# US 12,118,109 B2 · Data storage method, device, and storage medium

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,118,109 B2
- Document ID: US12118109B2
- Status: Granted
- Kind: B2
- Application number: 17/694,411
- Filed: 2022-03-14
- Published: 2022-06-23
- Granted: 2024-10-15
- Earliest claimed: 2021-05-14
- Assignees: Beijing Baidu Netcom Science Technology Co., Ltd.
- Applicants: Beijing Baidu Netcom Science Technology Co., Ltd.
- Inventors: Jingqi Cao
- Web page: https://patentgrep.com/patent/US12118109B2

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/3236: {using cryptographic hash functions}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 9/3297: {involving time stamps, e.g. generation of time stamps}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Provided are a data storage method, a device, and a storage medium. The implementation scheme is as follows: target data to be stored is divided into data fragment original texts, and storage nodes are allocated for the data fragment original texts; in a trusted execution environment, the data fragment original texts are encrypted according to node information of the storage nodes to obtain data fragment cipher texts associated with the storage nodes; and the data fragment cipher texts are stored to the storage nodes.

## Claims

### Claim 1

A data storage method, comprising:
dividing target data to be stored into data fragment original texts, and allocating storage nodes for the data fragment original texts;
in a trusted execution environment, encrypting the data fragment original texts according to node information of the storage nodes to obtain data fragment cipher texts associated with the storage nodes; and
storing the data fragment cipher texts to the storage nodes;
wherein in the trusted execution environment, encrypting the data fragment original texts according to the node information of the storage nodes comprises:
in the trusted execution environment, acquiring a data fragment original text, identification information of the data fragment original text and node information of a storage node allocated for the data fragment original text through an encryption interface;
generating an encryption key according to a root key, the identification information of the data fragment original text, the node information of the storage node and a first random number; and
encrypting the data fragment original text by adopting the encryption key.

### Claim 2 (depends on 1)

The method of claim 1, wherein after storing the data fragment cipher texts to the storage nodes, the method further comprises: writing an association relationship between the data fragment cipher texts and the storage nodes into a blockchain;
selecting a node to be verified from the storage nodes according to the association relationship between the data fragment cipher texts and the storage nodes in the blockchain;
writing a storage state verification request for the node to be verified into the blockchain to instruct the node to be verified to execute the following: in response to the storage state verification request, determining a data existence certification according to pre-stored data fragment cipher texts, and writing the data existence certification into the blockchain; and
determining a data storage state of the node to be verified according to the data existence certification in the blockchain.

### Claim 3 (depends on 2)

The method of claim 2, wherein writing the storage state verification request for the node to be verified into the blockchain comprises:
determining a parameter to be verified, wherein the parameter to be verified comprises identification information of the node to be verified, a bit to be verified, a timestamp and a second random number; and
writing the storage state verification request carrying the parameter to be verified into the blockchain to instruct the node to be verified to execute the following: determining the data existence certification according to the pre-stored data fragment cipher texts, the bit to be verified, the identification information of the node to be verified, the timestamp and the second random number, and writing the data existence certification into the blockchain.

### Claim 4 (depends on 1)

The method of claim 1, wherein after storing the data fragment cipher texts to the storage nodes, the method further comprises:
acquiring the data fragment cipher texts from the storage nodes; and
in the trusted execution environment, decrypting the data fragment cipher texts according to identification information of the storage nodes.

### Claim 5 (depends on 4)

The method of claim 4, wherein in the trusted execution environment, decrypting the data fragment cipher texts according to the identification information of the storage nodes comprises:
in the trusted execution environment, acquiring a data fragment cipher text, identification information of a data fragment original text associated with the data fragment cipher text, node information of a storage node associated with the data fragment cipher text and a first random number associated with the data fragment cipher text through a decryption interface;
generating a decryption key according to a root key, the identification information of the data fragment original text, the node information of the storage node and the first random number; and
decrypting the data fragment cipher text by adopting the decryption key.

### Claim 6 (depends on 1)

The method of claim 1, wherein allocating the storage nodes for the data fragment original texts comprises:
allocating at least two storage nodes for the data fragment original texts by adopting a redundancy algorithm.

### Claim 7

An electronic device, comprising:
at least one processor; and
a memory communicatively connected to the at least one processor;
wherein the memory stores an instruction executable by the at least one processor, and the instruction, when executed by the at least one processor, causes the at least one processor to perform the following steps:
dividing target data to be stored into data fragment original texts, and allocating storage nodes for the data fragment original texts;
in a trusted execution environment, encrypting the data fragment original texts according to node information of the storage nodes to obtain data fragment cipher texts associated with the storage nodes; and
storing the data fragment cipher texts to the storage nodes;
wherein the at least one processor is caused to perform in the trusted execution environment, encrypting the data fragment original texts according to the node information of the storage nodes by:
in the trusted execution environment, acquiring a data fragment original text, identification information of the data fragment original text and node information of a storage node allocated for the data fragment original text through an encryption interface;
generating an encryption key according to a root key, the identification information of the data fragment original text, the node information of the storage node and a first random number; and
encrypting the data fragment original texts by adopting the encryption key.

### Claim 8 (depends on 7)

The electronic device of claim 7, wherein after the data fragment cipher texts are stored to the storage nodes, the at least one processor is caused to further perform the following steps:
writing an association relationship between the data fragment cipher texts and the storage nodes into a blockchain;
selecting a node to be verified from the storage nodes according to the association relationship between the data fragment cipher texts and the storage nodes in the blockchain;
writing a storage state verification request for the node to be verified into the blockchain to instruct the node to be verified to execute the following: in response to the storage state verification request, determining a data existence certification according to pre-stored data fragment cipher texts, and writing the data existence certification into the blockchain; and
determining a data storage state of the node to be verified according to the data existence certification in the blockchain.

### Claim 9 (depends on 8)

The electronic device of claim 8, wherein the at least one processor is caused to perform writing the storage state verification request for the node to be verified into the blockchain by:
determining a parameter to be verified, wherein the parameter to be verified comprises identification information of the node to be verified, a bit to be verified, a timestamp and a second random number; and
writing the storage state verification request carrying the parameter to be verified into the blockchain to instruct the node to be verified to execute the following: determining the data existence certification according to the pre-stored data fragment cipher texts, the bit to be verified, the identification information of the node to be verified, the timestamp and the second random number, and writing the data existence certification into the blockchain.

### Claim 10 (depends on 7)

The electronic device of claim 7, wherein after the data fragment cipher texts are stored to the storage nodes, the at least one processor is caused to further perform the following steps:
acquiring the data fragment cipher texts from the storage nodes; and
in the trusted execution environment, decrypting the data fragment cipher texts according to identification information of the storage nodes.

### Claim 11 (depends on 10)

The electronic device of claim 10, wherein the at least one processor is caused to perform in the trusted execution environment, decrypting the data fragment cipher texts according to the identification information of the storage nodes by:
in the trusted execution environment, acquiring a data fragment cipher text, identification information of a data fragment original text associated with the data fragment cipher text, node information of a storage node associated with the data fragment cipher text and a first random number associated with the data fragment cipher text through a decryption interface;
generating a decryption key according to a root key, the identification information of the data fragment original text, the node information of the storage node and the first random number; and
decrypting the data fragment cipher text by adopting the decryption key.

### Claim 12 (depends on 7)

The electronic device of claim 7, wherein the at least one processor is caused to perform allocating the storage nodes for the data fragment original texts by:
allocating at least two storage nodes for the data fragment original texts by adopting a redundancy algorithm.

### Claim 13

A non-transitory computer readable storage medium storing a computer instruction, wherein the computer instruction is configured to cause a computer to perform the following steps:
dividing target data to be stored into data fragment original texts, and allocating storage nodes for the data fragment original texts;
in a trusted execution environment, encrypting the data fragment original texts according to node information of the storage nodes to obtain data fragment cipher texts associated with the storage nodes; and
storing the data fragment cipher texts to the storage nodes;
wherein the computer instruction is configured to cause the computer to perform in the trusted execution environment, encrypting the data fragment original texts according to the node information of the storage nodes by:
in the trusted execution environment, acquiring a data fragment original text, identification information of the data fragment original text and node information of a storage node allocated for the data fragment original text through an encryption interface;
generating an encryption key according to a root key, the identification information of the data fragment original text, the node information of the storage node and a first random number; and
encrypting the data fragment original texts by adopting the encryption key.

### Claim 14 (depends on 13)

The storage medium of claim 13, wherein after the data fragment cipher texts are stored to the storage nodes, the computer instruction is configured to cause the computer to further perform the following steps:
writing an association relationship between the data fragment cipher texts and the storage nodes into a blockchain;
selecting a node to be verified from the storage nodes according to the association relationship between the data fragment cipher texts and the storage nodes in the blockchain;
writing a storage state verification request for the node to be verified into the blockchain to instruct the node to be verified to execute the following: in response to the storage state verification request, determining a data existence certification according to pre-stored data fragment cipher texts, and writing the data existence certification into the blockchain; and
determining a data storage state of the node to be verified according to the data existence certification in the blockchain.

### Claim 15 (depends on 14)

The storage medium of claim 14, wherein the computer instruction is configured to cause the computer to perform writing the storage state verification request for the node to be verified into the blockchain by:
determining a parameter to be verified, wherein the parameter to be verified comprises identification information of the node to be verified, a bit to be verified, a timestamp and a second random number; and
writing the storage state verification request carrying the parameter to be verified into the blockchain to instruct the node to be verified to execute the following: determining the data existence certification according to the pre-stored data fragment cipher texts, the bit to be verified, the identification information of the node to be verified, the timestamp and the second random number, and writing the data existence certification into the blockchain.

### Claim 16 (depends on 13)

The storage medium of claim 13, wherein after the data fragment cipher texts are stored to the storage nodes, the computer instruction is configured to cause the computer to further perform the following steps:
acquiring the data fragment cipher texts from the storage nodes; and
in the trusted execution environment, decrypting the data fragment cipher texts according to identification information of the storage nodes.

### Claim 17 (depends on 16)

The storage medium of claim 16, wherein the computer instruction is configured to cause the computer to perform in the trusted execution environment, decrypting the data fragment cipher texts according to the identification information of the storage nodes by:
in the trusted execution environment, acquiring a data fragment cipher text, identification information of a data fragment original text associated with the data fragment cipher text, node information of a storage node associated with the data fragment cipher text and a first random number associated with the data fragment cipher text through a decryption interface;
generating a decryption key according to a root key, the identification information of the data fragment original text, the node information of the storage node and the first random number; and
decrypting the data fragment cipher text by adopting the decryption key.

### Claim 18 (depends on 13)

The storage medium of claim 13, wherein the computer instruction is configured to cause the computer to perform allocating the storage nodes for the data fragment original texts by:
allocating at least two storage nodes for the data fragment original texts by adopting a redundancy algorithm.