CN103795780A - Cloud storage data protection method and device - Google Patents

Abstract

The present invention is applicable to the technical field of information security, and provides a cloud storage data protection method and device, including: receiving a public key issued by a cloud server, and the public key issued by the cloud server is uniquely corresponding to the user account logged in to the client ; Upload original data to the cloud server, so that the cloud server utilizes a pre-stored private key to encrypt the original data, generate encrypted data and save it, and the pre-stored private key is issued with the cloud server corresponding to the public key; the original data is acquired from the cloud server by using the public key issued by the cloud server. In the present invention, even if the data stored in the cloud is leaked, it is difficult for a third party to obtain the real data, thereby ensuring the security of the cloud storage data and the information security of the cloud server user.

Description

Cloud storage data protection method and device

technical field

The invention belongs to the technical field of information security, and in particular relates to a method and device for protecting cloud storage data.

Background technique

Cloud storage is a new concept extended and developed from the concept of cloud computing. It refers to the collection of a large number of different types of storage devices in the network through application software through functions such as cluster applications, grid technology, or distributed file systems. Work together to jointly provide a system of data storage and business access functions. When the core of cloud computing system computing and processing is the storage and management of large amounts of data, a large number of storage devices need to be configured in the cloud computing system, then the cloud computing system will be transformed into a cloud storage system, so cloud storage is a data storage and management as the core cloud computing system.

Compared with the traditional method of storing data locally, cloud storage can better ensure data security and save local storage space. Therefore, more and more users start to use cloud storage to back up data. Cloud server users get a certain amount of cloud storage space. After logging in to the cloud server, they can upload the files on the mobile phone or computer to the cloud server for storage, and can download from the cloud server when needed. However, the existing cloud servers store the files uploaded by users in plain text. Once the data of the cloud server is leaked, the data in plain text is likely to be obtained and used by others, which poses a great threat to the information security of users. .

Contents of the invention

The purpose of the embodiments of the present invention is to provide a method for protecting cloud storage data, which solves the problem that the existing cloud storage data is stored in plain text, resulting in that the security of the cloud storage data cannot be guaranteed.

The embodiment of the present invention is achieved in this way, a method for protecting cloud storage data, comprising:

Receive the public key issued by the cloud server, the public key issued by the cloud server is uniquely corresponding to the user account logged into the client;

Upload the original data to the cloud server, so that the cloud server uses the pre-stored private key to encrypt the original data, generate encrypted data and save it, and the pre-stored private key is the same as the one issued by the cloud server The public key corresponds to;

The original data is obtained from the cloud server by using the public key issued by the cloud server.

Another object of the embodiments of the present invention is to provide a method for protecting cloud storage data, including:

issuing a public key to the client, the public key uniquely corresponding to the user account logged into the client;

receiving the original data uploaded by the client;

The original data is encrypted by using a pre-stored private key, and encrypted data is generated and saved, and the pre-stored private key corresponds to the public key issued by the cloud server.

Another object of the embodiments of the present invention is to provide a protection device for cloud storage data, including:

The public key receiving unit is used to receive the public key issued by the cloud server, and the public key issued by the cloud server is uniquely corresponding to the user account logged into the client;

an uploading unit, configured to upload original data to the cloud server, so that the cloud server encrypts the original data with a pre-stored private key, generates and stores encrypted data, and the pre-stored private key is the same as the The public key issued by the cloud server corresponds to;

An obtaining unit, configured to obtain the original data from the cloud server by using the public key issued by the cloud server.

Another object of the embodiments of the present invention is to provide a protection device for cloud storage data, including:

An issuing unit, configured to issue a public key to the client, the public key uniquely corresponding to the user account logged into the client;

a data receiving unit, configured to receive the original data uploaded by the client;

An encryption storage unit, configured to encrypt the original data with a pre-stored private key corresponding to the public key issued by the cloud server, generate and store encrypted data.

In the embodiment of the present invention, for the data stored in the cloud, the cloud server adopts an asymmetric encryption method to encrypt this part of data from plaintext into ciphertext before storing, and the cloud server saves the private key, and the client saves the corresponding Public key, so that even if the data stored in the cloud is leaked, it is difficult for a third party to obtain the real data, thereby ensuring the security of cloud storage data and the information security of cloud server users.

Description of drawings

Fig. 1 is the implementation flowchart of the cloud storage data protection method client provided by the embodiment of the present invention;

Fig. 2 is a specific implementation flowchart of the cloud storage data protection method client S103 provided by the embodiment of the present invention;

Fig. 3 is a specific implementation flowchart of the cloud storage data protection method client S103 provided by another embodiment of the present invention;

FIG. 4 is a flow chart of implementing a cloud storage data protection method server provided by an embodiment of the present invention;

Fig. 5 is a flow chart of implementing a cloud storage data protection method server provided by another embodiment of the present invention;

Fig. 6 is a structural block diagram of a device for protecting cloud storage data provided by an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

In the embodiment of the present invention, for the data stored in the cloud, the cloud server adopts an asymmetric encryption method to encrypt this part of data from plaintext into ciphertext before storing, and the cloud server saves the private key, and the client saves the corresponding Public key, so that even if the data stored in the cloud is leaked, it is difficult for a third party to obtain the real data, thereby ensuring the security of cloud storage data and the information security of cloud server users.

Fig. 1 shows the implementation process of the cloud storage data protection method provided by the embodiment of the present invention. In this embodiment, the execution subject of the process is the client corresponding to the cloud server. In the process of data backup, the user must first register in the cloud server through the client to register as a user of the cloud server. After the registration is successful, the cloud server will allocate a user account to the user, and at the same time allocate a certain amount of storage space to the user account. After logging in to the user account on the client, the user performs operations to select locally the files that need to be backed up. Various types of files such as video, audio, and pictures, and based on the communication between the client and the cloud server, the function of uploading the selected file to the cloud server can be realized.

The specific implementation process of Figure 1 is described in detail as follows:

In S101, a public key delivered by the cloud server is received, and the public key delivered by the cloud server uniquely corresponds to a user account logged in to the client.

Since the cloud server adopts asymmetric encryption, that is, public-private key encryption, in the encryption process, the public key and the private key are a key pair, the private key is used for encryption, and the public key is used for decryption. Therefore, in this embodiment , in order to avoid the common use of a public-private key pair by different user accounts, thereby causing potential security risks of data leakage between different user accounts, the public key assigned by the cloud server is uniquely corresponding to the user account logged in to the client. At the same time, the public key is sent to the client by the cloud server for storage, but the public key is not stored in the cloud server, thus effectively avoiding the leakage of public and private key pairs due to information leakage of the cloud server. When the situation arises, the security of cloud storage data is effectively guaranteed.

In this embodiment, the distribution of the public key can be assigned to the user account by the cloud server during the registration process, or it can be assigned to the user account of the login client in real time when the client needs to upload data to the cloud server. Before obtaining the public key, the cloud server needs to generate a public-private key pair containing the public key in advance, and save the private key in the cloud server locally.

In S102, upload the original data to the cloud server, so that the cloud server encrypts the original data with a pre-stored private key, generates encrypted data and saves it, and the pre-stored private key and the cloud The corresponding public key issued by the server.

In S102, the client uploads the original data that needs to be stored in the cloud to the cloud server, so that the cloud server encrypts the original data with the private key corresponding to the public key assigned to the user account that logs in to the client, thereby generating encrypted data. data and stored in the cloud server. The processing process of the original data by the cloud server will be described in detail in subsequent embodiments, and will not be repeated here.

In S103, the original data is acquired from the cloud server by using the public key issued by the cloud server.

In this embodiment, after the client has backed up data on the cloud server, it can use the public key issued by the cloud server to obtain the original data from the cloud server, wherein the methods of obtaining include online viewing and downloading.

For online viewing of raw data, as an embodiment of the present invention, as shown in Figure 2, S103 is specifically:

In S201, an online viewing request is sent to the cloud server, the online viewing request carries the public key issued by the cloud server, so that the cloud server decrypts the confidential data according to the public key, restores and The raw data are presented online.

In this embodiment, after the user logs in the user account assigned by the cloud server at the client, he can remotely access the cloud server through the web page provided by the client, initiate an online viewing request, and request to upload it to the cloud server for backup. The data. Wherein, the online viewing refers to that the backup data can only be viewed on the cloud server side, and the backup data cannot be edited or downloaded to the client. Therefore, online viewing can prevent data from being modified or downloaded data breach.

In this embodiment, the online viewing request sent by the client carries the public key assigned by the cloud server to the currently logged-in user account. After receiving the public key, the cloud server uses the unique correspondence between the public key and the user account to Find the ciphertext of the data backed up by the user account, and use the public key to decrypt the ciphertext, thereby restoring the original data, and display the original data online.

Since the cloud server needs to decrypt the public key uploaded by the client, and the public key uploaded by the client is uniquely corresponding to the user account currently logged into the client, only the party who actually uploaded the encrypted data can decrypt the encrypted data Only with the correct public key can the cloud server successfully decrypt the encrypted data. Therefore, the online viewing method of this embodiment can effectively prevent other user accounts from viewing the original data of the user account.

In S202, the original data displayed by the cloud server is viewed online.

In this embodiment, after the cloud server restores and displays the original data online, the client can remotely access the cloud server and view the original data online.

Further, on the basis of the embodiment shown in FIG. 2 , after the client cancels the online viewing of the data uploaded by the client, the cloud server deletes the data uploaded by the client for online viewing in the cache. The data.

In this embodiment, for the backup data viewed remotely online by the client, a cache file will be generated in the cloud server during the online viewing process, in order to prevent criminals from extracting this part from the cache file of the cloud server in the subsequent process Plaintext data leads to backup data leakage. In this embodiment, when it is detected that the client exits remote viewing, the cloud server will delete this part of plaintext data in the cache, thereby further ensuring the security of cloud storage data.

For downloading raw data, as an embodiment of the present invention, as shown in Figure 3, S103 is specifically:

In S301, a download request is sent to the cloud server.

In this embodiment, the user can remotely access the cloud server through the web page provided by the client after logging into the user account assigned by the cloud server at the client, initiate a data download request, and request to download the data uploaded to the cloud server for backup. data. After the client completes the data download, it can further modify the data.

In S302, receive the encrypted data returned by the cloud server according to the download request.

In this embodiment, after receiving the data download request sent by the client, the cloud server finds the encrypted data corresponding to the user account according to the user account logged into the client, and returns it to the client.

In S303, the encrypted data is decrypted according to the public key issued by the cloud server, and the original data is restored.

In this embodiment, after receiving the encrypted data returned by the cloud server, the client decrypts the encrypted data using the public key delivered by the cloud server, thereby restoring the original data.

In the download process described in the embodiment in Figure 3, the entire process of data transmission from the cloud server to the client exists in the form of ciphertext, and only after the data is downloaded to the client can the client send the data according to the cloud server. The key can be decrypted by itself, therefore, it can effectively prevent the data from being leaked during the transmission process and guarantee the user's information security.

Fig. 4 shows the implementation process of the cloud storage data protection method provided by the embodiment of the present invention. In this embodiment, the execution subject of the process is the cloud server, which executes the same as that described in the embodiment of Fig. 1 to Fig. 3 The operation of the cloud server corresponds to the operation of the client. Therefore, the same implementation principle will not be described one by one in this embodiment. The specific implementation process of Figure 4 is described in detail as follows:

In S401, a public key is issued to the client, and the public key is uniquely corresponding to a user account logged into the client.

In this embodiment, the distribution of the public key can be assigned to the user account by the cloud server during the registration process, or it can be assigned to the user account of the login client in real time when the client needs to upload data to the cloud server. Before obtaining the public key, the cloud server needs to generate a public-private key pair containing the public key in advance, and save the private key in the cloud server locally.

In S402, the original data uploaded by the client is received.

In S403, the original data is encrypted by using a pre-stored private key corresponding to the public key delivered by the cloud server to generate and store encrypted data.

In this embodiment, the client uploads the original data that needs to be stored in the cloud to the cloud server. The data is encrypted, thereby generating encrypted data and saving it in the cloud server.

In this embodiment, the data saving operation is performed only after the cloud server obtains the ciphertext of the data through encryption. Thus, the data uploaded by the user to the cloud server for backup is stored in the cloud in the form of ciphertext. Even if the cloud storage data is leaked, it is difficult for a third party to obtain the real user backup data, thereby ensuring the security of cloud storage data and the information security of cloud server users.

In this embodiment, after the client has backed up data on the cloud server, it can use the public key issued by the cloud server to obtain the original data from the cloud server, wherein the methods of obtaining include online viewing and downloading.

For online viewing of raw data, as an embodiment of the present invention, as shown in Figure 5, on the basis of the embodiment shown in Figure 4, the method also includes:

S404. Receive an online viewing request sent by the client, where the online viewing request carries the public key delivered by the cloud server.

S405. Extract the public key delivered by the cloud server carried in the online viewing request.

S406. Decrypt the confidential data according to the extracted public key, and restore the original data.

S407. Display the original data online, so that the client can view the original data online.

In this embodiment, the online viewing request sent by the client carries the public key assigned by the cloud server to the currently logged-in user account. After receiving the online viewing request, the cloud server extracts the public key carried in it, and uses the public key According to the unique correspondence between the key and the user account, find the ciphertext of the data backed up by the user account, and use the public key to decrypt the ciphertext, thereby restoring the original data and displaying the original data online.

Since the cloud server needs to decrypt the public key uploaded by the client, and the public key uploaded by the client is uniquely corresponding to the user account currently logged into the client, only the party who actually uploaded the encrypted data can decrypt the encrypted data Only with the correct public key can the cloud server successfully decrypt the encrypted data. Therefore, the online viewing method of this embodiment can effectively prevent other user accounts from viewing the original data of the user account.

In this embodiment, for the backup data viewed remotely online by the client, a cache file will be generated in the cloud server during the online viewing process, in order to prevent criminals from extracting this part from the cache file of the cloud server in the subsequent process Plaintext data leads to backup data leakage. In this embodiment, when it is detected that the client exits remote viewing, the cloud server will delete this part of plaintext data in the cache, thereby further ensuring the security of cloud storage data.

For downloading original data, in this embodiment, after the user logs in the user account assigned by the cloud server at the client, he can remotely access the cloud server through the web page provided by the client, initiate a data download request, and request to download the uploaded data. Data backed up to the cloud server. After the client completes the data download, it can further modify the data. After receiving the data download request sent by the client, the cloud server finds the encrypted data corresponding to the user account according to the user account logged into the client, and returns to the client. Since the entire process of data transmission from the cloud server to the client exists in the form of ciphertext, only after it is downloaded to the client, the client can decrypt it by itself according to the key issued by the cloud server. Therefore, it can effectively Prevent data from being leaked during transmission and ensure user information security.

Fig. 6 shows a structural block diagram of a device for protecting cloud storage data provided by an embodiment of the present invention. The devices are respectively located in the client and the cloud server, and are used to run the embodiments of the present invention shown in Fig. 1 to Fig. 3 and Fig. 4 of the present invention respectively. and the method for protecting cloud storage data shown in the embodiment of FIG. 5 . For ease of description, only the parts related to this embodiment are shown.

Referring to Figure 6, in the client, it includes:

The public key receiving unit 61 receives the public key issued by the cloud server, and the public key issued by the cloud server is uniquely corresponding to the user account logged into the client.

Upload unit 62, uploading original data to the cloud server, so that the cloud server encrypts the original data with a pre-stored private key, generates encrypted data and saves it, and the pre-stored private key is shared with the cloud The corresponding public key issued by the server.

The obtaining unit 63 obtains the original data from the cloud server by using the public key issued by the cloud server.

Optionally, the acquisition unit 63 includes:

The online viewing request sending subunit sends an online viewing request to the cloud server, and the online viewing request carries the public key issued by the cloud server, so that the cloud server can decrypt the confidential data according to the public key , restore and display the original data online.

View subunits online, and view the raw data displayed by the cloud server online.

Optionally, the acquiring unit 63 includes:

The download request sending subunit sends a download request to the cloud server;

a data receiving subunit, configured to receive the encrypted data returned by the cloud server according to the download request;

The restoration sub-unit decrypts the encrypted data according to the public key issued by the cloud server, and restores the original data.

In the cloud server, the device includes:

The issuing unit 64 is configured to issue a public key to the client, where the public key uniquely corresponds to the user account that logs in to the client.

The data receiving unit 65 is configured to receive the original data uploaded by the client.

The encryption storage unit 66 encrypts the original data with a pre-stored private key corresponding to the public key issued by the cloud server to generate and store encrypted data.

Optionally, the device also includes:

The online viewing request receiving unit receives the online viewing request sent by the client, and the online viewing request carries the public key issued by the cloud server.

An extraction unit, configured to extract the public key issued by the cloud server carried in the online viewing request.

The restoration unit decrypts the confidential data according to the extracted public key, and restores the original data.

The online display unit is configured to display the original data online, so that the client can view the original data online.

In the embodiment of the present invention, for the data stored in the cloud, the cloud server adopts an asymmetric encryption method to encrypt this part of data from plaintext into ciphertext before storing, and the cloud server saves the private key, and the client saves the corresponding Public key, so that even if the data stored in the cloud is leaked, it is difficult for a third party to obtain the real data, thereby ensuring the security of cloud storage data and the information security of cloud server users.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. within range.

Claims (10)

1. a guard method for cloud storage data, is characterized in that, comprising:

Receive the PKI that Cloud Server issues, the PKI that described Cloud Server issues is unique corresponding with the user account of login client;

Upload initial data to described Cloud Server, so that described Cloud Server utilizes the private key of pre-stored to be encrypted described initial data, generate enciphered data and preserve, the described PKI that the private key of described pre-stored issues with described Cloud Server is corresponding;

Utilize the PKI that described Cloud Server issues to get described initial data from described Cloud Server.

2. the method for claim 1, is characterized in that, describedly utilizes PKI that described Cloud Server issues to get described initial data from described Cloud Server to comprise:

Send and check online request to described Cloud Server, described checking online in request carried the PKI that described Cloud Server issues, so that described Cloud Server is deciphered described private data according to this PKI, reduction also shows described initial data online;

Check online the described initial data that described Cloud Server is shown.

3. the method for claim 1, is characterized in that, describedly utilizes PKI that described Cloud Server issues to get described initial data from described Cloud Server to comprise:

Send download request to described Cloud Server;

Receive the described enciphered data that described Cloud Server returns according to described download request;

The PKI issuing according to described Cloud Server is decrypted described enciphered data, restores described initial data.

4. a guard method for cloud storage data, is characterized in that, comprising:

Issue PKI to client, described PKI is unique corresponding with the user account of the described client of login;

Receive the initial data of described client upload;

Utilize the private key of pre-stored to be encrypted described initial data, generate enciphered data and preserve, the described PKI that the private key of described pre-stored issues with described Cloud Server is corresponding.

5. method as claimed in claim 4, is characterized in that, described method also comprises:

Receive the request of checking online that described client sends, described checking online carried the PKI that described Cloud Server issues in request;

Extract the described PKI of checking that online the described Cloud Server that carries in request issues;

Decipher described private data according to the PKI extracting, restore described initial data;

The described initial data of online displaying, so that described client is checked described initial data online.

6. a protective device for cloud storage data, is characterized in that, comprising:

PKI receiving element, the PKI issuing for receiving Cloud Server, the PKI that described Cloud Server issues is unique corresponding with the user account of login client;

Uploading unit, for uploading initial data to described Cloud Server, so that described Cloud Server utilizes the private key of pre-stored to be encrypted described initial data, generate enciphered data and preserve, the described PKI that the private key of described pre-stored issues with described Cloud Server is corresponding;

Acquiring unit, for utilizing the PKI that described Cloud Server issues to get described initial data from described Cloud Server.

7. device as claimed in claim 6, is characterized in that, described acquiring unit comprises:

The request of checking online sends subelement, for sending to described Cloud Server the request of checking online, described checking online in request carried the PKI that described Cloud Server issues, so that described Cloud Server is deciphered described private data according to this PKI, reduction also shows described initial data online;

Check online subelement, for the described initial data of checking that online described Cloud Server is shown.

8. device as claimed in claim 6, is characterized in that, described acquiring unit comprises:

Download request sends subelement, for sending download request to described Cloud Server;

Data receiver subelement, the described enciphered data of returning according to described download request for receiving described Cloud Server;

Also atomic unit, is decrypted described enciphered data for the PKI issuing according to described Cloud Server, restores described initial data.

9. a protective device for cloud storage data, is characterized in that, comprising:

Issue unit, for issuing PKI to client, described PKI is unique corresponding with the user account of the described client of login;

Data receiver unit, for receiving the initial data of described client upload;

Encrypting storing unit, is encrypted described initial data for the private key that utilizes pre-stored, generates enciphered data and preserves, and the described PKI that the private key of described pre-stored issues with described Cloud Server is corresponding.

10. device as claimed in claim 9, is characterized in that, described device also comprises:

Check online request reception unit, the request of checking online sending for receiving described client, described checking online carried the PKI that described Cloud Server issues in request;

Extraction unit, the PKI issuing for extracting the described described Cloud Server of checking that online request is carried;

Reduction unit, for deciphering described private data according to the PKI extracting, restores described initial data;

Online display unit, for the described initial data of online displaying, so that described client is checked described initial data online.

Images