Cloud storage method and system with quantum encryption function
Technical Field
The invention belongs to the technical field of cloud storage, and particularly relates to a cloud storage method and system with a quantum encryption function.
Background
The cloud storage is a cloud computing system taking data access and management as a core, and the system has the advantages that on one hand, a user can be connected to the cloud storage at any time and any place through any connectable device, and the data access operation can be conveniently carried out; on the other hand, a user does not need to invest in a local data center or a special remote site to maintain and manage data, and a large amount of low-cost storage space can be obtained by utilizing cloud storage. Based on the advantages of the two aspects, in recent years, cloud storage technology has been rapidly developed, and more users select to use cloud storage.
The existing cloud storage service has the following disadvantages:
(1) the cloud storage service is provided by a cloud service provider without adopting an encryption function or an encryption function, keys and data are stored in the cloud end, and the data security of customers cannot be guaranteed;
(2) the randomness of the data encryption key is insufficient.
Disclosure of Invention
Based on the defects of cloud storage in the prior art, the invention provides a cloud storage method and system with a quantum encryption function, so that the problem of data encryption storage safety in the existing public cloud service system is solved.
According to an embodiment of the invention, the invention provides a cloud storage method with a quantum encryption function, which is applied to a terminal side of a cloud storage system and a service side of the cloud storage system, wherein the terminal side comprises an APP and a security control based on a local client, and the service side comprises a cloud end system for storing ciphertext data and a quantum security service platform based on a quantum random number generator QRNG.
The cloud storage method comprises the following steps:
the APP sends a request for acquiring initialized first key data to the quantum security service platform, after the first key data is acquired, the security control is called to process the first key data to obtain second key data in a ciphertext form, and the security control returns a processing result of the first key data to the APP;
after receiving an encryption request of data to be encrypted from a first user, the APP calls the security control to encrypt the data to be encrypted according to the second key data to form first ciphertext data, and sends the first ciphertext data to a cloud system for storage, wherein the first ciphertext data comprises an equipment identifier, an application identifier and corresponding ciphertext data of the first user.
As an embodiment of the present invention, before the step of sending, by the APP, a first key data request for initialization to the quantum security service platform, the method further includes:
the quantum security service platform generates corresponding first key data in advance based on device identifications and application identifications of different users.
As an embodiment of the present invention, after the step of sending, by the APP, a first key data request for initialization to the quantum security service platform, the method further includes:
the quantum security service platform receives a first key data request from a first user, extracts an equipment identifier and an application identifier in the request, inquires whether the equipment identifier and the application identifier are registered in the quantum security service platform, and if so, calls out first key data based on the equipment identifier and the application identifier from a database and sends the first key data to the first user; otherwise, calling quantum equipment through a throughput sub-network to generate two groups of 32-bit key components, calling an encryption machine to generate a pair of asymmetric keys, calling the encryption machine and the quantum network to generate initialized first key data of the symmetric and asymmetric keys corresponding to the equipment identifier and the application identifier of the first user, storing the first key data corresponding to the equipment identifier and the application identifier, and simultaneously sending the first key data to the first user.
As an embodiment of the present invention, the cloud storage method further includes, after receiving a data decryption request of an application based on a first user from a second user, acquiring, by a cloud system, first ciphertext data based on an equipment identifier and an application identifier, and sending the data decryption request to the quantum security service platform, so as to acquire transcryption key data corresponding to the second user equipment identifier and the application identifier.
As an embodiment of the present invention, after receiving the first ciphertext data and the encryption key data, the APP invokes the security control to decrypt the first ciphertext data at the local client, and obtains plaintext data after decryption succeeds, and returns error information of decryption failure to the user when decryption fails.
As an embodiment of the present invention, the sending, by the APP, a request for obtaining initialized first key data to the quantum security service platform includes sending, by the APP, the first key data request to the quantum security service platform in an initKey manner.
As an embodiment of the present invention, the cloud storage method further includes that the APP acquires a transCryption key from the quantum security service platform in a transCryption manner, and the APP calls the transCryption key and the first ciphertext data to the security control to perform decryption operation in a decmagata manner, so as to obtain decrypted plaintext data, and returns the decrypted plaintext data to the second user through the APP.
As an embodiment of the present invention, the cloud storage method further includes that the APP calls a security control in a setUSBKeyEncrKeys manner to process the first key data to obtain second key data in a ciphertext form, and the APP calls the security control in an encmagata manner to encrypt the data to be encrypted according to the second key data to form first ciphertext data.
As an embodiment of the present invention, the quantum security service platform generates corresponding first key data in advance based on device identifications and application identifications of different users, including the quantum security service platform generating one or more initialized first key data through a throughput sub-network according to a QRNG system.
According to an embodiment of the present invention, the present invention further provides a cloud storage system with a quantum encryption function, where the system includes a terminal side applied to the cloud storage system and a service side of the cloud storage system, the terminal side includes an APP and a security control based on a local client, the service side includes a cloud system and a quantum security service platform based on a quantum random number generator QRNG, and the APP, the security control and the QRNG system are configured to execute the cloud storage method described above.
According to the technical scheme, compared with the prior art, the cloud storage method and system with the quantum encryption function are provided, the secret key and the ciphertext data are stored separately, so that the cloud storage scheme is safer for a user, and the cloud storage method and system provided by the invention have the beneficial effects that:
(1) providing encryption/decryption services for cloud-stored data
(2) The separation of cloud storage data and a secret key is realized, and the data privacy safety of a client is ensured to the maximum extent
(3) And the quantum random number is used as a key source, so that the randomness of the key is improved.
Drawings
Fig. 1 is a schematic specific flow chart of a cloud storage method with a quantum encryption function disclosed in the present invention;
fig. 2 is a schematic view of a specific process of scene initialization in the cloud storage method disclosed in the present invention;
fig. 3 is a schematic diagram of a key initialization process of the QRNG system disclosed in the present invention;
fig. 4 is a schematic diagram illustrating a specific flow of data encryption in the cloud storage method disclosed in the present invention;
fig. 5 is a schematic view of a specific flow of a data encryption scene in the cloud storage method disclosed by the present invention;
fig. 6 is a schematic diagram illustrating a specific process of data decryption in the cloud storage method disclosed by the present invention;
fig. 7 is a schematic view of a specific flow of a data decryption scenario in the cloud storage method disclosed in the present invention.
Detailed Description
For the convenience of understanding, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The invention provides a cloud storage method with a quantum encryption function, which is applied to a terminal side of a cloud storage system and a service side of the cloud storage system, wherein the terminal side comprises an APP and a safety control based on a local client, and the service side comprises a cloud system for storing ciphertext data and a quantum safety service platform based on a quantum random number generator QRNG.
As shown in fig. 1, a specific flow of a cloud storage method with a quantum encryption function is shown. For terminal equipment such as a PC, a notebook computer, a mobile phone and the like, the security service and the key management of the business system client are realized by the terminal security equipment such as a TF card, a password module or software and the like. The terminal security equipment is uniformly managed by the quantum application security service platform, initialization setting is carried out, the platform calls QRNG to generate symmetric and asymmetric keys, and information such as the symmetric key, a public and private key pair and the like is distributed to the terminal. Sensitive information such as the key is safely stored in a hardware medium, and the life cycle management of the unified key is carried out by a safety service platform of the server.
In fig. 1, the local client includes APP and the security control that invoke the encryption and decryption process, in the process of carrying out cloud storage, the initial key data that quantum random number generator QRNG system in the quantum security service platform produced is obtained through APP, and invoke to the security control, when data such as file, picture that need send the user encrypt, invoke the security control to carry out encryption processing, generate the encryption ciphertext data and save to cloud system (application server), when needs decrypt, recall the security control and carry out corresponding decryption operation.
In the cloud storage method, an APP sends a request for acquiring initialized first key data to a QRNG (quantum random number generator) system of a quantum security service platform in an initKey mode, after the first key data is acquired, a security control is called in a setUSBKeyEncrykeys mode to process the first key data to obtain second key data in a ciphertext mode, and the security control returns a processing result of the first key data to the APP.
As shown in fig. 2, the APP calls the background system to pass through and call the quantum security platform to obtain initialization key data. After the APP obtains the key data, the safety control is called, the obtained key data are led into the control, after the safety control internally processes the key data, the key is stored in an internal file in a ciphertext mode, and the safety control returns an initialization result to the APP of the local client side, so that the initialization process is completed. Before using the data encryption function, a user needs to call a background system by the APP terminal, and the background system calls the security platform to acquire initialized key data and import the initialized key data into the security control. The initialization mode of initKey is shown in fig. 3.
In the scheme of the invention, a quantum random number generator QRNG system of the quantum security service platform is used, one or more initialized key data are generated through a quantum network, the generated initialized key data are matched with the equipment identification and the application identification of a user, for example, multiple application identifications possibly exist under the same equipment identification, when the storage is carried out, the multiple application identifications under one equipment identification can correspondingly store corresponding quantum keys, and the quantum keys are stored in the quantum security service platform.
As shown in fig. 4, after receiving an encryption request of data to be encrypted from a first user, the APP calls an encryption interface of the security control in an encmagata manner to encrypt the data to be encrypted according to the second key data to form first ciphertext data, where the data to be encrypted may be image data or other file data, and sends the first ciphertext data to the cloud system for storage, where the first ciphertext data includes a device identifier, an application identifier, and corresponding ciphertext data of the first user. The specific encryption process of the security control is shown in fig. 5.
As shown in fig. 6, after receiving a data decryption request from a second user, the APP obtains a transCryption key from the QRNG system through a transCryption mode, and obtains the first ciphertext data from the cloud system, where the second user may be the same user as the first user or may be another user, and to show the technical solution of the present invention, where the user a uploads encrypted image data, the user B needs to check an image uploaded by the user a, the APP calls the background system, uploads the unique identifier of the user a, the unique identifier of the user B, and arrives at the security platform, and obtains the transCryption key needed by the user B for decryption, and the APP obtains ciphertext data obtained after the image is encrypted from the cloud system. And calling the security control, and transmitting the encryption key and the ciphertext data into the control.
In the invention, the APP calls the encryption key and the first ciphertext data to the security control to perform decryption operation in a decMaData mode to obtain decrypted plaintext data, and the decrypted plaintext data is returned to a second user through the APP. The decryption process of the security control is shown in fig. 7.
According to an embodiment of the present invention, the present invention further provides a cloud storage system with a quantum encryption function, where the system includes a terminal side applied to the cloud storage system and a service side of the cloud storage system, the terminal side includes an APP and a security control based on a local client, the service side includes a cloud system for storing ciphertext data and a quantum security service platform based on a quantum random number generator, and the APP, the security control and the QRNG system are used to execute the cloud storage method.
It will be evident to those skilled in the art that the embodiments of the present invention are not limited to the details of the foregoing illustrative embodiments, and that the embodiments of the present invention are capable of being embodied in other specific forms without departing from the spirit or essential attributes thereof. The present embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the embodiments being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any reference sign in a claim should not be construed as limiting the claim concerned. Furthermore, it is obvious that the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural. Several units, modules or means recited in the system, apparatus or terminal claims may also be implemented by one and the same unit, module or means in software or hardware. The terms first, second, etc. are used to denote names, but not any particular order.
Finally, it should be noted that the above embodiments are only used for illustrating the technical solutions of the embodiments of the present invention and not for limiting, and although the embodiments of the present invention are described in detail with reference to the above preferred embodiments, it should be understood by those skilled in the art that modifications or equivalent substitutions can be made on the technical solutions of the embodiments of the present invention without departing from the spirit and scope of the technical solutions of the embodiments of the present invention.