WO2023272747A1

WO2023272747A1 - Scientific research data security protection system based on cloud fusion and working method thereof

Info

Publication number: WO2023272747A1
Application number: PCT/CN2021/104395
Authority: WO
Inventors: 宁静仪; 谢磊; 叶保留
Original assignee: 南京大学
Priority date: 2021-06-29
Filing date: 2021-07-03
Publication date: 2023-01-05
Also published as: CN113342896A; CN113342896B

Abstract

Disclosed in the present invention are a scientific research data security protection system based on cloud fusion and a working method thereof. The system comprises a storage medium having a wireless communication chip, a cloud server, and a client, wherein the storage medium is used for storing protected scientific research data, implementing data synchronization with a cloud, and implementing management and control of user's read-write operation in cooperation with the cloud; the cloud server implements information management of the storage medium and a user, provides an encryption service to implement validity authentication of the storage medium and the user, stores scientific research data, and keeps the scientific research data consistent with the storage medium; and the client sends an identity authentication request to the storage medium when the user applies for read-write operation on the storage medium, and the data in the storage medium is decrypted according to a key after the authentication is passed, thereby completing the read-write operation. According to the present invention, the validity of the storage medium having the wireless communication chip and the validity of the user are authenticated by using cloud fusion technology, and the read-write operation of the user is controlled, such that the security of the scientific research data and user privacy is ensured.

Description

A research data security protection system based on cloud integration and its working method

technical field

The invention belongs to the technical field of computer information security and cloud computing, and specifically relates to a scientific research data security protection system based on cloud integration and a working method thereof.

Background technique

In today's information age, the convenience and security of information storage has become the top priority. Most of the various storage media currently on the market have the characteristics of small size and large capacity, so burning and encrypting scientific research data through storage media has good convenience and scalability. However, due to the small size of the storage medium, it is often difficult to detect the loss and the data cannot be retrieved; on the other hand, a large number of virus programs threaten the security of the storage medium files, which may lead to malicious tampering of scientific research data, leakage of data and user privacy, etc. question.

The encryption protection mode of current storage medium mainly contains following several: 1) Encryption based on plain text password: set fixed unlocking password, can't read the file in the storage medium when can't input correct password. However, there are currently a large number of password cracking programs, and fixed passwords can be used to perform brute force cracking in parallel in linear time, making it difficult to protect the security of storage media data. 2) A hash-based encryption method, by setting a fixed encryption and decryption key, encodes and decodes the storage medium file. However, since the resources stored in the storage medium are often relatively large, it will take a lot of time to map the hash key. At the same time, if the key is lost, the files in the storage medium will be completely undecryptable, and there is a risk of information loss.

Therefore, a new storage method is needed to realize the effective protection of scientific research data.

Contents of the invention

In view of the deficiencies of the above-mentioned prior art, the purpose of the present invention is to provide a scientific research data security protection system based on cloud integration, so as to solve the problems in the prior art that data storage devices are vulnerable to malicious attacks or user data leakage. The present invention adopts cloud collaboration technology to realize identity authentication for scientific research data storage devices and users, thereby realizing the effectiveness of data protection.

In order to achieve the above object, the present invention adopts following technical scheme:

A scientific research data security protection system based on cloud integration, including: a storage medium with a wireless communication chip, a cloud server, and a client; wherein,

The storage medium with a wireless communication chip stores the protected scientific research data, realizes data synchronization with the cloud server, and cooperates with the cloud server to realize user read and write control and self-destruct protection in the out-of-control state;

The cloud server realizes the information management of the storage medium and the user, provides encryption services to realize the legality authentication of the storage medium and the user, stores the protected scientific research data and keeps it consistent with the storage medium;

When the user applies for reading and writing operations on the storage medium, the client sends an identity authentication request to the storage medium. After the authentication is passed, the data on the storage medium is decrypted according to the key, and the read and write operations are completed.

Further, the structure of the storage medium with a wireless communication chip includes: a wireless communication chip, a USB interface, and a memory, wherein the wireless communication chip supports multiple wireless communication methods, the USB interface is used to connect a client device, and the memory stores Protected research data, private keys for storage media legality verification, and hash functions for user identity verification.

Further, the realization of data synchronization between the storage medium with the wireless communication chip and the cloud server refers to that the storage medium sends a data synchronization request to the cloud server every time a certain period of time passes or when the stored data changes, and According to the synchronization command of the cloud server, the data synchronization with the cloud server is completed to ensure that the data in the storage medium is consistent with the cloud server.

Furthermore, when the storage medium has its own power supply, the data is synchronized with the cloud server at regular intervals; when the storage medium does not contain a power supply, the data is synchronized with the cloud server after each read and write operation by a legitimate user .

Further, the storage medium with a wireless communication chip realizes cooperation with the cloud server to control the reading and writing of the user, which means that when the user connects the storage medium to the client device through the USB interface, the storage medium receives the user’s data from the client. ID and password are hashed and sent to the cloud server for user legality authentication. If the cloud server passes the authentication, the key is returned to the client to complete the decryption and read and write operations of the storage medium data.

Further, the self-destruction protection function of the storage medium with a wireless communication chip occurs when the storage medium data and key are obtained by an illegal user, at this time, the storage medium self-destruction module starts and erases all data inside the storage medium remove.

Further, the cloud server includes a data storage module, a storage medium authentication module and a user authentication module, wherein the data storage module stores scientific research data synchronized with the storage medium, storage medium ID and public key pair information, user ID and password hash Greek value signal; the storage medium authentication module responds when the storage medium requests data synchronization, and completes the authentication of the validity of the storage medium by calling the storage medium ID and public key pair information from the data storage module; the user authentication module requests the user to read Respond when the permission is written, and complete the authentication of user identity information by calling the user ID and password hash value information from the data storage module.

The protection method of the scientific research data security protection system based on the above-mentioned cloud fusion includes the following steps:

1) The user sends a read and write data request to the storage medium;

2) After the storage medium receives the read and write request from the user, it sends the user's read and write request command to the cloud server, and implements cloud collaborative user identity authentication;

3) After receiving the request, the cloud server authenticates the legitimacy of the user. If the authentication is passed, the key is returned to allow the user to decrypt the data on the storage medium and complete the read and write operations; if the authentication fails, the key is not returned;

4) Every fixed time or when the data of the storage medium changes, the storage medium sends a data synchronization request to the cloud server for data update to ensure that the protected scientific research data is always consistent with the cloud server;

5) After receiving the data synchronization request, the cloud server authenticates the validity of the storage medium. If the storage medium is judged to be legal, the data synchronization is completed; if the storage medium is illegal, the data synchronization is rejected.

The present invention has the following beneficial effects:

1. High reliability of data storage: The data stored in the cloud server is always synchronized with the scientific research data in the storage medium, and before each synchronization operation, the cloud server can authenticate the legality of the storage medium to avoid malicious write attacks.

2. High security of data storage: The collaborative management and control of cloud server and storage media can effectively authenticate user identities, avoiding leakage of user privacy and malicious writing by illegal users.

3. Accident monitoring: When there is a possibility of data leakage, start the self-destruct mode to erase the scientific research data in the storage medium to prevent data leakage, but the cloud server still saves data backups, which not only ensures safety but also meets data storage requirements.

Description of drawings

Fig. 1 is the structure diagram of the scientific research data security protection system of cloud integration provided by the embodiment of the present invention;

Fig. 2 is the work flowchart of the scientific research data safety protection system of cloud integration provided by the embodiment of the present invention;

FIG. 3 is an architecture diagram of user identity authentication for cloud collaboration provided by an embodiment of the present invention;

FIG. 4 is a structural diagram of storage medium legality authentication provided by an embodiment of the present invention.

detailed description

In order to facilitate the understanding of those skilled in the art, the present invention will be further described below in conjunction with the embodiments and accompanying drawings, and the contents mentioned in the embodiments are not intended to limit the present invention.

Referring to FIG. 1 , an embodiment of the present invention provides a scientific research data security protection system based on cloud integration, including: a storage medium with a wireless communication chip, a cloud server, and a client.

Among them, the storage medium with the wireless communication chip stores the protected scientific research data, realizes the data synchronization with the cloud server, the legality certification of the storage medium, and cooperates with the cloud to realize the user's read and write control and the self-destruct protection function in the out-of-control state. Wherein, the type of the storage medium includes but not limited to U disk, mobile hard disk, SD card and so on.

The structure of the storage medium with a wireless communication chip includes: a wireless communication chip, a USB interface and a memory, wherein the communication methods supported by the wireless communication chip include but are not limited to 3G/4G/5G, Bluetooth, Wi-Fi, etc.; In connection with the client, the storage stores protected scientific research data, private keys for storage medium legality authentication, and hash functions for user identity authentication. Therefore, the storage medium can respectively realize the communication with the cloud and the client to realize the corresponding security authentication function.

The data synchronization between the storage medium with the wireless communication chip and the cloud server refers to that the storage medium sends a data synchronization request to the cloud server every time a certain period of time passes or when the stored data changes to ensure that the data in the storage medium Consistent with the cloud server. When the storage medium has its own power supply, the data is synchronized with the cloud server at regular intervals; when the storage medium does not contain a power supply, the data is synchronized with the cloud server after each read and write operation by a legitimate user.

The storage medium with a wireless communication chip realizes the collaborative cloud server to control the user's reading and writing. When the user connects the storage medium to the client device through the USB interface, the storage medium receives the user ID and password from the client and performs After the hash operation, it is sent to the cloud server for user legality authentication. If the cloud server passes the authentication of the user, it will return the key to the client to complete the decryption and read and write operations of the storage medium data. Optionally, if the legality authentication of the user fails, the cloud server sends an instruction to the storage medium that the current user is an illegal user.

The self-destruction protection function of the storage medium with a wireless communication chip occurs when the storage medium receives an instruction from the cloud server to determine that the current user is an illegal user, but receives a legal password provided by the illegal user for decrypting the content of the storage medium. key. At this time, the key may be obtained by illegal users through brute force cracking, etc., then the storage medium starts the self-destruct module to erase all data inside the storage medium and sends an abnormal state reminder to the cloud server.

In one embodiment, the storage medium with the wireless communication chip includes a data synchronization module, a read-write control module, and a self-destruction protection module. Wherein, the data synchronization module is used to realize the data synchronization between the storage medium and the cloud server, and the data synchronization occurs at a fixed period of time (for example, when the data synchronization timer Timer1 expires) or when the stored data changes, the storage The data synchronization module in the medium sends a data synchronization request to the cloud server, and completes data synchronization with the cloud server according to the synchronization command returned by the cloud server, ensuring that the data in the storage medium is consistent with the cloud server. The read-write control module is used to cooperate with the cloud server to realize user read-write control. Specifically, when the user connects the storage medium to the client device through the USB interface, the read-write control module of the storage medium receives the user ID and password from the client. Use the hash function stored in the storage to perform a hash operation and send it to the cloud server for user legality authentication, and complete the decryption and read and write operations of the protected data according to the key returned by the cloud server. The self-destruction protection module is used to self-destruct when the storage medium is identified as being out of control to protect data from leakage. Specifically, when the data and keys in the storage medium are obtained by an illegal user, that is, When the instruction from the cloud server determines that the current user is an illegal user, but receives the legal key provided by the illegal user for decrypting the content of the storage medium, the self-destruct function is activated and all data inside the storage medium is erased, and at the same time Send an abnormal status reminder to the cloud server.

The cloud server is responsible for data management, storage media and user information management, and implements identity authentication and user read and write operation control for storage media and users. The cloud server includes a data storage module, a storage medium authentication module and a user authentication module, wherein the data storage module stores scientific research data synchronized with the storage medium, storage medium ID and public key pair information, user ID and password hash value signals; The media authentication module responds when the storage media requests data synchronization, and completes the legality authentication of the storage media by calling the storage media ID and public key from the data storage module; the user authentication module responds when the storage media requests the user's read and write permissions , by calling the user ID and password hash value information from the data storage module to complete the authentication of the user identity information.

When the user applies for reading and writing operations on the storage medium, the client sends an authentication request to the storage medium. After the authentication is passed, the data on the storage medium is decrypted according to the key to further complete the read and write operations.

Referring to Figure 2, a working method of a cloud fusion-based scientific research data security protection system provided by an embodiment of the present invention includes the following steps:

1) The user sends a read and write data request to the storage medium;

4) Every fixed time (for example, when the data synchronization timer Timer1 expires) or when the storage medium data changes, the storage medium sends a data synchronization request to the cloud server for data update to ensure that the protected scientific research data is always consistent with the cloud server ;

With reference to shown in Figure 3, the user identity authentication method of the cloud collaboration in described step 2) is:

21) The user connects the USB interface of the storage medium to the client device, and sends a read and write operation command to the storage medium by inputting the user ID and the corresponding user password s at the client;

22) After receiving the user ID _u and password s from the client, the storage medium calculates the hash value H(s) of the password according to the hash function, and then sends the user ID _u and the hash value H(s) to the cloud server ;

23) The user authentication module of the cloud server queries the user ID _u and the corresponding hash value <ID _u , h> from the data storage module.

24) If the hash value H(s) sent by the storage medium is consistent with the hash value h stored in the cloud server data storage module, the current user is considered to be a legitimate user, and the user authentication module calls the data storage module to find the content of the current storage medium The corresponding key key is returned to the storage medium, and the storage medium sends the key key to the client to enable the user to complete the operation of reading and writing data in the storage medium; if the hash value H(s) sent by the storage medium is consistent with the cloud server data If the hash value h stored in the storage module is inconsistent, the current user is considered to be an illegal user, and the user authentication module of the cloud server sends a command to the storage medium to deny read and write operations, so that the user cannot effectively decrypt the data in the storage medium; When the cloud server determines that the current user is an illegal user and the key is obtained by the illegal user through brute force cracking, etc., it will start the storage medium self-destruct mode, erase the stored scientific research data and send an abnormal status reminder to the cloud server.

Shown in Fig. 4 with reference to, described step 5) in the method to storage medium legitimacy authentication is:

51) The storage medium sends a data synchronization request to the cloud server;

52) The cloud server invokes the storage medium authentication module to authenticate the legality of the storage medium. First generate a random number R and return it to the storage medium;

53) The storage medium encrypts the random number R with the private key K _pri stored in its own memory and sends the result K _pri (R) back to the cloud server;

54) The storage medium authentication module of the cloud server queries the storage medium ID and public key pair <ID _d , K _pub > from the data storage module, and uses the public key K _pub of the storage medium to decrypt the data K _pri (R). If the result obtained is the same as the random number R sent before, it is considered that the storage medium currently communicating with it is legal, and a synchronization data command is sent to the storage medium to complete data synchronization; if the result decrypted with the public key is the same as the previously generated random number If R is different, it is considered that the storage medium currently communicating with it may have been maliciously attacked or illegally tampered with, and the data synchronization request of the storage medium is rejected.

The present invention synchronizes with cloud data through cloud fusion technology, not only can backup and save the data in the storage medium in the cloud, but also cooperate with the cloud to authenticate the legitimacy of the storage medium and users, which fully guarantees the privacy of scientific research data and users safety. In addition, the present invention minimizes the overhead of encryption and decryption, avoiding impact on user experience.

There are many specific application approaches of the present invention, and the above description is only a preferred embodiment of the present invention. It should be pointed out that for those of ordinary skill in the art, some improvements can also be made without departing from the principles of the present invention. Improvements should also be regarded as the protection scope of the present invention.

Claims

A scientific research data security protection system based on cloud fusion, characterized in that it includes: a storage medium with a wireless communication chip, a cloud server, and a client; wherein,

The storage medium with a wireless communication chip stores the protected scientific research data, realizes data synchronization with the cloud server, and cooperates with the cloud server to realize user read and write control and self-destruct protection in the out-of-control state;

The cloud server realizes the information management of the storage medium and the user, provides encryption services to realize the legality authentication of the storage medium and the user, stores the protected scientific research data and keeps it consistent with the storage medium;

When the user applies for reading and writing operations on the storage medium, the client sends an identity authentication request to the storage medium. After the authentication is passed, the data on the storage medium is decrypted according to the key, and the read and write operations are completed.
The scientific research data security protection system based on cloud fusion according to claim 1, wherein the storage medium with a wireless communication chip includes a wireless communication chip, a USB interface and a memory, wherein the wireless communication chip supports a variety of wireless The communication method is connected to the cloud server, the USB interface is used to connect the client device, the protected scientific research data is stored in the memory, the private key used for the legality authentication of the storage medium, and the hash function used for the user identity authentication.
The scientific research data security protection system based on cloud integration according to claim 1, wherein the storage medium with a wireless communication chip realizes data synchronization with the cloud server means: every time a fixed period of time or When the stored data changes, the storage medium sends a data synchronization request to the cloud server, and completes data synchronization with the cloud server according to the cloud server's synchronization command, ensuring that the data in the storage medium is consistent with the cloud server.
The scientific research data security protection system based on cloud integration according to claim 3, wherein when the storage medium has its own power supply, the data is synchronized with the cloud server at regular intervals; when the storage medium does not contain a power supply , the data is synchronized with the cloud server after each read and write operation by a legitimate user.
The scientific research data security protection system based on cloud integration according to claim 1, wherein the storage medium with a wireless communication chip realizes the collaboration of the cloud server to control the reading and writing of the user. When connected to the client device through the USB interface, the storage medium receives the user ID and password from the client, performs a hash operation, and sends it to the cloud server for user legality authentication, and completes the storage medium data according to the key returned by the cloud server. Decryption and read and write operations.
The scientific research data security protection system based on cloud integration according to claim 1, wherein the self-destruction protection function of the storage medium with the wireless communication chip occurs when the storage medium data and key are obtained by an illegal user , at this time the storage medium self-destruct module starts and erases all data inside the storage medium.
The scientific research data security protection system based on cloud integration according to claim 1, wherein the cloud server includes a data storage module, a storage medium authentication module, and a user authentication module, wherein the storage in the data storage module is synchronized with the storage medium Scientific research data, storage medium ID and public key pair information, user ID and password hash value signal; the storage medium authentication module responds when the storage medium requests data synchronization, by calling the storage medium ID and public key pair from the data storage module The information completes the authentication of the validity of the storage medium; the user authentication module responds when the storage medium requests the user to read and write permissions, and completes the authentication of the user identity information by calling the user ID and password hash value information from the data storage module.
The working method of the scientific research data security protection system based on cloud fusion according to any one of claims 1-7, characterized in that, comprising the following steps:

1) The user sends a read and write data request to the storage medium;

2) After the storage medium receives the read and write request from the user, it sends the user's read and write request command to the cloud server, and implements cloud collaborative user identity authentication;

3) After receiving the request, the cloud server authenticates the legitimacy of the user. If the authentication is passed, the key is returned to allow the user to decrypt the data on the storage medium and complete the read and write operations; if the authentication fails, the key is not returned;

4) Every fixed time or when the data of the storage medium changes, the storage medium sends a data synchronization request to the cloud server for data update to ensure that the protected scientific research data is always consistent with the cloud server;

5) After receiving the data synchronization request, the cloud server authenticates the validity of the storage medium. If the storage medium is judged to be legal, the data synchronization is completed; if the storage medium is illegal, the data synchronization is rejected.
Based on the working method described in claim 8, it is characterized in that the user identity authentication of cloud collaboration in said step 2) includes:

21) The user connects the USB interface of the storage medium to the client device, and sends a read and write operation command to the storage medium by inputting the user ID and the corresponding user password s at the client;

22) After receiving the user ID u and password s from the client, the storage medium calculates the hash value H(s) of the password according to the hash function, and then sends the user ID u and the hash value H(s) to the cloud server ;

23) The user authentication module of the cloud server queries the user ID u and the corresponding hash value <ID u , h> from the data storage module;

24) If the hash value H(s) sent by the storage medium is inconsistent with the hash value h stored in the cloud server data storage module, the user authentication module of the cloud server sends an order to the storage medium to refuse read and write operations; if the storage medium The hash value H(s) sent by the medium is consistent with the hash value h stored in the cloud server data storage module, then the user authentication module of the cloud server calls the data storage module to find the key key corresponding to the current storage medium content and returns it to the storage medium, the storage medium sends the key key to the client to enable the user to complete the read and write operations on the data in the storage medium.
Based on the working method described in claim 8, it is characterized in that, the method for the legality authentication of the storage medium in the described step 5) is:

51) The storage medium sends a data synchronization request to the cloud server;

52) The cloud server invokes the storage medium authentication module to authenticate the validity of the storage medium, generates a random number R and returns it to the storage medium;

53) The storage medium encrypts the random number R with the private key K pri stored in its own memory and sends the result K pri (R) back to the cloud server;

54) The storage medium authentication module of the cloud server queries the storage medium ID and the public key pair <ID d , K pub > from the data storage module, and decrypts the data K pri (R) with the public key K pub of the storage medium, if If the obtained result is the same as the random number R sent before, send a synchronization data command to the storage medium to complete data synchronization; if the decrypted result with the public key is different from the random number R generated before, the data synchronization request from the storage medium is rejected.