CN103973698A - User access right revoking method in cloud storage environment - Google Patents

Abstract

The invention discloses a method for reclaiming user rights in a cloud storage environment, which solves the problem of potential safety hazards caused by reclaiming user rights in the existing cloud environment and performance overhead problems caused by data re-encryption. Including: client process, cloud storage system process and security management center process, cloud storage system implements token chain management update, notifies security management center to distribute keys and tokens, inserts interference blocks into ciphertext, and judges user access requests Reply; the security management center implements user registration, login, authority grant, recovery, key management, distribution, and user token distribution. The present invention utilizes the token mechanism to realize the interference processing of the ciphertext, and adopts the immediate recovery mechanism, when the user authority is recovered, the token is immediately updated and the ciphertext is re-interference processed, which solves the problem caused by the recovery of the user authority in the non-immediate recovery mechanism Security risks. This method does not need to re-encrypt the data, which greatly reduces the performance overhead of the system.

Description

A method for reclaiming user access rights in a cloud storage environment

technical field

The invention belongs to the field of computer storage technology and information security technology, and more specifically relates to a method for reclaiming user access rights in a cloud storage environment.

Background technique

While cloud storage systems provide users with data storage and business services, the security of cloud data has always been an important issue that users and business managers are particularly concerned about. In order to protect the privacy of user data, the current cloud storage security framework generally encrypts and stores data, and cloud service providers use corresponding access control policies to determine whether users have legitimate access rights to the data, key management and distribution by a trusted third party. Although this has strengthened the security of cloud data to a certain extent, the form of ciphertext storage will also cause new problems. When it is necessary to change the user's access authority to certain data, in order to ensure that the key held by the user who has revoked the authority is invalid, the general solution is to re-encrypt the data, and then update and redistribute the key. Due to the large number of users in the cloud environment and frequent changes in user permissions, re-encryption of data and redistribution of keys will bring huge performance overhead. If re-encryption is performed when the user uploads data, since the time when the user performs the upload data operation is uncertain, the timing of data re-encryption is also uncertain, and the user whose authority has been revoked during this period can still access the data. It may happen that the revoked authority user maliciously writes dirty data to the system. In addition, this solution cannot solve the re-encryption problem of read-only data.

Contents of the invention

Aiming at the above defects or improvement needs of the prior art, the present invention provides a method for reclaiming user access rights in a cloud storage environment, the purpose of which is to realize immediate reclaiming of user rights through ciphertext-based random processing in the cloud, In order to solve the security risks caused by the recovery of existing user rights and the technical problems of re-encryption of data causing huge performance overhead.

In order to achieve the above object, according to one aspect of the present invention, a method for reclaiming user access rights in a cloud storage environment is provided, including the following steps:

(1) The client receives a data operation request from the user and judges the type of the request, whether it is a read data request or a permission operation request. If it is a write data request, then go to step (2), if it is a read data request, go to Step (6), if it is a permission operation request, then proceed to step (11);

(2) The client randomly generates a symmetric key for encrypting the data corresponding to the write data request, and submits an encryption key request to the security management center;

(3) The security management center determines the legitimacy of the user according to the encryption key request, and judges whether the legal user is in the permission recovery list corresponding to the data corresponding to the write data request, and if not, obtains the encryption key corresponding to the data, and return the encryption key to the client;

(4) The client uses the symmetric key generated in step (2) to encrypt and write the data corresponding to the data request using the symmetric encryption algorithm to obtain the ciphertext data, which is encrypted using the received encryption key and the public-private key encryption algorithm Symmetric key to obtain the ciphertext key, pack the ciphertext data and the ciphertext key into a ciphertext data packet, and send a write data request to the cloud storage terminal;

(5) The cloud storage terminal receives the write data request from the client, determines the legitimacy of the user according to the write data request, and randomly generates a token when the legal user has write access to the data corresponding to the write data request, and Use the token as the tail token of the token chain corresponding to the data in the write data request, randomly generate an interference block and insert the interference block into the ciphertext data according to the rules formulated in the token, and save the obtained data;

(6) The client sends a read data request to the cloud storage terminal;

(7) The cloud storage terminal determines the legitimacy of the user according to the user identity certificate in the read data request from the client, and returns the data to the client when the legal user has read access to the data, and searches for the data The chain tail token in the corresponding token chain sends a key request to the security management center;

(8) The security management center judges whether the user is in the permission recovery list corresponding to the data corresponding to the read data request according to the key request, and if not, searches for the decryption key corresponding to the requested data, and returns the decryption key and token To the client, then enter step (9), if it exists, then return the client denial of service information to the client, and then the process ends;

(9) The client waits for and receives the information returned by the cloud storage terminal and the security management center. If the information returned by the cloud storage terminal is the requested data information and the information returned by the security management center is the decryption key and token, then go to step (10) , otherwise the process ends;

(10) The client uses the returned token to process the returned data, removes the interference blocks in the data, and obtains the ciphertext data, uses the returned decryption key to decrypt the ciphertext key in the returned data to obtain the symmetric key, and uses the symmetric The key decrypts the ciphertext data to obtain the original data requested by the user;

(11) The client sends a user authority recovery request to the security management center;

(12) The security management center verifies the user identity certificate according to the client user authority recovery request to judge whether the user is legal, if legal, then turn to step (13), otherwise return the user identity certificate error message to the client, and then the process ends;

(13) The security management center judges whether the user who reclaims the authority is in the authority recovery list corresponding to the data ID corresponding to the user authority recovery request, if the user is not in the authority recovery list, then inserts the user ID of the recovery authority into the authority recovery list, and sends The cloud storage terminal sends out a user authority recovery request, and returns the user authority recovery success message to the client, and then proceeds to step (14); if the user is in the authority recovery list, then returns to the client a prompt that the user is already in the authority recovery list information;

(14) The cloud storage terminal searches for the token chain corresponding to the data ID according to the user authority recovery request, and obtains the chain tail token, uses the obtained chain tail token to remove the interference block in the data corresponding to the data ID, and obtains The ciphertext data that has undergone interference processing, using the token generation rules, randomly generates a new token, and adds it to the token chain as a new chain end token, randomly generates interference blocks and follows the new token. According to the rules, the interference block is inserted into the obtained ciphertext data, the new interference data is obtained and saved, and the client user authority recycling success message is returned.

Preferably, the encryption key request includes the ID number of the user identity certificate and the data corresponding to the write data request, and the write data request includes the user identity certificate, the packaged ciphertext data, the ciphertext key, and the ID number of the data corresponding to the write data request. Metadata, the read data request includes the user identity certificate and the ID of the data corresponding to the read data request, and the user authority recovery request includes the user identity certificate, the data ID corresponding to the user authority recovery request, and the user ID of the recovery authority.

Preferably, step (3) includes the following substeps:

(3-1) The safety management center judges whether the user is legal according to the user identity certificate in the encryption key request, and if it is legal, then proceeds to step (3-2), otherwise returns request failure information to the user, and then the process ends;

(3-2) The security management center judges whether the user is in the permission recovery list corresponding to the data corresponding to the write data request, and if so, returns the user request failure information, otherwise proceeds to step (3-3), wherein if the permission list If it does not exist, it means that the user is not in the permission recovery list;

(3-3) The security management center searches whether the encryption key corresponding to the data can be found in the local key storehouse, if found, then proceeds to step (3-4), otherwise proceeds to step (3-5);

(3-4) The security management center returns the found encryption key to the client, and then enters step (4);

(3-5) The security management center randomly generates and saves an encryption key according to the data and uses a public-private key encryption mechanism, and returns the generated encryption key to the client, and then enters step (4).

Preferably, it also includes a step: after receiving the encryption key from the security management center, the client sends a correct reception response to the security management center,

Preferably, step (5) includes the following sub-steps:

(5-1) The cloud storage terminal receives the write data request from the client, verifies the user identity certificate to determine whether the user is legal, if not, returns the user identity certificate error message, and then the process ends; if legal, go to step (5-2) ;

(5-2) The cloud storage terminal judges whether the user has the write access right to the data corresponding to the write data request, and if not, returns the information that the user has no write access right, and then the process ends, if there is write access right, go to step ( 5-3);

(5-3) The cloud storage terminal randomly generates a token, and uses the token as the end token of the token chain corresponding to the data in the write data request, randomly generates an interference block and according to the rules formulated in the token, writes Interference block inserts ciphertext data, saves the obtained data, and returns user write data success information to the client.

Preferably, step (7) includes the following sub-steps:

(7-1) The cloud storage terminal judges whether the user is legal according to the user identity certificate in the read data request from the client, and if it is legal, then go to step (7-2), otherwise return the user identity certificate error message to the client, and then the process ends ;

(7-2) The cloud storage terminal judges whether the data corresponding to the read data request exists, and if so, proceeds to step (7-3), otherwise returns the request data non-existing information to the client, and then the process ends;

(7-3) The cloud storage terminal judges whether the user has read access to the data, and if so, returns the data to the client, searches for the chain tail token in the token chain corresponding to the data, and reports to the security management center Send a key request, which includes the ID of the data, the chain tail token, and the user identity certificate; otherwise, return the user's non-read access permission information to the client.

Generally speaking, compared with the prior art, the above technical solutions conceived by the present invention can achieve the following beneficial effects:

(1) Immediate recovery of user rights can be realized, avoiding possible security risks due to the recovery of user rights. For example, in a non-immediate recovery mechanism, users who have recovered rights can still access data because they still meet the access control conditions, or even It is possible to maliciously write dirty data; secondly, the uncertainty of user authority recovery time will cause security holes in the system; in addition, the non-immediate recovery mechanism cannot solve the problem of re-encryption of read-only data;

(2) In the traditional user authority recovery mechanism, it is inevitable to perform re-encryption operations to invalidate the old key of the authority recovery user to avoid using the old key to decrypt the ciphertext to obtain the latest data. However, the interference block processing method proposed by the present invention only needs to use the rules formulated in the randomly generated tokens for the ciphertext data stored in the cloud to re-insert the interference block. Since users with recovery rights cannot obtain the latest tokens, even if they have The old key also cannot be decrypted to get the original data. Due to the performance bottleneck of the encryption algorithm, re-encryption often brings great performance overhead. However, the present invention utilizes the re-interference processing of ciphertext data to avoid the re-encryption problem when user rights are reclaimed, and greatly reduces the performance of the system. overhead;

(3) The present invention fully supports the write data request. The difference between the user write data request of the present invention and the current general write data flow is that a step is added when the cloud storage end data is saved, and the uploaded data is inserted into an interference block using a token. The present invention also supports other access requests of the user's data, such as deletion, movement, renaming and other requests.

(4) The present invention has wide applicability and is not limited to cloud environment systems. Since the generation rules of tokens and the interference processing of ciphertext data are not necessarily related to cloud storage systems, for any system that has user authority recovery, The present invention will apply to both.

Description of drawings

Fig. 1 is a schematic flow chart of the present invention.

Figure 2 is a schematic diagram of the client process.

FIG. 3 is a schematic diagram of a cloud storage terminal process.

Figure 4 is a schematic diagram of the token structure.

Figure 5 is a schematic diagram of the token chain structure.

Fig. 6 is a schematic diagram of the structure of an interference block.

FIG. 7 is a schematic diagram of interference processing on ciphertext data.

Fig. 8 is a schematic diagram of the process of the security management center.

Figure 9 is a sequence diagram of user login and read access data.

Figure 10 is a sequence diagram of user login and write access data.

Figure 11 is a sequence diagram of user login and recovery of user rights.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not constitute a conflict with each other.

Below at first explain and illustrate with regard to the technical terms of the present invention:

Original file: refers to the unencrypted file;

Identity certificate: a data structure that marks the user's identity characteristics, used for user identity judgment and access control to judge whether the user has access rights;

Symmetric encryption mechanism: Encryption and decryption use the same key, and decryption is the inverse operation of encryption;

Symmetric key: randomly generated binary data, used to encrypt or decrypt the original file;

Encrypted file: the file obtained by encrypting the original file with a symmetric key cryptography mechanism using a symmetric key;

Integrity verification key: Randomly generated binary data, used to encrypt encrypted files;

Signature file: Binary data obtained by encrypting the encrypted file with an integrity verification key and using a hash function;

Permission recovery list: record user identification information for recovery permissions;

Interference block: a binary data block with a custom length;

Token: a data structure that records the basic information of all interfering blocks inserted into the encrypted file, and is used to insert or remove interfering blocks in the encrypted file;

Token chain: a chain structure composed of tokens, in which the tokens behind the chain can deduce the previous tokens, while the previous tokens cannot deduce the following tokens;

The present invention is further described below in conjunction with embodiment and accompanying drawing.

As shown in Fig. 1, the present invention includes a client process, a cloud storage system process and a security management center process, which run on the client host, authentication host and cloud storage system host of the distributed file system respectively. The three modules work together, in which the client implements various access operation requests, including logging in to the system, reading access data requests, writing data uploads, and reclaiming user permissions. The token eliminates the interference block in the data returned by the cloud storage system, restores the ciphertext, and then uses the key to decrypt to obtain the original data; while the write access is encrypted data, and the ciphertext is uploaded; the cloud storage system implements token chain management update, notification The security management center distributes keys and tokens, inserts ciphertext into interference blocks, and judges and replies user access requests; the security management center implements user registration, login, authority granting, recycling, key management and distribution, and user token distribution .

The present invention uses a token chain mechanism to interfere with the ciphertext data uploaded by the user, so even if the user has the decryption key, the user cannot restore the ciphertext data without obtaining the corresponding token, so the ciphertext cannot be decrypted to obtain the original data , thereby avoiding the necessary re-encryption operation when user rights are revoked.

The token is a data structure that includes interference block generation and ciphertext insertion rules. The cloud can use the token to interfere with the ciphertext; the user can use the token to remove the interference block from the interference-processed data to restore the ciphertext data. Token chain is a chain structure composed of tokens, in which the tokens behind the chain can launch the previous tokens, but the previous tokens cannot launch the following tokens, and the chain tail tokens are cloud-based for interference processing The key token of the ciphertext data is also the token for the user to remove interference blocks. When the user authority is revoked, it is only necessary to generate a new chain tail token on the token chain, and use the newly generated token to re-disturb the ciphertext data to realize the immediate reclaim of user authority.

As shown in Figure 1, the method for recovering user access rights in the cloud storage environment of the present invention includes the following steps:

(1) The client receives a data operation request from the user and judges the type of the request, whether it is a read data request or a permission operation request. If it is a write data request, then go to step (2), if it is a read data request, go to Step (13), if it is a permission operation request, then proceed to step (20);

(2) The client randomly generates a symmetric key for encrypting the data corresponding to the write data request, and submits an encryption key request to the security management center. The request includes the user identity certificate and the ID of the data corresponding to the write data request Specifically, this step is to use a symmetric encryption algorithm (such as Advanced Encryption Standard, referred to as AES) to generate a key;

(3) The safety management center judges whether the user is legal according to the user identity certificate in the encryption key request, if legal then proceeds to step (4), otherwise returns request failure information to the user, and then the process ends;

(4) The security management center judges whether the user is in the permission recovery list corresponding to the data corresponding to the write data request, and if so, returns the user request failure information, otherwise, proceeds to step (5), wherein if the permission list does not exist, it means The user is not in the permission recovery list;

(5) The security management center searches whether the encryption key corresponding to the data can be found in the local key storehouse, if found then proceeds to step (6), otherwise proceeds to step (7);

(6) The security management center returns the encryption key found to the client, and then enters step (8);

(7) According to the data, the security management center randomly generates and saves the encryption key using the public-private key encryption mechanism, returns the generated encryption key to the client, and then turns to step (8); specifically, randomly generates the encryption key The key is an asymmetric encryption mechanism, such as the RSA algorithm;

(8) After receiving the encryption key from the security management center, the client sends a correct reception response to the security management center, and turns to step (9);

(9) The client uses the symmetric key generated in step (2) to encrypt the data corresponding to the write data request using a symmetric encryption algorithm to obtain ciphertext data, and then uses the encryption key and public-private key received in (8) The encryption algorithm encrypts the symmetric key generated in step (2) to obtain the ciphertext key, packs the ciphertext data and the ciphertext key into a ciphertext data packet, and sends a write data request to the cloud storage terminal, specifically , the write data request includes user identity certificate, packaged ciphertext data, ciphertext key, metadata of the data corresponding to the write data request, etc.;

(10) The cloud storage terminal receives the write data request from the client, verifies the user identity certificate, to judge whether the user is legal, if it is illegal, then returns the user identity certificate error message, and then the process ends; if it is legal, then turn to step (11);

(11) The cloud storage terminal judges whether the user has the write access right to the data corresponding to the write data request, and if not, returns the information that the user has no write access right, and then the process ends, if there is a write access right, go to step (12) ;

Specifically, the judgment of user permissions mainly depends on the access control strategy adopted by the cloud storage terminal. For example, the identity-based access control strategy adopts the access control list to grant user permissions. If the user is in the access control list, it means that the user has read access permissions. Otherwise, the user does not have read access;

(12) The cloud storage terminal randomly generates a token (token), and uses the token as the end token of the token chain corresponding to the data in the write data request, randomly generates an interference block and follows the rules formulated in the token, Insert the interference block into the ciphertext data obtained in step (9), save the obtained data, and return the user to write data success information to the client; specifically, if the token chain does not exist, create an empty token chain, and Use the randomly generated token as the first token of the empty token chain;

Among them, the process of judging and storing user uploaded data by the cloud storage terminal is further explained with examples:

Assuming that the data corresponding to the user's write data request is Data, and assuming that the user has legal access rights, the cloud storage terminal first judges whether Data already exists, that is, judges whether the user is writing data or newly uploading data. If it already exists, you can directly obtain the token at the end of the chain; for newly uploaded data, a new token token will be randomly generated and used as the first token of the token chain corresponding to the data;

According to the principle of token formulation, an interference block as shown in Figure 6 is generated, and the interference block is inserted into the data uploaded by the user, and the data Data' inserted into the interference block as shown in Figure 7 is obtained and saved;

(13) The client sends a read data request to the cloud storage terminal, wherein the read data request includes the ID of the data corresponding to the user identity certificate and the read data request;

(14) The cloud storage end judges whether the user is legal according to the user identity certificate in the read data request from the client, if legal then go to step (16), otherwise return the user identity certificate error message to the client, and then the process ends;

(15) The cloud storage terminal judges whether the data corresponding to the read data request exists, and if it exists, then turn to step (16), otherwise the request data does not exist information is returned to the client, and then the process ends;

(16) The cloud storage terminal judges whether the user has the read access right to the data, and if so, returns the data to the client, searches for the chain tail token in the token chain corresponding to the data, and sends the password to the security management center. key request, the request includes the ID of the data, the chain tail token, and the user identity certificate; otherwise, return the user's non-read access permission information to the client;

Specifically, the judgment of user permissions mainly depends on the access control strategy adopted by the cloud storage terminal. For example, the identity-based access control strategy uses the access control list to grant user permissions. If the user is in the access control list, it means that the user has read access. , otherwise it means that the user does not have read access rights; the data returned to the client includes the data requested by the user and the ciphertext key corresponding to the requested data.

(17) The security management center determines whether the user is in the permission recovery list corresponding to the data corresponding to the read data request according to the key request, and if not (if the permission recovery list does not exist, it also means that the user is not in the permission recovery list) then search Request the decryption key corresponding to the data, return the decryption key and token to the client, and then enter step (18), if it exists, return the client’s denial of service information to the client, and then the process ends

(18) The client waits for and receives the information returned by the cloud storage terminal and the security management center. If the information returned by the cloud storage terminal is the requested data information and the information returned by the security management center is the decryption key and token, then go to step (19), Otherwise, it means that the user has no right to read the requested data, and then the process ends;

(19) The client first uses the token returned by step (17) to process the data returned by step (16), removes the interference blocks in the data, and obtains the ciphertext data, and uses the decryption key returned by step (17) to decrypt step (16) ) return the ciphertext key in the data to obtain a symmetric key, and use the symmetric key to decrypt the ciphertext data to obtain the original data requested by the user;

The process of obtaining the information returned by the cloud storage terminal and the security management center will be further described below in conjunction with the embodiments:

The user receives the ciphertext data Data, ciphertext key Enc (K _AES ) and its metadata returned by the cloud, and receives the decryption key K _S and token token returned by the security management center;

First of all, the user has the interfering block insertion rules formulated in the token, removes the interfering blocks in Data, and obtains the data Data' without interfering blocks, as shown in Figure 7, removing the interfering blocks is the inverse process of inserting interfering blocks; the user uses K _S Decrypt Enc(K _AES ) to obtain the symmetric key K _AES , and the above two steps can be processed in parallel; then the user can decrypt Data' with K _AES to obtain the requested original data.

(20) The client sends a user authority recovery request to the security management center, and the user authority recovery request includes the user identity certificate, the ID of the data corresponding to the user authority recovery request, and the user ID of the recovery authority;

(21) The security management center verifies the user identity certificate according to the client user authority recovery request to determine whether the user is legal, and if it is legal, then go to step (22), otherwise return the user identity certificate error message to the client, and then the process ends

(22) The safety management center judges whether the user who reclaims the authority is in the authority recovery list corresponding to the data ID corresponding to the user authority recovery request, if the user is not in the authority recovery list, then inserts the user ID of the recovery authority into the authority recovery list, and sends The cloud storage end sends out a user authority recovery request, and returns the user authority recovery success message to the client, and then proceeds to step (23), the user authority recovery request includes the data ID and the user ID of the recovery authority; if the user is in the authority recovery list , then return to the client the prompt information that the user has been in the permission recovery list; if the recovery permission list does not exist, then create a new permission recovery list, and the specific method of creating a new permission recovery list can be selected according to the access control strategy adopted by the system ( For example, in identity-based access control, the access control list (ACL) is used to implement), and then follow-up operations are performed according to the user's absence from the permission recovery list;

(23) The cloud storage terminal searches for the token chain corresponding to the data ID according to the user authority recovery request, and obtains the token at the end of the chain;

(24) The cloud storage terminal uses the chain tail token obtained in (23) to remove the interference block in the data corresponding to the data ID, and obtains the ciphertext data without interference processing; utilizes the token generation rule to randomly generate a new Token, and add it to the token chain as a new chain tail token, randomly generate interference blocks and insert the interference blocks into the obtained ciphertext data according to the rules formulated in the new token, and obtain and save new interference data ;Return the client user permission recovery success message.

Specifically, Figure 2 describes the schematic diagram of the client process in detail, Figure 3 is a schematic diagram of the cloud storage terminal process, and Figure 8 is a schematic diagram of the security management center process, the three processes cooperate to complete the user's operation request, the overall operation process is shown in Figure 1 Show. Above-mentioned steps (13) to (19) correspond to read data request, and its timing diagram is as shown in Figure 9; Above-mentioned steps (2) to (12) correspond to write data request, and its timing diagram is as shown in Figure 10; Above-mentioned steps (20 ) to (24) correspond to permission recovery requests, and their sequence diagram is shown in FIG. 11 .

In addition Fig. 4 to 7 represent the data structure of token and token chain and the use principle of token and interference block, for above-mentioned steps (12), (24), the present invention adopts pseudo-random algorithm to carry out the structure of token chain, therefore The unpredictability of token generation can be realized. The above-mentioned steps (12), (19), and (24) use tokens to process data. The method mainly utilizes the data structure defined by tokens. Figures 6 and 7 show data processing based on tokens. The process of processing.

It is easy for those skilled in the art to understand that the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention, All should be included within the protection scope of the present invention.

Claims (6)

1. A method for reclaiming user access rights in a cloud storage environment, characterized in that, comprising the following steps: (1) The client receives a data operation request from the user and judges the type of the request, whether it is a read data request or a permission operation request. If it is a write data request, then go to step (2), if it is a read data request, go to Step (6), if it is a permission operation request, then proceed to step (11); (2) The client randomly generates a symmetric key for encrypting the data corresponding to the write data request, and submits an encryption key request to the security management center; (3) The security management center determines the legitimacy of the user according to the encryption key request, and judges whether the legal user is in the permission recovery list corresponding to the data corresponding to the write data request, and if not, obtains the encryption key corresponding to the data, and return the encryption key to the client; (4) The client uses the symmetric key generated in step (2) to encrypt and write the data corresponding to the data request using a symmetric encryption algorithm to obtain ciphertext data, which is encrypted using the received encryption key and the public-private key encryption algorithm Symmetric key to obtain the ciphertext key, pack the ciphertext data and the ciphertext key into a ciphertext data packet, and send a write data request to the cloud storage terminal; (5) The cloud storage terminal receives the write data request from the client, determines the legitimacy of the user according to the write data request, and randomly generates a token when the legal user has write access to the data corresponding to the write data request, and Use the token as the tail token of the token chain corresponding to the data in the write data request, randomly generate an interference block and insert the interference block into the ciphertext data according to the rules formulated in the token, and save the obtained data; (6) The client sends a read data request to the cloud storage terminal; (7) The cloud storage terminal determines the legitimacy of the user according to the user identity certificate in the read data request from the client, and returns the data to the client when the legal user has read access to the data, and searches for the data The chain tail token in the corresponding token chain sends a key request to the security management center; (8) The security management center judges whether the user is in the permission recovery list corresponding to the data corresponding to the read data request according to the key request, and if not, searches for the decryption key corresponding to the requested data, and returns the decryption key and token To the client, then enter step (9), if it exists, then return the client denial of service information to the client, and then the process ends; (9) The client waits for and receives the information returned by the cloud storage terminal and the security management center. If the information returned by the cloud storage terminal is the requested data information and the information returned by the security management center is the decryption key and token, then go to step (10) , otherwise the process ends; (10) The client uses the returned token to process the returned data, removes the interference blocks in the data, and obtains the ciphertext data, uses the returned decryption key to decrypt the ciphertext key in the returned data to obtain the symmetric key, and uses the symmetric The key decrypts the ciphertext data to obtain the original data requested by the user; (11) The client sends a user authority recovery request to the security management center; (12) The security management center verifies the user identity certificate according to the client user authority recovery request to judge whether the user is legal, if legal, then turn to step (13), otherwise return the user identity certificate error message to the client, and then the process ends; (13) The security management center judges whether the user who reclaims the authority is in the authority recovery list corresponding to the data ID corresponding to the user authority recovery request, if the user is not in the authority recovery list, then inserts the user ID of the recovery authority into the authority recovery list, and sends The cloud storage terminal sends out a user authority recovery request, and returns the user authority recovery success message to the client, and then proceeds to step (14); if the user is in the authority recovery list, then returns to the client a prompt that the user is already in the authority recovery list information; (14) The cloud storage terminal searches for the token chain corresponding to the data ID according to the user authority recovery request, and obtains the chain tail token, uses the obtained chain tail token to remove the interference block in the data corresponding to the data ID, and obtains The ciphertext data that has undergone interference processing, using the token generation rules, randomly generates a new token, and adds it to the token chain as a new chain end token, randomly generates interference blocks and follows the new token. According to the rules, the interference block is inserted into the obtained ciphertext data, the new interference data is obtained and saved, and the client user authority recycling success message is returned. 2. The method for recovering user access rights according to claim 1, wherein: The encryption key request includes the user identity certificate and the ID number of the data corresponding to the write data request; The write data request includes the user identity certificate, the packaged ciphertext data, the ciphertext key, and the metadata of the data corresponding to the write data request; The read data request includes the user identity certificate and the ID of the data corresponding to the read data request; The user right revocation request includes the user identity certificate, the ID of the data corresponding to the user right revocation request, and the user ID of the revocation right. 3. The method for recovering user access rights according to claim 1, wherein step (3) comprises the following sub-steps: (3-1) The safety management center judges whether the user is legal according to the user identity certificate in the encryption key request, and if it is legal, then proceeds to step (3-2), otherwise returns request failure information to the user, and then the process ends; (3-2) The security management center judges whether the user is in the permission recovery list corresponding to the data corresponding to the write data request, and if so, returns the user request failure information, otherwise proceeds to step (3-3), wherein if the permission list If it does not exist, it means that the user is not in the permission recovery list; (3-3) The security management center searches whether the encryption key corresponding to the data can be found in the local key storehouse, if found, then proceeds to step (3-4), otherwise proceeds to step (3-5); (3-4) The security management center returns the found encryption key to the client, and then enters step (4); (3-5) The security management center randomly generates and saves an encryption key according to the data and uses a public-private key encryption mechanism, and returns the generated encryption key to the client, and then enters step (4). 4. The method for reclaiming user access rights according to claim 1, further comprising the step of: after receiving the encryption key from the security management center, the client sends a correct reception response to the security management center. 5. The method for reclaiming user access rights according to claim 1, wherein step (5) comprises the following sub-steps: (5-1) The cloud storage terminal receives the write data request from the client and verifies the user identity certificate to determine whether the user is legal. If it is illegal, it returns the error message of the user identity certificate, and then the process ends; if it is legal, go to step (5-2) ; (5-2) The cloud storage terminal judges whether the user has the write access right to the data corresponding to the write data request, and if not, returns the information that the user has no write access right, and then the process ends. If there is write access right, go to step ( 5-3); (5-3) The cloud storage terminal randomly generates a token, and uses the token as the end token of the token chain corresponding to the data in the write data request, randomly generates an interference block and according to the rules formulated in the token, writes Interference block inserts ciphertext data, saves the obtained data, and returns user write data success information to the client. 6. The method for recovering user access rights according to claim 1, wherein step (7) comprises the following sub-steps: (7-1) The cloud storage terminal judges whether the user is legal according to the user identity certificate in the read data request from the client, and if it is legal, then go to step (7-2), otherwise return the user identity certificate error message to the client, and then the process ends ; (7-2) The cloud storage terminal judges whether the data corresponding to the read data request exists, and if so, proceeds to step (7-3), otherwise returns the request data non-existing information to the client, and then the process ends; (7-3) The cloud storage terminal judges whether the user has read access to the data, and if so, returns the data to the client, searches for the chain tail token in the token chain corresponding to the data, and reports to the security management center Send a key request, which includes the ID of the data, the chain tail token, and the user identity certificate; otherwise, return the user's non-read access permission information to the client.