WO2012071720A1

WO2012071720A1 - Method for controlling cloud storage data

Info

Publication number: WO2012071720A1
Application number: PCT/CN2010/079332
Authority: WO
Inventors: 刘慧�
Original assignee: 北京卓微天成科技咨询有限公司
Priority date: 2010-11-29
Filing date: 2010-12-01
Publication date: 2012-06-07
Also published as: CN102065129A

Abstract

The present invention particularly discloses a method for controlling cloud storage data, which belongs to the field of cloud storage data security technology. The method includes the steps: the original data to be stored are transformed to an irreversible data block by a preset way, to form the physical part of the original data, which is then stored in a cloud storage data center; the necessary information, for data restoring in the procedure of transforming the original data to the physical part, is output as the logical part of the original data, which is then stored and controlled by user. With the present invention, the original data to be stored are transformed to the physical part, the logical part for restoring the physical part to the original data information is output, the physical part is stored in the cloud storage data center, and the logical part is controlled by user. Therefore, the invention can control the physical part of data occupying the larger physical space by controlling the logical part occupying the smaller physical space, and performs the control on the owned data.

Description

Cloud storage data control method

Technical field

The invention belongs to the field of cloud storage data security technologies, and in particular relates to a method for cloud storage data control.

Background technique

Data has proven to be one of the company's key assets, and the rapid growth of data has made companies face unprecedented challenges. At the same time, the ever-changing world economic situation and the cost pressures of fierce competition have forced companies to consider how to reduce IT costs and respond to the growing storage needs of enterprises.

Existing storage architectures can be divided into two types: one is a proprietary architecture, such as

DAS (direct attached storage, direct attached storage), SAN (Storage Area Network) and network access storage (NAS). This kind of storage system is used exclusively by one party, which can provide users with good control, better reliability and performance, but its scalability is poor, and it is not suitable for large-scale deployment; users are also difficult in this mode. Flexible use of storage budgets requires a one-time investment in storage devices, and as storage capacity increases, cost control will also face challenges.

The other is a multi-party shared architecture, the cloud storage architecture. According to the scope of its services, it is divided into private cloud and public cloud. The cloud storage architecture is based on network technologies (internet and intranet) that provide storage space for on-demand purchase, lease, and on-demand provisioning services, typically provided by third parties or third-party departments within the enterprise, including storage devices and dedicated maintenance personnel. . Through this storage service, organizations or departments within the enterprise can significantly reduce their internal storage requirements and corresponding management costs to balance the sharply rising storage demands and corporate cost pressures. The users of the above mentioned storage may be individuals, enterprises, or even departments or branches within the enterprise.

However, regardless of the mode of operation of cloud storage (private and public), data owners are inevitably concerned about the security and privacy of their data. And this data is safe and The risk of privacy mainly comes from the loss of control over all data after the data is delivered to a third party, that is, the data can be accessed, copied, moved, rewritten, etc. without the authorization of the data owner.

Existing cloud storage security solutions are mostly targeted at cloud storage data centers, such as data encryption (documented in US 2008/0083036 Off-Premise Encryption of Data Storage, US 2008/0080718 Data Security in an Off-Premise Environment And US 2008/0081613 Rights Management in a Cloud literature), virtualization and improved access control and authentication mechanisms (described in US 2008/0081613 Rights Management in a Cloud, US 2009/ 0228950 Self-Describing Authorization Polic for Accessing Cloud-based Resources and US 2007/0039053 Security Server in the Cloud literature). The above methods have enhanced the data owner's protection of data to a certain extent, but these methods have not fundamentally solved the data owner's control over all of its data. Usually, because users cannot participate in the management of the cloud storage service data center, once the user passes their data to the cloud storage service provider for storage, the ownership of the data is out of the scope of user control.

Taking the public cloud as an example, after the user completely stores the data in the data center of the cloud storage service, the data is likely to be stored with the data of his competitors. The data owner cannot be wrong or the data caused by professional ethics. leakage.

Although encryption protects the data control by the user's key to a certain extent, it is worth noting that the data encryption technology used by the existing cloud storage data protection cannot be solved due to the problem that the key occupation space is too large. Applying the encryption algorithm of "one time, one confusing codebook", the existing data encryption technology used in cloud storage services cannot theoretically prove to be irreversible, that is, under certain conditions, such as having sufficient computing power and sufficient At the time, the encrypted ciphertext can be restored to plain text or partial plaintext. The specific content can be found in the "Application Cryptography Protocol, Algorithm and C Source Program" published by the Machinery Industry Press on March 1, 2003, pages 6 and 12. In other words, with the continuous advancement of decryption technology, the price of decryption hardware is rapidly declining and performance is rising. It is impossible to guarantee the full control of all data control by cloud storage users only through the encryption key, or even if the user grasps the encryption key. However, it still cannot prevent the data stored on the cloud storage data center from being illegally cracked and unauthorized.

In summary, existing cloud storage service solutions cannot prevent users from moving their data out of their control (mostly local) to save local storage space while maintaining control over all data, but the latter is usually the user. The main concern when choosing a cloud storage service.

Summary of the invention

It is an object of the present invention to provide a method of cloud storage data control that is directed to solving the problem that existing cloud storage technologies cannot prevent the user from maintaining control of all of their data after moving all of its data out of its control range.

The invention provides a method for cloud storage data control, the method comprising:

Converting the original data to be stored into an irreversible data block in a preset manner, forming a physical part of the original data, and storing the data in the cloud storage data center;

Outputting the raw data into information necessary for data restoration in the physical portion process, as a logical portion of the original data, storing the logical portion of the original data and being controlled by a user.

The invention converts the original data to be stored into a physical part, and outputs the physical part to the logical part of the original data information, stores the physical part in the cloud storage data center, saves the logical part and controls by the user, thereby realizing the control of the physical The logical part occupying a small space controls the physical part of the data that physically takes up a large space, and realizes the control of the owned data.

DRAWINGS

1 is a flowchart of a method for controlling cloud storage data according to an embodiment of the present invention; FIG. 2 is a flowchart of a method for converting physical data to be stored into data blocks to form physical parts of original data according to an embodiment of the present invention; 3 is a schematic diagram of a principle for reorganizing source data according to an embodiment of the present invention; FIG. 4 is a flowchart of a method for randomly reorganizing source data according to an embodiment of the present invention; FIG. FIG. 6 is a schematic flowchart of a method for generating a key used in a cryptographic codebook according to an embodiment of the present invention;

FIG. 7 is a schematic diagram of a method for collecting data according to an embodiment of the present invention.

detailed description

In order to make the objects, the technical solutions and the advantages of the present invention more comprehensible, the present invention will be further described in detail below with reference to the accompanying drawings. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

The invention converts the original data to be stored into a physical part, and outputs the physical part to the logical part of the original data information, stores the physical part in the cloud storage data center, saves the logical part and controls by the user, thereby realizing The control of the physical part that takes up less space controls the physical part of the data that physically takes up a large space, and realizes the control of the owned data.

Referring to FIG. 1, an embodiment of the present invention provides a method for controlling cloud storage data, where the method includes the following steps:

Step S101: Convert the original data to be stored into an irreversible data block in a preset manner to form a physical part of the original data;

The physical part is the real expression of the physical space occupied by the original data. It is a set of data blocks. Because the computer storage medium can only accept Q, l values, it is represented by a string of 0, 1 values, which is usually transformed by the original data through technical means. Come over (as with the method provided by the present invention), the converted data cannot be restored to the original data, no matter how much computing power and time, without the logical part information of the original data, so the physical part of the original data Irreversible; Step S102: outputting information necessary for data restoration in converting the original data into a physical part, as a logical part of the original data;

In the embodiment of the present invention, the logical part of the original data includes the physical part of the original data. The original data, that is, which data blocks are composed of the original data, the actual representation of the physical part of the original data, and other required information to be restored to the original data, which is not a large physical space, but is primitive. The physical part of the data is restored to the indispensable part of the original data; in addition, according to the storage needs, the logical part of the original data also includes the attributes of the original data, access rights and check values (such as MD5 values, verifying the retrieval of the data content) Accuracy) information;

Step S103: The physical part of the original data is stored in the cloud storage data center. In the embodiment of the present invention, the number of the cloud storage service data center that stores the physical part of the original data is not limited, and may be one or multiple; In addition, the embodiment of the present invention may further notify the data storage success or failure according to the result returned by the cloud storage data center; Step S104: save the logical part of the original data, and be controlled by the user;

The logical part of the original data is stored in a storage server within the scope of the user control, such as a local server, or may be stored in a storage medium that the user can carry with him, or may be stored in a cloud storage data center different from the physical part storing the original data or server.

In the embodiment of the present invention, after the user selects a certain original data to be stored and stores it in the designated cloud storage data center, the backup archiving strategy and plan of the data are set, and the original data is configured according to the set backup archiving strategy and plan. The conversion is converted to a logical part and a physical part.

After the original data conversion is completed, the physical part of the original data is sent to the designated cloud storage data center according to the set cloud storage service access agreement, such as authentication, payment billing record, etc., and the logical part of the original data is saved, and Controlled by the user.

Since there is no logical part of the original data, the physical part of the original data cannot be restored to the original data, or the physical part of the original data is only meaningless 0, 1 character without the logical part of the original data. Strings, which cannot be interpreted and used, thus achieve control over the entire data by controlling the logical part of the original data after being saved separately.

Referring to FIG. 2, an embodiment of the present invention provides a method for converting a raw data to be stored into a data block to form a physical part of the original data, where the method includes the following steps: Data blocks, and de-weighted to form source data;

Data deduplication has been widely used in the industry and will not be repeated here;

Step S202: After content reorganization of each source data, new data is formed;

The method of the present invention can adopt the method of sequentially reorganizing the data content in the content reorganization of each source data, or the method of randomly reorganizing the data content;

The data content order reorganization method comprises: arranging rules in a fixed order of presets, collecting data in the same position in each source data; combining the collected data in order to form new data; for example, arranging the specified groups by grouping The n m-bit source data is vertically reorganized to form m n-bit new data, that is, the sequence reorganization of the content of the grouped source data is completed, as shown in FIG. 3;

The data content random reorganization method includes the following steps, as shown in Figure 4:

Step S301: traversing the source data corresponding to the new data according to the preset data recombination rule; Step S302: collecting data from the source data according to the preset data collection rule;

Step S303: Combine the collected data in order to form new data;

The specific implementation method of random reorganization of data content, see FIG. 5, assumes that the original data is converted, and obtains a series of source data, that is, source data 2 - source data i, and all or part of the source data corresponding to the original data is combined with other source data. a set of source data to be reorganized;

If the n f-bit source data in the specified group is reorganized into m g-bit new data, each new data corresponds to p source data (1 pn, p too large affects performance, too small will affect security), The source data corresponds to r new data (1 rm ). In the process of constructing new data, data is collected from each source data u times, each time taking V bits (l v f );

Identifies the i-th source data as sdi and the k-th new data as td _k . Where m, n, p, r, i, k are all natural numbers, u, v are integers greater than or equal to 0, p, u, V are all true random numbers;

The detailed construction process is as follows: When constructing the kth new data (td _k ), first traverse its corresponding p source data, collect U times from each source data, and collect V-bit data each time. The kth new data is identified from the i-th source data (1 (1 1) data is identified as Ext _iq ^k ( s _iq , e _iq ), where s _iq is a randomly generated data collection Starting cursor position, e _iq is random The end cursor position of the generated data acquisition, s _iq , e _iq are natural numbers, and s _iq e _iq , if s _iq =e _iq , then the number of bits of the data acquisition is 0, obviously v= e _iq -s _Iq +l. Combining the collected data in order is the new data that needs to be built. Expressed as:

Tdk = ( Extn ( Sn, en ) , Extn ( ) , ···, Ext _pu ^k ( ) ) . At the same time, after each data collection, the correspondence between the source data and the new data is synchronously generated. Suppose the q-th sdi from the collected data bits V, i.e. _{^{_{Ext iq k (s iq, e}}} iq), placed in corresponding positions td _k (in the acquired data is placed in the can calculate td _k) is denoted V-bit data acquisition sdi td corresponding data bits _k is Rxt kq (Skq, © kq) , wherein s _kq for acquiring data corresponding to the starting cursor position _k td, e _kq for the acquired data in td _k Corresponding termination cursor position, Skq, ©kq are natural numbers, and s _kq e _kq , if it is said that the number of digits of the data acquisition is 0, further analysis shows that the source data sdi can collect its corresponding new data by reverse Specify the order of the data bits, that is,

Sdi = ( Rxtn ¹ ( Sn, en ) , Rxt^ ¹ ( Si ₂ , Qn ) , ··· , Rxtj-u ¹ ( ) ) Similarly, when constructing the k+1th new data, traversing the kth The source data corresponding to +1 new data is collected according to the above method. (The collected data cannot be duplicated with the previously collected data, that is, the data in the source data cannot be repeatedly collected), and so on, until all source data is reorganized. Complete, and generate all new data and all source data and new data correspondence.

In the above method, each source data and the recombined new data may be fixed length or indefinite length, and p, U, V may be variables, that is, each time new data is constructed, they may be different; p, u, V true random number generation method, Mechanical Industry Press, March 1, 2003, "Application Cryptography Protocol, Algorithm and C Source Program", page 301, gives a variety of real random numbers. Methods, such as using random noise, using computer clock, CPU load, network packet arrival times, etc., will not be described here. Suppose that some true random numbers Rl, R2, R3 have been generated in some way, then

p = Rl mod n

u = R2 mod w

v = R3 mod f '

Where 3⁄4/ is the modulo operation, w is the maximum value of the specified u, Γ is in the source data The remaining number of uncollected data bits;

Step S203: Encrypt the new data with a cryptographic code encryption algorithm at a time to obtain a physical part of the original data.

After the content data is reorganized in the embodiment of the present invention, the unresolved "one time and one confusing codebook" encryption algorithm is used to encrypt the reassembled data, thereby improving the security of the original data.

After the foregoing step S203, the embodiment of the present invention simultaneously outputs and saves the correspondence relationship between the new data and the source data, the source data and the original data, and the correspondence relationship between the new data and the key into the logical part of the original data.

Referring to FIG. 6, an embodiment of the present invention provides a key generation method for a one-time chaos codebook encryption algorithm, and the steps are as follows:

Step S601: Generate a true random number of a predetermined length and a random seed of a predetermined length formed by a true random array according to a preset method;

Step S602: Randomly collecting data from the random seed multiple times, and merging each collected data into a true random data string not less than the plaintext length;

Step S603: Generate a true random key of the same length as the plaintext by using the true random data string.

When the length of the true random data string is equal to the length of the plaintext, the true random data string may be selected as the true random key for encryption; when the length of the true random data string is greater than the length of the plaintext, the random start of the true random data string Position traversing the true random data string to select a data string of the same length as the plaintext to generate a true random key. If the data string of the same length as the plaintext has not been selected at the end of the true random data string, return to the true random data string header to continue. Select until you select a data string that is as long as the plain text.

A method of generating a random key used for encryption of a codebook at a time in the embodiment of the present invention is provided below, but the scope of protection of the present invention is not limited to this implementation.

In this implementation, the generated true random key is fixed length, that is, equal to the plaintext length.

The following m, n, l, p are all natural numbers, where m is the length of the random seed, / is the length of the random key required to be generated (equal to the length of the plaintext), and p is the data bit already generated in the random key The number, ί _ρ is the number of bits of the uncollected data remaining in the random key. First, a true random number 0, 1 string of a predetermined length m bits and a random seed of a predetermined length composed of a true random number are generated and stored for storage;

Secondly, the random seed is collected for n times of random data. If the data is collected to the end of the random string, the data is collected back to the random seed head, and the data collected each time is cascaded into a true random number of predetermined length/bit. The data string, that is, the true random key (/ is equal to the length of the plaintext).

Before each data acquisition, two true random numbers are generated first, and then the two true random numbers are respectively modulo, and the starting cursor position and the required data length required for random data acquisition are obtained.

The starting cursor position and the collected data length (which can be greater than or equal to 0) for each data acquisition are random.

Assuming that two true random numbers M, R2 are generated before data acquisition, then it is now necessary to generate two random values Tl, Τ2 which are less than m and /-Ρ, respectively, then

Tl = Rl mod m

T2 = R2 mod( l -p)

Among them, mod is a modulo operation.

Referring to Figure 7, the true random key corresponding to the kth plaintext is re _k (k is a natural number), then re _k is equal to the sequential combination of the n randomly collected data from the random seed of the predetermined length, recorded from the random seed The data collected by i times is (Cur _s , Cur _e ) i , where Cur _s is the starting cursor position of the i-th collected data in the random seed, and accordingly Cur _e is the ending cursor position of the i-th collected data, Cur p Cur _e is identified by the offset from the random seed head. It can be seen that Cur p Cur _e is an integer greater than or equal to 0 and less than or equal to m, and Cur _{e is} greater than or equal to Cur _s . When Cur _e is equal to Cur _s , the data is collected. The number of bits is 0. Then the data collected in the i-th time is the data between Cur _s and Cur _e in the random seed of the specified length. Further, re _k can be expressed as:

Re _k = [ (Cur _s , Cur _e ) i , (Cur _s , Cur _e ) ₂ , .... (Cur _s , Cur _e ) i , .... (Cur _s , Cur _e ) _n ] _k

The above is only one implementation method. In addition, a key generation method for determining a random number of random data with a fixed number of data may be used, that is, n is determined, / is uncertain; indefinite data acquisition times fixed length random key generation Method, that is, n is indefinite, / is deterministic; indefinite data acquisition times are indefinitely long, random key generation methods, that is, n and / are indefinite; random key pair is random The method of encrypting the plaintext after the key is calculated by a predetermined number of times.

After generating the above-mentioned true random key, it encrypts the new data after the content is reorganized, thereby realizing the purpose of encrypting the data by the method of "one time, one secret codebook".

Since the traditional cloud storage data encryption method has no precedent for applying the "one-time-one-time codebook" encryption algorithm, the restoration of the data physical part to the source data of the cloud storage data center end protected by the traditional encryption method is theoretically reversible. However, the technical solution proposed by the present invention can realize the irreversible reduction of the physical part of the data to the source data of the cloud storage data center end that is protected, that is, it cannot be cracked.

To further clarify the feasibility of the present invention, the physical space occupied by the logical portion of the original data is analyzed as follows:

First, the physical space analysis of the logical part of the original data under the sequential reorganization method. In the method, the logical part information of the original data includes the correspondence between the source data and the new data in the content reorganization and the plaintext (new data after the content reorganization) ) Correspondence with random keys.

It is assumed that a plurality of sizes of 1 MB deduplicated data blocks need to be reorganized and encrypted, and the encryption function uses an exclusive OR operation (the length of the random key is required to be equal to the plaintext), and each random key generation needs to randomly collect data 100 times.

Since the arrangement of the source data and the new data in the sequential reorganization is regular, the physical space occupied by the correspondence between them can be neglected, as long as the order of the source data and the new data is recorded.

The following is an analysis of the space occupied by the correspondence between plaintext and random keys after encrypting with "one-time-one-time codebook":

Assume that it is now necessary to generate a data length of 8M (=8, 000, 000) to encrypt 1MB (also 8M bits) of data. The size of the random seed used is 1Gbit, that is, 1000, 000, 000 bits of random 0, 1 string. To set the generation of each random key, it is necessary to randomly collect data 100 times, that is, n=100.

Then, each cursor bit occupies a physical space of no more than 4 bytes (Byte), so each time the data acquisition cursor expression needs to occupy a physical space of no more than 8 bytes, then 100 times of acquisition, that is, 800 bytes, that is, no More than 10 ²⁴ bytes (=1KB). Therefore, after 1 MB of source data is randomly reorganized by data content and converted by a cryptographic code encryption method, a physical space of about 800 B is required to store the logical part information of the source data, and further calculation is available, and the logical part information of the source data is The source data occupies a physical space ratio of approximately 1:1250. Since the source data is decomposed by the original data, the proportion of the relative physical space occupied by the logical part of the original data is smaller.

Second, the spatial analysis of the logical part of the data under the random reorganization method

In the same order recombination method, the logical part information of the original data includes the correspondence between the source data and the new data and the correspondence between the plaintext (new data after content reorganization) and the random key.

Regarding the physical space analysis occupied by the correspondence between the saved source data and the new data: Corresponding to the restoration of each source data, the correspondence information between the source data and the new data to be saved is mainly:

Sdi = ( Rxtn ¹ ( Sn, en ) , Rxt^ ¹ ( s ₁₂ , e ₁₂ ) ,... , Rx ί _Γυ ' ( ) ) If the source data and the recombined new data size are both 1MB, ie source data and new data length can be calculated for each new data cursor (i.e. s _kq or e _kq, wherein s _kq td _k corresponds to the data acquisition for the initial cursor position, e _kq td _k corresponds to the data acquired for the The termination of the cursor position) The occupied physical space is not greater than 3B, so the physical space occupied by each corresponding data in the corresponding relationship at td _k start and end cursors is not greater than 6B. The generation of each new data needs to be collected 100 times (that is, data is collected once for each corresponding source data when generating new data), that is to say, generating 1MB of new data requires 600B of physical space to store new data and source data. Correspondence relationship.

Under the one-time encryption method, the physical space occupied by the correspondence between the plaintext (new data after content reorganization) and the random key is as follows:

Assume that it is now necessary to generate a data length of 8M (= 8,000, 000) to encrypt 1MB (also 8M bits) of data. The size of the random seed used is 1Gbit, that is, 1000, 000, 000 bits of random 0, 1 string. To set the generation of each random key, it is necessary to randomly collect data 100 times, that is, n=100.

Then, each cursor bit occupies a physical space of no more than 4 bytes (Byte), so each time the data acquisition cursor expression needs to occupy a physical space of no more than 8 bytes, then 100 times of acquisition, that is, 800 bytes. Therefore, after 1MB of source data is randomly reorganized by data content and converted by a cryptographic code encryption method, a physical space of about 1 400 B is needed to store the logical part information of the source data, and further calculation is available, and the logical part information of the source data is obtained. The ratio of physical space occupied by the source data is approximately 1: 7 30. Since the source data is decomposed by the original data, the proportion of the relative physical space occupied by the logical part of the original data is smaller.

It should be pointed out that the calculation of the physical space occupied by the logical part of the above two methods does not count the physical space occupied by the random seed used (because it is a one-time overhead, shared by all data to be encrypted). It can be further seen that the design object of the present invention can be achieved by the above content recombination and one-time encryption code method encryption, that is, the data is reasonably converted and transformed into a physical part and a logical part of the original data, wherein the physical part The occupied physical space is large, and the logical part occupies less physical space.

In the above two implementations, the physical part of the original data cannot be restored to the original data alone without the logical part of the original data.

Because, once a chaotic codebook encryption algorithm, no matter how powerful the computer, can not be cracked, see "Application Cryptography Protocol, Algorithm and C Source Program" published by Mechanical Industry Press, pages 6, 12;

Secondly, even if the cryptanalyst obtains a suspicious plaintext through countless attempts, all the plaintexts are equal in the one-time encryption code encryption algorithm system. All keys are random and used only once, cryptanalysis It is impossible to determine which is the correct plaintext, because all data content has been reorganized before data encryption and transmission, so the so-called "suspicious" plaintext obtained cannot be correctly interpreted.

In summary, through the above method, the physical part of the original data cannot be restored to the original data separately.

The data block formed after the conversion of the original data is subjected to de-reprocessing, content recombination and encryption processing, so that the original part of the data cannot be separately restored on the premise that the physical part of the original data has no logical part information of the original data. The logical portion of the original data occupies a small space of 4, thereby realizing control of the entire data by controlling the logical portion of the data occupying a small physical space, and then storing the logical portion and the physical portion of the original data separately. Reaching the goal of users using cloud storage services to save local storage space while maintaining control of all their data.

After receiving the external access request for the original data, the embodiment of the present invention first acquires a logical part corresponding to the original data to be accessed, and restores the physical part of the original data to the original data, and then according to the predetermined cloud storage service. Access protocols, such as authentication, paid billing records, etc., and the acquired logical portion retrieves the corresponding physical portion from the cloud storage data center where the physical portion of the original data is to be accessed, and then, based on the information stored in the logical portion of the original data obtained, The physical part of the retrieved original data is aggregated and restored to the accessed original data, and the restored original data is handed over to the external access request, thereby realizing the restoration of the data retrieval.

The invention converts the original data to be stored into data blocks to form a physical part of the original data, and restores the physical part of the original data to a logical part of the original data information, and the physical part of the original data is in the absence of the logical part of the original data. , can not be restored to the original data, and then the physical part of the original data is stored in the cloud storage data center, the logical part of the original data is saved and controlled by the user, and the physical part is controlled by controlling the physical part occupying a small space. The physical part of the original data occupies a large space, thereby realizing the user's control over the data possessed, and ensuring the security and privacy of the user data, and achieving the purpose of saving physical storage space.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. Within the scope.

Claims

Claim

A cloud storage data control method, the method comprising: converting raw data to be stored into an irreversible data block in a preset manner, forming a physical part of the original data, and saving the cloud data in a cloud storage data center;

2. The method of cloud storage data control according to claim 1, wherein the physical portion of the original data is a string of computer readable values of 0, 1 that do not have the original data features; The physical part of the data is irreversible.

3. The method of cloud storage data control according to claim 1, wherein the logical portion of the original data includes attributes, access rights, and check value information of the original data.

The method for controlling cloud storage data according to claim 1, wherein the logical portion of the original data is stored in a storage medium that can be carried around, or stored in a local server, or stored in a storage device different from the storage device. A server that describes the physical part of the original data.

The method for controlling the cloud storage data according to claim 1, wherein the step of converting the original data to be stored into an irreversible data block in a preset manner, and forming the physical portion of the original data comprises: : and then form the source data after de-duplication;

Reorganize the content of each source data to form new data;

Each new data is encrypted with a one-time scribble code encryption algorithm to obtain the physical portion of the original data.

The method for controlling the data storage of the cloud according to claim 5, wherein the step of reorganizing the content of each source data to form new data comprises:

Arrange the rules in a fixed order of presets, and collect the same position in each source data. Data

The collected data is combined in order to form new data.

The method for controlling the cloud storage data according to claim 5, wherein the step of reorganizing the content of each source data to form new data comprises:

Traversing the source data corresponding to the new data according to the preset data recombination rule; collecting data from the source data according to the preset data collection rule;

The collected data is combined in order to form new data.

The method for controlling the cloud storage data according to claim 5, wherein the step of encrypting each new data by using the one-time encryption code encryption algorithm comprises: generating and storing a predetermined length according to a preset method a true random number and a random seed of predetermined length consisting of the true random number;

Collecting data randomly from the random seed multiple times, and merging each collected data into a true random data string not less than the plaintext length;

Generating, according to the true random data string, a true random key that is equal in length to the plaintext; encrypting each new data with the true random key.

The method for controlling cloud storage data according to claim 8, wherein the step of encrypting each new data with the true random key further comprises:

Outputting and saving the new data and the source data, the source data and the original data, and the correspondence relationship between the new data and the true random key to the logic of the original data