CN103973698A - User access right revoking method in cloud storage environment - Google Patents
User access right revoking method in cloud storage environment Download PDFInfo
- Publication number
- CN103973698A CN103973698A CN201410213922.0A CN201410213922A CN103973698A CN 103973698 A CN103973698 A CN 103973698A CN 201410213922 A CN201410213922 A CN 201410213922A CN 103973698 A CN103973698 A CN 103973698A
- Authority
- CN
- China
- Prior art keywords
- data
- user
- token
- client
- request
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Landscapes
- Storage Device Security (AREA)
Abstract
The invention discloses a user access right revoking method in a cloud storage environment. The method solves the problems that in an existing cloud environment, when user right is revoked, potential safety hazards are caused, and performance expenditure is caused by data re-encryption. The method involves a client side process, a cloud storage system process and a safety management center process, wherein a cloud storage system achieves token chain management updating and notifies a safety management center of distribution of secret keys and tokens, and ciphertext is placed in an interference block to be processed, and a user access request is judged and replied; the safety management center achieves user registration and logging, right giving and revoking, secret key management and distribution and user token distribution. According to the user access right revoking method, interference processing on the ciphertext is achieved through a token mechanism, and an immediate revoking mechanism is adopted; when the user right is revoked, the token is updated immediately, the ciphertext is subjected to re-interference processing, and the potential safety hazards caused when the user right is revoked in a non-immediate revoking mechanism are avoided. According to the method, data do not need to be subjected to re-encryption processing, and performance expenditure of a system is greatly reduced.
Description
Technical field
The invention belongs to computer memory technical and field of information security technology, more specifically, relate to the access privilege recovery method in a kind of cloud storage environment.
Background technology
Cloud storage system is when providing data storage and business service for user, the fail safe of its high in the clouds data is the major issue that user and company manager particularly pay close attention to always.For ensureing the privacy of user data, current cloud storage security framework is generally that data are encrypted to storage, cloud service provider judges with corresponding access control policy whether user has legal access rights to these data, and the management of key and distribution are responsible for by trusted third party.Although this has strengthened the fail safe of high in the clouds data to a certain extent, the form of ciphertext storage also can cause new problem.In the time need to changing user to the access rights of certain data, in order to guarantee to reclaim the user of authority, to hold the key of these data invalid, and general scheme is that these data are carried out to re-encryption processing, then carries out the renewal of key and distribution again.Because userbase in cloud environment is huge and user right may frequently change, the heavily distribution of the re-encryption of data and key will bring great performance cost.If carried out when re-encryption is placed on to user's uploading data, because user carries out the uploading data operating time, be uncertain, it is also uncertain causing re-encryption opportunity of data, and the user who has been recovered authority during this still can access these data, may occur reclaiming authority user and dislike intentional system and write dirty data, this scheme cannot solve the re-encryption problem of read-only data in addition.
Summary of the invention
Above defect or Improvement requirement for prior art, the invention provides the access privilege recovery method in a kind of cloud storage environment, its object is, by high in the clouds based on the random processing of throwing of ciphertext, to realize the recovery immediately of user right, to solve the potential safety hazard causing when existing user right reclaims and data are carried out to the technical problem that re-encryption causes very big performance cost.
For achieving the above object, according to one aspect of the present invention, provide the access privilege recovery method in a kind of cloud storage environment, comprised the following steps:
(1) client is from user's data operation request, and judge this request type, read data request or limiting operation request, if write data requests, proceed to step (2), if read data request proceeds to step (6), if limiting operation request proceeds to step (11);
(2) the random symmetric key generating for data corresponding to write data requests are encrypted of client, and submit encryption key requests to security management center;
(3) security management center is determined this user's legitimacy according to encryption key requests, and judge whether validated user reclaims in list in the corresponding authority of data corresponding to write data requests, if do not obtaining encryption key corresponding to these data, and this encryption key returned to client;
(4) client is utilized the symmetric key generating in step (2), utilize symmetric encipherment algorithm to encrypt data corresponding to write data requests, to obtain encrypt data, the encryption key that utilization receives and public personal key algorithm are encrypted the symmetric key generating, to obtain ciphertext key, encrypt data and ciphertext key are packaged as to encrypt data bag, and send write data requests to cloud storage end;
(5) cloud storage termination is received the write data requests from client, according to this write data requests, determine this user's legitimacy, and generate a token at random when legal user has write access authority to data corresponding to write data requests, and using this token the last-of-chain token of the corresponding token chain of the data in write data requests, random generation disturbed piece and according to the rule of formulating in token, to disturb piece to insert encrypt data, and preserve the data that obtain;
(6) client is sent read data request to cloud storage end;
(7) cloud storage end is according to determine this user's legitimacy from the user identity certificate in the read data request of client, and when legal user has the read access authority to these data, these data are returned to client, search the last-of-chain token in token chain corresponding to these data, to security management center, send key request;
(8) security management center judges according to this key request whether user reclaims in list in the corresponding authority of data corresponding to read data request, if not at the corresponding decruption key of search request data, and decruption key, token are returned to client, then enter step (9), if exist, to client, return to client denial of service information, then process finishes;
(9) client awaits receive cloud storage end and information that security management center returns, if data message and security management center return information that cloud storage end return information is request are decruption key and token, go to step (10), else process finishes;
(10) token that client utilization is returned is processed the data of returning, reject the interference piece in data, obtain encrypt data, ciphertext key in the decruption key deciphering return data that utilization is returned obtains symmetric key, and utilize symmetric key decrypting ciphertext data, to obtain user, ask initial data;
(11) client is sent user right to security management center and is reclaimed request;
(12) whether security management center reclaims requests verification user identity certificate according to client user's authority, legal to judge user, if legal, goes to step (13), otherwise returns to user identity certificate error message to client, and then process finishes;
(13) whether the user of security management center judgement recovery authority reclaims in the corresponding authority recovery of request corresponding data ID list at this user right, if user does not reclaim in list in authority, the user ID that reclaims authority is inserted to authority and reclaim list, to cloud storage end, send user right and reclaim request, and to client, return to user right and reclaim successful information, then proceed to step (14); If user reclaims in list in authority, to client, return to this user and in authority, reclaim information in list;
(14) cloud storage end reclaims and asks to search the wherein corresponding token chain of data ID according to user right, and obtain last-of-chain token, utilize the last-of-chain token obtaining to reject the interference piece in the corresponding data of data ID, obtain disturbing without crossing the encrypt data of processing, utilize token create-rule, random generation one is new token, and added token chain, as new last-of-chain token, random generation disturbed piece and according to the rule of formulating in new token, to disturb piece to insert the encrypt data obtaining, obtain and preserve new interfering data, and return to client user's authority and reclaim successful information.
Preferably, encryption key requests comprises user identity certificate and data corresponding to write data requests No. ID, write data requests comprises the metadata of the data that encrypt data, ciphertext key, the write data requests after user identity certificate, packing is corresponding, read data request comprises the ID of user identity certificate and data corresponding to read data request, and the user right request of reclaiming comprises that user identity certificate, user right reclaim the ID of data corresponding to request and reclaim the user ID of authority.
Preferably, step (3) comprises following sub-step:
(3-1) security management center judges that according to the user identity certificate in encryption key requests whether user is legal, if legal, proceed to step (3-2), otherwise returns to request failure information to user, and then process finishes;
(3-2) security management center judges whether this user reclaims in list in the corresponding authority of data corresponding to write data requests, if ask failure information returning to user, otherwise proceed to step (3-3), if wherein permissions list does not exist and represents that user is in authority reclaims list;
(3-3) security management center is searched and whether can in local cipher key store, be found encryption key corresponding to these data, proceeds to step (3-4), otherwise proceed to step (3-5) if find;
(3-4) security management center returns to client by the encryption key finding, and then enters step (4);
(3-5) security management center is according to these data and utilize public and private key encryption mechanism to generate at random and preserve encryption key, and the encryption key of generation is returned to client, then enters step (4).
Preferably, also comprise step: client, after the encryption key receiving from security management center, sends correct reception to security management center and replys,
Preferably, step (5) comprises following sub-step:
(5-1) cloud storage termination is received the write data requests from client, identifying user identity certificate, and whether legal to judge user, if not rule is returned to user identity certificate error message, then process finishes; If legal, go to step (5-2);
(5-2) cloud storage end judges whether user has the write access authority to data corresponding to write data requests, if do not have authority to return to user without write access authority information, then process finishes, if there is write access authority, goes to step (5-3);
(5-3) token of the random generation of cloud storage end, and using this token the last-of-chain token of the corresponding token chain of the data in write data requests, random generation disturbed piece and according to the rule of formulating in token, to disturb piece to insert encrypt data, the data that preservation obtains, and return to user written data successful information to client.
Preferably, step (7) comprises following sub-step:
(7-1) cloud storage end, according to judging that from the user identity certificate in the read data request of client whether user is legal, if legal, goes to step (7-2), otherwise returns to user identity certificate error message to client, and then process finishes;
(7-2) cloud storage end judges whether data corresponding to read data request exist, if exist, goes to step (7-3), otherwise return to request msg to client, does not have information, and then process finishes;
(7-3) cloud storage end judges whether user has the read access authority to these data, if have these data returned to client, search the last-of-chain token in token chain corresponding to these data, to security management center, send key request, this request comprises ID, last-of-chain token, the user identity certificate of data; Otherwise return to user without read access authority information to client.
In general, the above technical scheme of conceiving by the present invention compared with prior art, can obtain following beneficial effect:
(1) can realize the recovery immediately of user right, avoid because user right reclaims the potential safety hazard that may occur, as in non-reclaim mechanism immediately, reclaim the user of authority because it still meets access control condition, still can conduct interviews to data, even can carry out the dirty data of writing of malice; Secondly, the uncertainty of user right recovery time, can cause the security breaches of system; In addition non-reclaim mechanism immediately cannot solve read-only data re-encryption problem;
(2) in traditional user right reclaim mechanism, inevitably need to carry out re-encryption operation, make the old key that reclaims authority user lose efficacy to avoid it to utilize old secret key decryption ciphertext to obtain up-to-date data.And the interference piece processing method that the present invention proposes, only need to be to the rule of formulating in the random token generating of the encrypt data utilization of high in the clouds storage, reinsert interference piece, for reclaiming authority user owing to cannot obtaining up-to-date token, even if therefore have old key, also cannot decipher and obtain initial data.Due to the performance bottleneck of cryptographic algorithm, so re-encryption tends to bring great performance cost, and the present invention utilizes the interference again of encrypt data to process, and the re-encryption problem while avoiding user right to reclaim has reduced the performance cost of system greatly;
(3) the present invention supports write data requests completely, user written data request of the present invention and now generally write data flow difference and be that cloud storage end data has increased by a step while preserving, utilize token uploading data to be inserted to the processing of disturbing piece, in like manner the present invention supports other access request of data of user too, as requests such as deletion, movement, renames.
(4) applicability of the present invention is wide, be not limited to cloud environment system, due to the create-rule of token, the interference processing of encrypt data and cloud storage system all do not have positive connection, the system that therefore exists user right to reclaim for any one, the present invention will be suitable for.
Accompanying drawing explanation
Fig. 1 is schematic flow sheet of the present invention.
Fig. 2 is client process schematic diagram.
Fig. 3 is cloud storage end process schematic diagram.
Fig. 4 is token structural representation.
Fig. 5 is token chain structural representation.
Fig. 6 is for disturbing block structure schematic diagram.
Fig. 7 processes schematic diagram for encrypt data is disturbed.
Fig. 8 is security management center process schematic diagram.
Fig. 9 is user's login and read access data time sequence figure.
Figure 10 is user's login and write access data time sequence figure.
Figure 11 is for user's login and reclaim user right sequential chart.
Embodiment
In order to make object of the present invention, technical scheme and advantage clearer, below in conjunction with drawings and Examples, the present invention is further elaborated.Should be appreciated that specific embodiment described herein, only in order to explain the present invention, is not intended to limit the present invention.In addition,, in each execution mode of described the present invention, involved technical characterictic just can not combine mutually as long as do not form each other conflict.
Below first with regard to technical term of the present invention, be explained and illustrated:
Original: refer to unencrypted file;
Letter of identity: a kind of data structure that indicates user identity feature, judges for user identity judgement and access control whether user has access rights;
Symmetric Cryptography: encryption and decryption adopt identical key, deciphering is the inverse operation of encrypting;
Symmetric key: the random binary data generating, for original is encrypted or deciphering;
Encrypt file: use symmetric key original to be adopted to the file obtaining after symmetric key cipher encryption mechanism;
Completeness check key: the random binary data generating, for encrypt file is encrypted;
Signature file: use integrality check key, adopt hash function encrypt file to be encrypted to the binary data obtaining;
Authority reclaims list: record reclaims the user totem information of authority;
Disturb piece: the binary data blocks that can customize length;
Token: record inserts the data structure of the essential information of interference pieces all in encrypt file, inserts or rejects interference piece for encrypt file;
Token chain: the chain structure being formed by token, the token of its medium chain token below before can deriving, and token before cannot be derived token below;
Below in conjunction with embodiment and accompanying drawing, the present invention is further described.
As shown in Figure 1, the present invention includes client process, cloud storage system process and security management center process, operate in respectively on client host, certification end main frame and the cloud storage system main frame of distributed file system.Three module cooperative operations, wherein client realizes various accessing operation requests, comprise login system, read access request of data, write data upload and reclaim user right, in client, during read access data, first by the token receiving from security management center, reject the interference piece cloud storage system return data, recover ciphertext, then utilize key to be decrypted and obtain initial data; Write access is enciphered data, and ciphertext is uploaded; Cloud storage system is realized token chain management update, and notice security management center distributed key, token are inserted and disturbed piece to process and user access request judgement reply ciphertext; Security management center is realized user's registration, login, and authority is authorized, reclaimed, key management and distribution, and User Token distribution.
The encrypt data that the present invention adopts token chain mechanism to upload user disturbs processing, even if therefore user has decruption key, when not obtaining corresponding token, user cannot recover encrypt data, therefore cannot obtain initial data by decrypting ciphertext, thus the re-encryption operation of necessity while having avoided user right to reclaim.
Token is a data structure that comprises the generation of interference piece and insert ciphertext rule, and processing can be disturbed to ciphertext by token in high in the clouds; User can reject the interference piece in the data of disturbing after processing by token, thereby recovers encrypt data.Token chain, the chain structure being formed by token, its medium chain token below can be released previous token, and token before cannot be released token below, wherein last-of-chain token is high in the clouds for disturbing the crucial token of processing encrypt data, is also that user rejects the token that disturbs piece processing simultaneously.When user right reclaims, only need to be in token chain a newly-generated last-of-chain token, and utilize newly-generated token again to disturb processing to encrypt data, can realize the recovery immediately of user right.
As shown in Figure 1, the access privilege recovery method in cloud storage environment of the present invention comprises the following steps:
(1) client is from user's data operation request, and judge this request type, read data request or limiting operation request, if write data requests, proceed to step (2), if read data request proceeds to step (13), if limiting operation request proceeds to step (20);
(2) the random symmetric key generating for data corresponding to write data requests are encrypted of client, and submit encryption key requests to security management center, this request comprises user identity certificate and data corresponding to write data requests No. ID; Particularly, this step is to adopt symmetric encipherment algorithm (as Advanced Encryption Standard, being called for short AES) to generate key;
(3) security management center judges that according to the user identity certificate in encryption key requests whether user is legal, if legal, proceed to step (4), otherwise returns to request failure information to user, and then process finishes;
(4) security management center judges whether this user reclaims in list in the corresponding authority of data corresponding to write data requests, if ask failure information returning to user, otherwise proceed to step (5), if wherein permissions list does not exist and represents that user is in authority reclaims list;
(5) security management center is searched and whether can in local cipher key store, be found encryption key corresponding to these data, proceeds to step (6), otherwise proceed to step (7) if find;
(6) security management center returns to client by the encryption key finding, and then enters step (8);
(7) security management center is according to these data and utilize public and private key encryption mechanism to generate at random and preserve encryption key, and the encryption key of generation is returned to client, then proceeds to step (8); Particularly, generating at random encryption key is to adopt asymmetric encryption mechanism, for example RSA Algorithm;
(8) client sends correct reception to security management center and replys after receiving from the encryption key of security management center, and goes to step (9);
(9) client is utilized the symmetric key generating in step (2), utilize symmetric encipherment algorithm to encrypt data corresponding to write data requests, to obtain encrypt data, then utilize the encryption key and the middle symmetric key generating of public personal key algorithm encrypting step (2) that in (8), receive, to obtain ciphertext key, encrypt data and ciphertext key are packaged as to encrypt data bag, and send write data requests to cloud storage end, particularly, write data requests comprises user identity certificate, encrypt data after packing, ciphertext key, the metadata of the data that write data requests is corresponding etc.,
(10) cloud storage termination is received the write data requests from client, identifying user identity certificate, and whether legal to judge user, if not rule is returned to user identity certificate error message, then process finishes; If legal, go to step (11);
(11) cloud storage end judges whether user has the write access authority to data corresponding to write data requests, if do not have authority to return to user without write access authority information, then process finishes, if there is write access authority, goes to step (12);
Particularly, user right judgement mainly depends on the access control policy that cloud storage end adopts, as adopting Access Control List (ACL), the access control policy based on identity authorizes user right, if user is in Access Control List (ACL), represent that user has read access authority, otherwise represent that user does not have read access authority;
(12) the random token (token) that generates of cloud storage end, and using this token the last-of-chain token of the corresponding token chain of the data in write data requests, random generation disturbed piece and according to the rule of formulating in token, the encrypt data that will disturb piece inserting step (9) to obtain, the data that preservation obtains, and return to user written data successful information to client; Particularly, if token chain does not exist, newly-built empty token chain, and the first token using the token generating at random as empty token chain;
Wherein, cloud storage end judges and the process of storing user's uploading data is described further in conjunction with example:
If data corresponding to user written data request are Data, and suppose that user has legal access rights, first cloud storage end is to judge whether Data exists, judge that user writes data or new uploading data, wherein write data because token chain exists, directly obtain last-of-chain token token; New uploading data generates a new token token at random, and first token using it as token chain corresponding to these data;
According to token, formulate principle, generate as the interference piece of Fig. 6, and will disturb piece to insert user's uploading data, the data Data ' disturbing after piece that inserts obtaining as shown in Figure 7 also preserves;
(13) client is sent read data request to cloud storage end, and wherein read data request comprises the ID of user identity certificate and data corresponding to read data request;
(14) cloud storage end, according to judging that from the user identity certificate in the read data request of client whether user is legal, if legal, goes to step (16), otherwise returns to user identity certificate error message to client, and then process finishes;
(15) cloud storage end judges whether data corresponding to read data request exist, if exist, goes to step (16), otherwise return to request msg to client, does not have information, and then process finishes;
(16) cloud storage end judges whether user has the read access authority to these data, if have these data returned to client, search the last-of-chain token in token chain corresponding to these data, to security management center, send key request, this request comprises ID, last-of-chain token, the user identity certificate of data; Otherwise return to user without read access authority information to client;
Particularly, user right judgement mainly depends on the access control policy that cloud storage end profit adopts, as adopting Access Control List (ACL), the access control policy based on identity authorizes user right, if user is in Access Control List (ACL), represent that user has read access authority, otherwise represent that user does not have read access authority; The data of returning to client comprise ciphertext key corresponding to data, request msg that user asks.
(17) security management center judges according to this key request whether user reclaims in list in the corresponding authority of data corresponding to read data request, if not (if wherein authority reclaims list and does not exist, also represent that user is in authority reclaims list) the corresponding decruption key of search request data, and decruption key, token are returned to client, then enter step (18), if exist, to client, return to client denial of service information, then process finishes
(18) client awaits receive cloud storage end and information that security management center returns, if data message and security management center return information that cloud storage end return information is request are that decruption key and token go to step (19), otherwise represent that user haves no right to read this request msg, then process finishes;
(19) first client utilizes the data that token treatment step (16) that step (17) is returned returns, reject the interference piece in data, obtain encrypt data, utilize the ciphertext key in decruption key decryption step (16) return data that step (17) returns to obtain symmetric key, and utilize symmetric key decrypting ciphertext data, to obtain user, ask initial data;
Below in conjunction with embodiment, the process obtaining after cloud storage end and security management center return information is further described:
User receives encrypt data Data, the ciphertext key Enc (K returning in high in the clouds
aES) and metadata metadata, receive the decruption key K that security management center returns
sand token token;
First user has more the interference piece insertion rule of formulating in token, and the interference piece in Data is removed, and obtains the data Data ' that does not disturb piece, and as Fig. 7, rejecting interference piece is and inserts the inverse process that disturbs piece; User utilizes K
sdeciphering Enc (K
aES) obtain symmetric key K
aES, above two steps can parallel processing; Then user utilizes K
aESdeciphering Data ' just can obtain the initial data of request.
(20) client is sent user right to security management center and is reclaimed request, and this user right recovery request comprises the user ID that user identity certificate, user right reclaim the ID of data corresponding to request and reclaim authority;
(21) whether security management center reclaims requests verification user identity certificate according to client user's authority, legal to judge user, if legal, goes to step (22), otherwise returns to user identity certificate error message to client, and then process finishes
(22) whether the user of security management center judgement recovery authority reclaims in the corresponding authority recovery of request corresponding data ID list at this user right, if user does not reclaim in list in authority, the user ID that reclaims authority is inserted to authority and reclaim list, to cloud storage end, send user right and reclaim request, and to client, return to user right and reclaim successful information, then proceed to step (23), the request of reclaiming of this user right comprises this data ID and reclaims the user ID of authority; If user reclaims in list in authority, to client, return to this user and in authority, reclaim information in list; If reclaim permissions list, do not exist newly-built authority to reclaim list, concrete newly-built authority reclaims tabulating method and can select (in the access control based on identity according to the concrete access control policy adopting of system, adopt access control list ACL to realize), then according to user, in authority, do not reclaim list and carry out subsequent operation;
(23) cloud storage end reclaims and asks to search the wherein corresponding token chain of data ID according to user right, and obtains last-of-chain token;
(24) cloud storage end utilizes the last-of-chain token that (23) obtain to reject the interference piece in the corresponding data of data ID, obtains disturbing without crossing the encrypt data of processing; Utilize token create-rule, generate at random a new token, and added token chain, as new last-of-chain token, random generation disturbed piece and according to the rule of formulating in new token, by disturbing piece to insert the encrypt data obtaining, obtained and preserve new interfering data; Return to client user's authority and reclaim successful information.
Particularly, Fig. 2 describes client process schematic diagram in detail, and Fig. 3 is cloud storage end process schematic diagram, and Fig. 8 is security management center process schematic diagram, three process cooperative cooperatings, and the operation requests of completing user, integrated operation flow process is as shown in Figure 1.The corresponding read data request of above-mentioned steps (13) to (19), its sequential chart is as shown in Figure 9; The corresponding write data requests of above-mentioned steps (2) to (12), its sequential chart is as shown in figure 10; The corresponding authority of above-mentioned steps (20) to (24) reclaims request, and its sequential chart as shown in figure 11.
In addition the data structure of Fig. 4 to 7 expression token and token chain and token and disturb the using priciple of piece, for above-mentioned steps (12), (24), the present invention adopts pseudo-random algorithm to carry out the structure of token chain, therefore can realize the unpredictability that token generates, above-mentioned steps (12), (19), (24) utilize token data processing method mainly to utilize the data structure of token definition, and Fig. 6, Fig. 7 have shown the process of carrying out data processing according to token.
Those skilled in the art will readily understand; the foregoing is only preferred embodiment of the present invention; not in order to limit the present invention, all any modifications of doing within the spirit and principles in the present invention, be equal to and replace and improvement etc., within all should being included in protection scope of the present invention.
Claims (6)
1. the access privilege recovery method in cloud storage environment, is characterized in that, comprises the following steps:
(1) client is from user's data operation request, and judge this request type, read data request or limiting operation request, if write data requests, proceed to step (2), if read data request proceeds to step (6), if limiting operation request proceeds to step (11);
(2) the random symmetric key generating for data corresponding to write data requests are encrypted of client, and submit encryption key requests to security management center;
(3) security management center is determined this user's legitimacy according to encryption key requests, and judge whether validated user reclaims in list in the corresponding authority of data corresponding to write data requests, if do not obtaining encryption key corresponding to these data, and this encryption key returned to client;
(4) client is utilized the symmetric key generating in step (2), utilize symmetric encipherment algorithm to encrypt data corresponding to write data requests, to obtain encrypt data, the encryption key that utilization receives and public personal key algorithm are encrypted the symmetric key generating, to obtain ciphertext key, encrypt data and ciphertext key are packaged as to encrypt data bag, and send write data requests to cloud storage end;
(5) cloud storage termination is received the write data requests from client, according to this write data requests, determine this user's legitimacy, and generate a token at random when legal user has write access authority to data corresponding to write data requests, and using this token the last-of-chain token of the corresponding token chain of the data in write data requests, random generation disturbed piece and according to the rule of formulating in token, to disturb piece to insert encrypt data, and preserve the data that obtain;
(6) client is sent read data request to cloud storage end;
(7) cloud storage end is according to determine this user's legitimacy from the user identity certificate in the read data request of client, and when legal user has the read access authority to these data, these data are returned to client, search the last-of-chain token in token chain corresponding to these data, to security management center, send key request;
(8) security management center judges according to this key request whether user reclaims in list in the corresponding authority of data corresponding to read data request, if not at the corresponding decruption key of search request data, and decruption key, token are returned to client, then enter step (9), if exist, to client, return to client denial of service information, then process finishes;
(9) client awaits receive cloud storage end and information that security management center returns, if data message and security management center return information that cloud storage end return information is request are decruption key and token, go to step (10), else process finishes;
(10) token that client utilization is returned is processed the data of returning, reject the interference piece in data, obtain encrypt data, ciphertext key in the decruption key deciphering return data that utilization is returned obtains symmetric key, and utilize symmetric key decrypting ciphertext data, to obtain user, ask initial data;
(11) client is sent user right to security management center and is reclaimed request;
(12) whether security management center reclaims requests verification user identity certificate according to client user's authority, legal to judge user, if legal, goes to step (13), otherwise returns to user identity certificate error message to client, and then process finishes;
(13) whether the user of security management center judgement recovery authority reclaims in the corresponding authority recovery of request corresponding data ID list at this user right, if user does not reclaim in list in authority, the user ID that reclaims authority is inserted to authority and reclaim list, to cloud storage end, send user right and reclaim request, and to client, return to user right and reclaim successful information, then proceed to step (14); If user reclaims in list in authority, to client, return to this user and in authority, reclaim information in list;
(14) cloud storage end reclaims and asks to search the wherein corresponding token chain of data ID according to user right, and obtain last-of-chain token, utilize the last-of-chain token obtaining to reject the interference piece in the corresponding data of data ID, obtain disturbing without crossing the encrypt data of processing, utilize token create-rule, random generation one is new token, and added token chain, as new last-of-chain token, random generation disturbed piece and according to the rule of formulating in new token, to disturb piece to insert the encrypt data obtaining, obtain and preserve new interfering data, and return to client user's authority and reclaim successful information.
2. access privilege recovery method according to claim 1, is characterized in that,
Encryption key requests comprises user identity certificate and data corresponding to write data requests No. ID;
Write data requests comprises the metadata of the data that encrypt data, ciphertext key, the write data requests after user identity certificate, packing is corresponding;
Read data request comprises the ID of user identity certificate and data corresponding to read data request;
The user right request of reclaiming comprises that user identity certificate, user right reclaim the ID of data corresponding to request and the user ID of recovery authority.
3. access privilege recovery method according to claim 1, is characterized in that, step (3) comprises following sub-step:
(3-1) security management center judges that according to the user identity certificate in encryption key requests whether user is legal, if legal, proceed to step (3-2), otherwise returns to request failure information to user, and then process finishes;
(3-2) security management center judges whether this user reclaims in list in the corresponding authority of data corresponding to write data requests, if ask failure information returning to user, otherwise proceed to step (3-3), if wherein permissions list does not exist and represents that user is in authority reclaims list;
(3-3) security management center is searched and whether can in local cipher key store, be found encryption key corresponding to these data, proceeds to step (3-4), otherwise proceed to step (3-5) if find;
(3-4) security management center returns to client by the encryption key finding, and then enters step (4);
(3-5) security management center is according to these data and utilize public and private key encryption mechanism to generate at random and preserve encryption key, and the encryption key of generation is returned to client, then enters step (4).
4. access privilege recovery method according to claim 1, is characterized in that, also comprises step: client, after the encryption key receiving from security management center, sends correct reception to security management center and replys.
5. access privilege recovery method according to claim 1, is characterized in that, step (5) comprises following sub-step:
(5-1) cloud storage termination is received the write data requests from client, identifying user identity certificate, and whether legal to judge user, if not rule is returned to user identity certificate error message, then process finishes; If legal, go to step (5-2);
(5-2) cloud storage end judges whether user has the write access authority to data corresponding to write data requests, if do not have authority to return to user without write access authority information, then process finishes, if there is write access authority, goes to step (5-3);
(5-3) token of the random generation of cloud storage end, and using this token the last-of-chain token of the corresponding token chain of the data in write data requests, random generation disturbed piece and according to the rule of formulating in token, to disturb piece to insert encrypt data, the data that preservation obtains, and return to user written data successful information to client.
6. access privilege recovery method according to claim 1, is characterized in that, step (7) comprises following sub-step:
(7-1) cloud storage end, according to judging that from the user identity certificate in the read data request of client whether user is legal, if legal, goes to step (7-2), otherwise returns to user identity certificate error message to client, and then process finishes;
(7-2) cloud storage end judges whether data corresponding to read data request exist, if exist, goes to step (7-3), otherwise return to request msg to client, does not have information, and then process finishes;
(7-3) cloud storage end judges whether user has the read access authority to these data, if have these data returned to client, search the last-of-chain token in token chain corresponding to these data, to security management center, send key request, this request comprises ID, last-of-chain token, the user identity certificate of data; Otherwise return to user without read access authority information to client.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410213922.0A CN103973698B (en) | 2014-05-19 | 2014-05-19 | User access right revoking method in cloud storage environment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410213922.0A CN103973698B (en) | 2014-05-19 | 2014-05-19 | User access right revoking method in cloud storage environment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103973698A true CN103973698A (en) | 2014-08-06 |
| CN103973698B CN103973698B (en) | 2017-01-25 |
Family
ID=51242744
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410213922.0A Active CN103973698B (en) | 2014-05-19 | 2014-05-19 | User access right revoking method in cloud storage environment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103973698B (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104901968A (en) * | 2015-06-10 | 2015-09-09 | 华中科技大学 | Method for managing and distributing secret keys in secure cloud storage system |
| CN104935588A (en) * | 2015-06-12 | 2015-09-23 | 华中科技大学 | Layered key management method of secure cloud storage system |
| CN107612910A (en) * | 2017-09-19 | 2018-01-19 | 北京邮电大学 | A kind of distributed document data access method and system |
| CN109218295A (en) * | 2018-08-22 | 2019-01-15 | 平安科技（深圳）有限公司 | Document protection method, device, computer equipment and storage medium |
| CN111222034A (en) * | 2019-12-31 | 2020-06-02 | 湖南华菱涟源钢铁有限公司 | Data mobile display method and device and cloud server |
| CN112818404A (en) * | 2021-02-26 | 2021-05-18 | 青岛大学 | Data access permission updating method, device, equipment and readable storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101383702A (en) * | 2008-10-06 | 2009-03-11 | 中兴通讯股份有限公司 | Method and system protecting cipher generating parameter in tracing region updating |
| CN103326999A (en) * | 2012-12-14 | 2013-09-25 | 无锡华御信息技术有限公司 | File safety management system based on cloud service |
| CN103441844A (en) * | 2013-07-31 | 2013-12-11 | 南京神盾信息技术有限公司 | Data safety and intranet monitoring system based on cloud storage |
-
2014
- 2014-05-19 CN CN201410213922.0A patent/CN103973698B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101383702A (en) * | 2008-10-06 | 2009-03-11 | 中兴通讯股份有限公司 | Method and system protecting cipher generating parameter in tracing region updating |
| CN103326999A (en) * | 2012-12-14 | 2013-09-25 | 无锡华御信息技术有限公司 | File safety management system based on cloud service |
| CN103441844A (en) * | 2013-07-31 | 2013-12-11 | 南京神盾信息技术有限公司 | Data safety and intranet monitoring system based on cloud storage |
Non-Patent Citations (1)
| Title |
|---|
| 陈杰: "《基于属性的分布式存储安全访问控制技术》", 《中国优秀硕士学位论文全文数据库 信息科技辑》 * |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104901968A (en) * | 2015-06-10 | 2015-09-09 | 华中科技大学 | Method for managing and distributing secret keys in secure cloud storage system |
| CN104901968B (en) * | 2015-06-10 | 2018-01-05 | 华中科技大学 | A kind of key management distribution method in safe cloud storage system |
| CN104935588A (en) * | 2015-06-12 | 2015-09-23 | 华中科技大学 | Layered key management method of secure cloud storage system |
| CN104935588B (en) * | 2015-06-12 | 2017-11-24 | 华中科技大学 | A kind of hierarchical encryption management method of safe cloud storage system |
| CN107612910A (en) * | 2017-09-19 | 2018-01-19 | 北京邮电大学 | A kind of distributed document data access method and system |
| CN109218295A (en) * | 2018-08-22 | 2019-01-15 | 平安科技（深圳）有限公司 | Document protection method, device, computer equipment and storage medium |
| CN111222034A (en) * | 2019-12-31 | 2020-06-02 | 湖南华菱涟源钢铁有限公司 | Data mobile display method and device and cloud server |
| CN111222034B (en) * | 2019-12-31 | 2023-05-16 | 湖南华菱涟源钢铁有限公司 | Data mobile display method and device and cloud server |
| CN112818404A (en) * | 2021-02-26 | 2021-05-18 | 青岛大学 | Data access permission updating method, device, equipment and readable storage medium |
| CN112818404B (en) * | 2021-02-26 | 2022-11-04 | 青岛大学 | Data access permission updating method, device, equipment and readable storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103973698B (en) | 2017-01-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107959567B (en) | Data storage method, data acquisition method, device and system | |
| US7975312B2 (en) | Token passing technique for media playback devices | |
| CN102138300B (en) | Message authentication code pre-computation with applications to secure memory | |
| KR101371608B1 (en) | Database Management System and Encrypting Method thereof | |
| CN103636161A (en) | Use of non-interactive identity based key agreement derived secret keys with authenticated encryption | |
| CN113541935B (en) | Encryption cloud storage method, system, equipment and terminal supporting key escrow | |
| CN103973698A (en) | User access right revoking method in cloud storage environment | |
| CN105100076A (en) | Cloud data security system based on USB Key | |
| US20150143107A1 (en) | Data security tools for shared data | |
| CN111274599A (en) | Data sharing method based on block chain and related device | |
| CN109274644A (en) | A kind of data processing method, terminal and watermark server | |
| CN107317677A (en) | Key storage and equipment identities authentication method, device | |
| US12118540B2 (en) | Systems and methods for distributed data mapping | |
| CN114826702B (en) | Database access password encryption method and device and computer equipment | |
| EP3455763B1 (en) | Digital rights management for anonymous digital content sharing | |
| CN106992978A (en) | Network safety managing method and server | |
| CN111541652B (en) | System for improving security of secret information keeping and transmission | |
| US8862893B2 (en) | Techniques for performing symmetric cryptography | |
| US11436351B1 (en) | Homomorphic encryption of secure data | |
| Suthar et al. | EncryScation: A novel framework for cloud iaas, daas security using encryption and obfuscation techniques | |
| CN111404895A (en) | Method, equipment and storage medium for distributing and recovering readable permission of shared data | |
| CN105740726B (en) | A kind of extension information ciphering method and system | |
| US8681972B2 (en) | Method of executing a cryptographic calculation | |
| CN106790100A (en) | A kind of data storage and access control method based on asymmetric cryptographic algorithm | |
| Karani et al. | Secure File Storage Using Hybrid Cryptography |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |