciphertext of the at least one storage service key of the current layer; Sending the first data and the storage service key of this layer to the next layer includes: sending the at least one data shard, the at least one storage service key of this layer, and the second corresponding relationship between the at least one data shard and the at least one storage service key of this layer to the next layer.

10. The method according to claim 9, wherein: Decrypt the ciphertext of the storage service key of this layer according to the key provided by the previous layer to obtain the storage service key of this layer, including: According to the key provided by the upper layer, query the first corresponding relationship to obtain the identifier of at least one data shard corresponding to the second data and the ciphertext of at least one storage service key of the current layer; Decrypting the ciphertext of the at least one storage service key of the current layer according to the key provided by the previous layer to obtain the at least one storage service key of the current layer; Sending the identification information of the second data and the storage service key of this layer to the next layer, including: sending the identification information of at least one data shard, the at least one storage service key of this layer, and the third correspondence between the identification information of at least one data shard and the at least one storage service key of this layer to the next layer.

11. The method according to any one of claims 6 to 10, wherein: Also includes: In the event that the user master key changes, the current layer storage service key is decrypted from the ciphertext of the current layer storage service key using the user master key before the change, and the current layer storage service key is re-encrypted using the user master key after the change to obtain a new ciphertext of the current layer storage service key.

12. A data reading and writing method, wherein: Applicable to a storage persistence node in a storage persistence layer in a cloud storage system, the method comprises: Receiving a storage service key provided by a storage service layer adjacent to the storage persistence layer in the cloud storage system; Generate a data encryption key, and encrypt and decrypt user data according to the data encryption key during data reading and writing, and The data encryption key is encrypted and decrypted according to the storage service key provided by the adjacent storage service layer.

13. The method according to claim 12, wherein: Generate a data encryption key, and in the data writing process, encrypt and decrypt the user data according to the data encryption key, and encrypt and decrypt the data encryption key according to the storage service key provided by the storage service layer, including: When the user writes the first data, a data encryption key is generated; encrypting the first data according to the data encryption key and persistently storing the encrypted data ciphertext, and The data encryption key is encrypted according to the storage service key provided by the storage service layer adjacent to it, and the ciphertext of the encrypted data encryption key is saved.

14. The method according to claim 13, wherein: During the data reading process, the user data is encrypted and decrypted according to the data encryption key, and the data encryption key is encrypted and decrypted according to the storage service key provided by the storage service layer, including: When the user reads the second data, receiving a storage service key provided by a storage service layer adjacent to the user; Decrypting the ciphertext of the data encryption key according to the storage service key provided by the storage service layer adjacent to it to obtain the data encryption key; The data ciphertext corresponding to the second data is decrypted according to the data encryption key to obtain the second data, and the second data is sent to the storage service layer adjacent to it.

15. The method according to claim 14, wherein: Generating a data encryption key includes: receiving at least one data shard corresponding to the first data sent by a storage service layer adjacent to the storage service layer, at least one storage service key, and a second corresponding relationship between the at least one data shard and the at least one storage service key; for any data shard, dividing the data shard into a plurality of data chunks, and generating at least one data encryption key for the plurality of data chunks; Encrypting the data encryption key according to the storage service key provided by the storage service layer adjacent to the data encryption key and saving the ciphertext of the encrypted data encryption key, including: for any data shard, according to the second corresponding relationship, using the storage service key corresponding to the data shard, encrypting the at least one data encryption key to obtain the ciphertext of the at least one data encryption key; The first data is encrypted according to the data encryption key and the encrypted data ciphertext is persistently stored, including: according to the at least one data encryption key, the corresponding data block is encrypted, and the ciphertext of the encrypted multiple data blocks is stored in at least one persistent file, and the identification information of the included data blocks and the ciphertext of the data encryption key used to encrypt the data blocks are recorded in the metadata of the at least one persistent file.

16. The method according to claim 15, wherein: Receiving a storage service key provided by a storage service layer adjacent to the storage service layer, including: receiving identification information of at least one data shard, at least one storage service key, and a third correspondence between the identification information of the at least one data shard and the at least one storage service key of the current layer, sent by the storage service layer adjacent to the storage service layer; Decrypting the ciphertext of the data encryption key according to the storage service key provided by the storage service layer adjacent to the data encryption key to obtain the data encryption key, including: determining at least one persistent file according to the corresponding relationship between at least one data shard contained in the second data and at least one persistent file, and obtaining the data encryption key from the at least one persistent file. Obtain identification information of the data chunks contained in the file and ciphertext of the data encryption key used to encrypt the data chunks from the metadata of the file; decrypt the ciphertext of the data encryption key used to encrypt each data chunk using at least one storage service key according to the correspondence between the data chunks and the data shards and the third correspondence, to obtain the data encryption key; The data ciphertext corresponding to the second data is decrypted according to the data encryption key to obtain the second data, and the second data is sent to the storage service layer adjacent to it, including: decrypting the ciphertext of each data block according to the data encryption key corresponding to each data block to obtain at least one data shard, each data shard includes multiple data blocks.

17. The method according to any one of claims 12 to 16, wherein: Also includes: Updating the data encryption key, decrypting the user data from the data ciphertext obtained by encrypting the user data using the data encryption key before the update, and re-encrypting the user data using the updated data encryption key to obtain a new data ciphertext; as well as The updated data encryption key is encrypted according to the storage service key provided by the adjacent storage service layer to obtain the ciphertext of the updated data encryption key, and replace the ciphertext of the data encryption key before the update.

18. A method for reading and writing data, wherein: Applicable to storage persistence nodes in cloud storage systems, including: Receiving a user master key provided by a key management node in a user interaction layer of the cloud storage system; Generate a data encryption key, and encrypt and decrypt user data according to the data encryption key during the data reading and writing process; The data encryption key is encrypted and decrypted according to the user master key.

19. An electronic device, wherein: include: Memory and processor; The memory is used to store computer programs; The processor, coupled to the memory, is configured to execute the computer program to implement the steps in the method of any one of claims 6 to 11, claims 12 to 17, and claim 18.

20. A computer-readable storage medium storing a computer program, wherein: When the computer program is executed by a processor, the processor is caused to implement the steps of the method as claimed in any one of claims 6 to 11, claims 12 to 17 and claim 18.

21. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps in the method as claimed in any one of claims 6 to 11, claims 12 to 17 and claim 18 are implemented.

Images