CN103516523A - Data encryption system structure based on cloud storage - Google Patents

Abstract

The invention relates to the field of cloud storage systems, and discloses a data encryption system structure based on cloud storage. The data encryption system comprises a cloud computing secret key client, a cloud computing secret key management server, a customer private secret key carrier, a symmetric cryptography server, and a digital certificate center, wherein the customer private secret key carrier comprises a private key to decrypt a symmetric secret key. For a cloud storage provider, the file cannot be decrypted without the private key, so that the system structure improves the security of client data information, can effectively prevent the private information of the customer from being obtained and illegally utilized by other users or the cloud storage provider. The structure faces various cloud computing applications, and can realize uniform and standard secret key management. The file decryption needs to be executed by the customer private key, which effectively protects the security of customer data. The structure further has the advantages of simpleness and expandability.

Description

A Data Encryption Architecture Based on Cloud Storage

technical field

The invention relates to the field of cloud storage systems, in particular to a data encryption security architecture based on cloud storage.

technical background

With the widespread promotion and application of cloud computing (Cloud Computing), it has injected new vitality and impetus into the huge Chinese Internet market. Currently well-known cloud computing-based applications mainly include: cloud search by search engine companies such as Google, Yahoo, and Baidu; cloud storage proposed by storage solution providers such as Amazon and EMC; and cloud security by antivirus software manufacturers such as Rising, Trend, and Kingsoft. , and many cloud services implemented by online software service providers such as Salesforce. With the popularization of cloud computing, enterprises store more and more core business and important data in the cloud. However, enterprises are more and more worried about the data stored in the cloud. address people's concerns about information security.

Many studies have shown that there is a big divide between cloud service providers and their customers on who should bear the responsibility for the security of customer data: the provider puts the responsibility in the hands of the customer, but the customer usually does not agree. According to a survey conducted by the Ponemon Institute last year, seven out of ten cloud service providers hand over the security responsibility of customer data to customers, and only 30% of customers agree. This has made cloud storage services that provide data encryption and security more and more popular. By encrypting data, customers can ensure that their information is safe even in the event of a data breach, and it can be kept confidential from the cloud service provider.

Analysis shows that the best solutions for cloud storage encryption are those that allow the customer to control the key or part of the key. By controlling the key, the customer can also control the access to the data, and even prevent the cloud service provider from accessing it. data. Professionals say it's safe if all information is encrypted and done through a key that the customer controls and that even cloud administrators can't see. Encrypting data securely isn't a technical hurdle for cloud security services, the difficulty lies in finding a way to securely manage the keys.

Data security is the lifeline of an enterprise. Any cloud service provider tries their best to claim that their services are completely safe. Compared with traditional storage, a large amount of user core data is placed in cloud storage, and users do not know the specific storage location, which inevitably makes users feel uneasy. Any customer is worried about personal data Materials such as photos, personal information, and technical documents are leaked or become objects of public browsing, causing information and personal safety hazards. Some vendors store keys in the same cloud environment as the data, which is not secure; others outsource keys to third parties or let customers manage keys themselves, neither of which is ideal for key storage method.

Contents of the invention

The technical problem to be solved by the invention is to enable customers to ensure the confidentiality of their data, simplify key management and improve the security of customer data.

The present invention involves two kinds of keys, one is the symmetric key stored in the cloud computing management server, and the other private key is used to decrypt the symmetric key and stored in the customer's private key carrier.

The technical solution adopted in the present invention is: a data encryption system architecture based on cloud storage, the system architecture includes: cloud computing key client, cloud computing key management server, customer private key carrier, symmetric cipher server, digital Certificate Authority, where:

The cloud computing key client is a cryptographic service client residing in the cloud computing service, responsible for providing key services to the cloud computing applications in the cloud computing server, and applying to the key management server through the standard key management protocol. key generation;

The cloud computing key management server is responsible for management services such as key generation, recovery, and update, and returns the key to the client; the cloud computing key management server stores distributed keys, which require the private key in the client's private key Only then can the key be completely restored;

The customer's private key carrier is responsible for storing the digital certificate and the private key required for the restoration of the distributed key;

The symmetric encryption server encrypts the file with a symmetric key, and the symmetric key needs to be encrypted with the public key in the client's private key;

The digital certificate center is responsible for issuing digital certificates to customers for digital signature certification;

The customer downloads the digital signature certificate to the customer's private key carrier. In addition to the digital signature provided by the digital certification center, the carrier also contains the private key used to crack the symmetric key.

When customers log in, they need a user name and password, and provide a digital certificate, and log in to the cloud computing key client through identity verification. For cloud storage providers, it is impossible to decrypt files without this private key. Therefore, this invention improves customer Security of data information.

The customer's private key carrier can be embodied as a storage device with a certain capacity.

The carrier of the client's private key is a USB-shield, which is convenient for the client to carry.

A cloud computing encryption key generation process based on the above architecture includes the following process:

The cloud computing key client generates a key request packet and sends a key request to the cloud computing management server. The key request packet includes a request packet header (REQ Header) operation type (GET) and a key object (Symmetric Key), Identifier (UID); after receiving the key request, the cloud computing management server obtains the symmetric key from the symmetric cipher server according to the content of the request, and then generates a key reply packet, including the response header (Response Header), the key object ( Symmetric Key), identifier (UID) and symmetric key (Key Value).

The symmetric encryption server encrypts the file with a symmetric key, and returns the symmetric key to the cloud computing key client through the cloud computing key management server. Decrypting the symmetric key requires the private key stored in the customer's private key carrier.

This approach effectively improves the security of customer data. This method of mixed storage of keys is somewhat similar to a bank's safe. The bank holds one key, the customer holds another key, and the bank's key relies on the key in the customer's hand to perform the decryption process.

The beneficial effects of the present invention are: the present invention proposes a method for key hybrid storage, that is, the customer's private key carrier contains the private key to crack the symmetric key. For cloud storage providers, without this private key, it is impossible The file is decrypted, so the invention improves the security of customer data information, and can effectively prevent the customer's private information from being obtained and illegally used by other users or cloud storage providers. The architecture is oriented to various cloud computing applications and can realize unified and standard key management. File decryption requires the customer's private key to execute, which effectively protects the security of customer data. The architecture also has the advantages of simplicity and scalability.

Description of drawings

Figure 1 is a schematic diagram of cloud computing key management architecture;

Fig. 2 is a schematic diagram of cloud computing encryption key acquisition;

Description of reference signs: 1. Cloud computing key client, 2. Cloud computing key management server, 3. Customer private key carrier, 4. Symmetric encryption server, 5. Digital certificate center.

Detailed ways

Referring to the accompanying drawings, the present invention will be described in detail in conjunction with the embodiments.

Example 1:

A data encryption architecture based on cloud storage, the system architecture includes: cloud computing key client 1, cloud computing key management server 2, customer private key carrier 3, symmetric cipher server 4, digital certificate center 5, wherein :

The cloud computing key client 1 is a cryptographic service client residing in the cloud computing service, responsible for providing key services to the cloud computing applications in the cloud computing server, and sending key services to the key management server through standard key management protocols. Application key generation;

The cloud computing key management server 2 is responsible for management services such as key generation, recovery, and update, and returns the key to the client; there are distributed keys in the cloud computing key management server, and the private key in the client's private key is required. The key can be fully restored;

The customer's private key carrier 3 is responsible for storing the digital certificate and the private key required for the restoration of the distributed key;

The symmetric encryption server 4 encrypts the file using a symmetric key, and the symmetric key needs to be encrypted using the public key in the client's private key;

The digital certificate center 5 is responsible for issuing digital certificates to customers for the authentication of digital signatures;

The customer downloads the digital signature certificate to the customer's private key carrier 3, which contains the private key used to crack the symmetric key in addition to the digital signature provided by the digital certification center 5.

When customers log in, they need a user name and password, and provide a digital certificate, and log in to the cloud computing key client through identity verification. For cloud storage providers, it is impossible to decrypt files without this private key. Therefore, this invention improves customer Security of data information.

Example 2:

On the basis of Embodiment 1, the customer private key carrier described in this embodiment can be embodied as a storage device with a certain capacity.

Example 3:

On the basis of Embodiment 2, the carrier of the customer's private key in this embodiment is a USB shield, which is convenient for the customer to carry.

Example 4:

A kind of cloud computing encryption key generation process based on above-mentioned embodiment, comprises following process:

The cloud computing key client generates a key request packet and sends a key request to the cloud computing management server. The key request packet includes a request packet header (REQ Header) operation type (GET) and a key object (Symmetric Key), Identifier (UID); after receiving the key request, the cloud computing management server obtains the symmetric key from the symmetric cipher server according to the content of the request, and then generates a key reply packet, including the response header (Response Header), the key object ( Symmetric Key), identifier (UID) and symmetric key (Key Value).

The symmetric encryption server encrypts the file with a symmetric key, and returns the symmetric key to the cloud computing key client through the cloud computing key management server. Decrypting the symmetric key requires the private key stored in the customer's private key carrier.

Claims (4)

1. A data encryption architecture based on cloud storage, characterized in that: the system architecture includes: cloud computing key client (1), cloud computing key management server (2), customer private key carrier (3) , a symmetric cryptographic server (4), a digital certificate center (5), where: The cloud computing key client is a cryptographic service client residing in the cloud computing service, responsible for providing key services to the cloud computing applications in the cloud computing server, and applying to the key management server through the standard key management protocol. key generation; The cloud computing key management server is responsible for management services such as key generation, recovery, and update, and returns the key to the client; the cloud computing key management server stores distributed keys, which require the private key in the client's private key Only then can the key be completely restored; The customer's private key carrier is responsible for storing the digital certificate and the private key required for the restoration of the distributed key; The symmetric encryption server encrypts the file with a symmetric key, and the symmetric key needs to be encrypted with the public key in the client's private key; The digital certificate center is responsible for issuing digital certificates to customers for digital signature certification; The customer downloads the digital signature certificate to the customer's private key carrier, which contains the private key used to crack the symmetric key in addition to the digital signature provided by the digital certification center; When customers log in, they need a user name and password, and provide a digital certificate, and log in to the cloud computing key client through identity verification. 2. A data encryption architecture based on cloud storage according to claim 1, characterized in that: the customer private key carrier is a storage device with a certain capacity. 3. A data encryption architecture based on cloud storage according to claim 2, characterized in that: the customer private key carrier is a USB-Shield. 4. A cloud computing encryption key generation method based on any of the preceding claims, characterized in that: the method comprises the following processes: The cloud computing key client generates a key request packet and sends a key request to the cloud computing management server. The key request packet contains the request packet header operation type and key object, identifier; the cloud computing management server receives the key After the request, according to the content of the request, obtain the symmetric key from the symmetric encryption server, and then generate a key reply packet, which includes the header of the reply packet, the key object, the identifier and the symmetric key; The file is encrypted with a symmetric key, and the symmetric key is returned to the cloud computing key client through the cloud computing key management server. Decrypting the symmetric key requires the private key stored in the customer's private key carrier.

Images