Encrypted database efficient data management method based on key management system

Abstract

The invention discloses an encrypted database high-efficiency data management method based on a key management system, which comprises the following steps of: 1, storing a database through a distributed storage system, establishing a multi-dimensional feature vector for each type of data according to service attributes of the data in the database, determining the initial average optimal fragmentation number of all encrypted data blocks in the distributed storage system; 2, integrating the operation parameters of each storage node and the permission level allowed for the role of the user in the distributed storage system to obtain an access control vector; 3, completing data integrity verification and consistency check; and calculating a load balancing factor, and guiding the average optimal fragment number of all encrypted data blocks in the distributed storage system to evolve to an optimal state. According to the invention, the problems of single security policy and insufficient resource allocation of a traditional static key are overcome.

Description

Technical Field

[0001] The present invention relates to the field of database management and processing, and in particular to an efficient data management method for an encrypted database based on a key management system. Background Art

[0002] Currently, data encryption technology is widely used in distributed storage systems to protect the security of sensitive data. Traditional encryption methods mainly include symmetric encryption algorithms (such as AES, DES) and asymmetric encryption algorithms (such as RSA, ECC). These methods provide basic security guarantees for data transmission and storage. However, in practical applications, these encryption methods usually face the following limitations: Most existing data encryption systems use static keys for encryption, that is, a fixed key is generated when the system is initialized and used for encryption and decryption operations of all data. Although this method is simple to implement, it has obvious security risks. Once the key is leaked, the attacker can crack all encrypted data related to the key, resulting in serious data leakage. In addition, static keys lack a dynamic update mechanism and cannot adapt to the needs of dynamic changes in data in complex business scenarios. Many existing technologies only design encryption strategies based on a single characteristic of data (such as sensitivity or size), and fail to fully consider the multi-dimensional attributes of data (such as access frequency, real-time requirements, encryption level, etc.). This single-dimensional encryption strategy is difficult to cope with complex business needs, especially in distributed storage environments, where different types of data have significant differences in security and performance requirements, and single-dimensional strategies often lead to inefficient resource utilization. Summary of the invention

[0003] The purpose of the present invention is to provide an efficient data management method for encrypted databases based on a key management system, which comprehensively improves data security, resource utilization efficiency and access performance in distributed storage systems. The present invention overcomes the defects of traditional static keys, single security policies and insufficient resource allocation, and can dynamically adjust encryption, storage and access policies according to data characteristics and system load, ensuring data integrity and consistency in a high-concurrency environment, while optimizing system performance.

[0004] In order to solve the above technical problems, the present invention provides an efficient data management method for an encrypted database based on a key management system, the method comprising: Step 1: Store the database through a distributed storage system. According to the business attributes of the data in the database, a multi-dimensional feature vector is established for each type of data, and a unique encryption key is generated based on it. Each type of data is encrypted using the encryption key to generate a corresponding encrypted data block. Based on the operating parameters of each storage node, the comprehensive evaluation value between each storage node in the distributed storage system is calculated to determine the resource capacity of each storage node, and the preliminary average optimal number of shards for all encrypted data blocks in the distributed storage system is determined. Step 2: Combine the operating parameters of each storage node and the permission level allowed for the user's role in the distributed storage system to obtain an access control vector, and combine the time dimension to constrain it to prevent timeout access or unauthorized access, thereby dynamically strengthening the access control vector; when the time or key is updated, the access control vector will also be dynamically refreshed; Step 3: For each encrypted data block, calculate the hash value, cyclic redundancy check value, error correction code and message authentication code, and normalize them accordingly in combination with the access control vector to complete data integrity verification and consistency check; calculate a load balancing factor based on the real-time total data access load and the total number of concurrent requests, and combine it with the preliminary average optimal number of shards to guide the average optimal number of shards of all encrypted data blocks in the distributed storage system to evolve towards the optimal state.

[0005] Furthermore, the operating parameters of the storage node include: bandwidth capacity, CPU utilization, memory utilization, disk input and output operations per second, average response time and concurrency.

[0006] Furthermore, the business attributes include: sensitivity score, data access frequency, data type identifier, response time requirement, data size, number of concurrent access users, encryption level and timestamp; the sensitivity score ranges from 1 to 10, indicating the security sensitivity level of this type of data, and the higher the sensitivity score, the greater the contribution to the key; the data access frequency indicates the access frequency of this type of data; the data type identifier takes a value of 1, 2 or 3, when the value is 1, it indicates structured data, when the value is 2, it indicates semi-structured data, and when the value is 3, it indicates unstructured data; the response time requirement indicates the response time constraint on this type of data, and the smaller the value, the higher the real-time requirement; the encryption level ranges from 1, 2 or 3, and the higher the value, the higher the corresponding encryption level.

[0007] Furthermore, let The multidimensional feature vector of the class data is: ; in, For the Sensitivity score of class data; For the The frequency with which the data of the class data is accessed; For the Data type identifier of class data; For the Response time requirements for class data; For the The data size of the class data; For the The number of concurrent users accessing class data; For the The encryption level of the class data; For the The timestamp of the class data; a unique encryption key is generated by the following formula : ; in, is the number of categories of data; Represents the L1 norm of the multidimensional feature vector; is the set encrypted large prime number; is the modulo operation; express The hash value of .

[0008] Furthermore, each type of data is encrypted using the CBC mode of the AES encryption algorithm using an encryption key.

[0009] Furthermore, the initial average optimal number of fragments for all encrypted data blocks is Calculated by the following formula: ; in, For the Memory usage of storage nodes; For the The number of disk input and output operations per second for each storage node; is the determinant operator; is the number of storage nodes; For the The bandwidth capacity of each storage node; For the The CPU usage of each storage node.

[0010] Furthermore, the access control vector Calculated by the following formula: ; in, The user's permission level is an integer from 1 to 5. The CPU usage allowed for the access corresponding to the user. The number of concurrent accesses allowed for this user. The number of disk input and output operations per second allowed for the access corresponding to this user; The access bandwidth allowed for the user; The average response time allowed for the access corresponding to the user; The memory usage allowed for access by the user; No. A hash value of the timestamp of the class data; is the minimum function; For the The number of concurrent storage nodes; For the The average response time of each storage node.

[0011] Furthermore, the verification value is calculated by the following formula to complete data integrity verification and consistency check: ; in, No. The verification value of the encrypted data block corresponding to the class data. When the verification value is within the set threshold range, it means that the encrypted data block corresponding to the class data has passed the verification and is allowed to be accessed. Otherwise, the access is denied. for The hash value of the encrypted data block corresponding to the class data; for The error correction code of the encrypted data block corresponding to the class data; for The message authentication code of the encrypted data block corresponding to the class data; for The cyclic redundancy check code of the encrypted data block corresponding to the class data.

[0012] Furthermore, the following formula is used to guide the average optimal number of shards of all encrypted data blocks in the distributed storage system to evolve toward the optimal state: ; in, For time The load balancing factor is calculated as follows: ; in, For time The total number of concurrent requests at the time; For time Total data access load at time ; For time The total number of concurrent requests at the time.

[0013] The efficient data management method of encrypted database based on key management system of the present invention has the following beneficial effects: The present invention adopts a dynamic key generation method based on the multi-dimensional characteristics of data in key management, breaking through the security limitations of traditional static keys. The encryption key of each type of data is jointly determined by multi-dimensional characteristics such as sensitivity score, access frequency, data type, response time requirement, encryption level, timestamp, etc. The timestamp hash and dynamic adjustment parameters are introduced into the formula to make the key highly timely and unique. This design ensures that even if the same type of data is encrypted at different times or environments, its key is completely different, thereby effectively resisting replay attacks and brute force cracking; the present invention realizes real-time access permission management based on user authority level, storage node resource status and data characteristics through dynamic access control vectors.

[0014] Compared with the traditional static access control list, the present invention can dynamically adjust the permission configuration according to the user's role level, system load status and concurrent requests. For example, in a high-concurrency scenario, the system will give priority to resource allocation for high-privilege users and high-priority tasks, and limit the access frequency of low-privilege users, thereby achieving efficient resource utilization and priority management. The dynamic access control mechanism also combines timestamp hashing and key strength to constrain permissions through the time dimension to prevent the abuse of permissions that have been idle for a long time. At the same time, the combination of access control vectors with data characteristics and node status enables the system to automatically adapt to load changes in permission management and avoid resource conflicts and security vulnerabilities.

[0015] By combining dynamic parameters such as bandwidth, CPU usage, memory usage, disk IOPS, and average response time of storage nodes, the present invention realizes dynamic sharding optimization of encrypted data blocks in distributed storage systems. This optimization method can balance node loads in high-concurrency access scenarios, avoid overloading of some nodes, and ensure overall performance stability. Compared with traditional static sharding strategies, the dynamic optimization mechanism of the present invention greatly improves the resource utilization of the storage system and reduces the risk of performance bottlenecks caused by hot data. At the same time, the load balancing factor accurately models the system load characteristics through the combination of Poisson distribution and gamma distribution, which can more effectively guide the evolution of the sharding strategy to the optimal state. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0017] Figure 1A method flow chart of an efficient data governance method for an encrypted database based on a key management system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] Example 1, reference Figure 1 : An efficient data management method for an encrypted database based on a key management system, the method comprising: Step 1: Store the database through a distributed storage system. According to the business attributes of the data in the database, a multi-dimensional feature vector is established for each type of data, and a unique encryption key is generated based on it. Each type of data is encrypted using the encryption key to generate a corresponding encrypted data block. Based on the operating parameters of each storage node, the comprehensive evaluation value between each storage node in the distributed storage system is calculated to determine the resource capacity of each storage node, and the preliminary average optimal number of shards for all encrypted data blocks in the distributed storage system is determined. First, the system will classify all the data in the database and extract multiple dimensions that can reflect the characteristics of the data based on the business attributes of the data, such as the importance, sensitivity, structuredness, access frequency, and concurrent access volume of the data. These dimensions will be quantified into numerical values ​​and integrated into a multidimensional feature vector. The construction of the feature vector is not a simple collection of parameters, but a combination of multiple dynamic analysis methods. For example, data sensitivity is quantified by evaluating the risk level of the data in the business (such as the confidentiality of financial data and the privacy of medical data). This sensitivity score will directly affect the subsequent key strength and encryption strategy selection. The quantification of access frequency requires reference to historical access logs and prediction models. It is necessary not only to calculate the average number of accesses in the past period of time, but also to introduce dynamic weights of time windows. For example, the prediction weight for future access peaks will be higher. The identification of data types distinguishes between structured data (such as relational database tables), semi-structured data (such as JSON files), and unstructured data (such as video files), because different types of data have obvious differences in storage requirements and encryption complexity. When the feature vectors are constructed, the key management system will generate a unique encryption key based on these vectors. In the process of generating keys, timestamps are introduced as important dynamic variables, which makes the keys closely related to the time point of data storage, thereby improving the timeliness and security of the keys. This time correlation not only prevents the reuse of keys, but also provides additional security constraints in the dynamic update or access control of subsequent data. The key generation formula comprehensively considers the data characteristics (such as sensitivity, size, and concurrency) and the system status (such as storage node resources and encryption level), uses the hash function in the encryption algorithm to process the timestamp and eigenvalue, and then generates the final key through modular operation. In this way, even when facing the same type of data, the keys will be significantly different due to the differences in timestamps and the dynamic changes in encryption levels, which greatly improves the ability to resist attacks.

[0020] After key generation, data is divided into blocks to adapt to the storage mechanism of the distributed storage system. The rules for block division are adjusted based on the data size and the storage performance of the node. For example, large data files are divided into smaller blocks so that they can be distributed to multiple storage nodes, which not only improves storage efficiency but also reduces the load on a single node and the risk of data loss. Each data block is encrypted with the assigned key. The encryption uses a symmetric encryption algorithm (such as AES) and combines an initial vector (IV) to ensure the randomness and independence of the encryption result. After encryption, the generated encrypted data block will be accompanied by meta information, such as block ID, encryption key ID, initial vector, and encryption algorithm type, which provide necessary support for subsequent data recovery and decryption. At the same time, the system will also evaluate the resource capabilities of each node based on the real-time operating parameters of the distributed storage node (such as bandwidth, CPU usage, memory usage, and disk IOPS). This evaluation uses a comprehensive performance scoring method, taking into account the weight distribution of resources in each dimension, and dynamically generating a score for each node. This score determines the initial allocation strategy of encrypted data blocks, that is, encrypted data blocks will be preferentially allocated to nodes with high performance and high availability. The calculation of the preliminary average optimal number of shards is an overall optimization process based on the global node resource capabilities. By evenly distributing data blocks, the system can effectively reduce the resource bottleneck problem caused by the centralized storage of hot data sets, while ensuring that highly sensitive data blocks are preferentially allocated to nodes with higher security levels.

[0021] Step 2: Combine the operating parameters of each storage node and the permission level allowed for the user's role in the distributed storage system to obtain an access control vector, and combine the time dimension to constrain it to prevent timeout access or unauthorized access, thereby dynamically strengthening the access control vector; when the time or key is updated, the access control vector will also be dynamically refreshed; In order to ensure the access security and compliance of encrypted data, the system will construct a multi-dimensional access control vector based on the role level and permission level of each user to describe the user's access ability to a specific data block. The user role level (such as administrator, ordinary user, visitor, etc.) and permission level (such as read permission, write permission, delete permission, etc.) jointly determine the user's basic permission range. The definition of this basic permission adopts a hierarchical model, which is preset according to business needs when the system is initialized, but its specific permission allocation will be dynamically adjusted over time, data status and user behavior. In addition to roles and permission levels, the access control vector also introduces dynamic parameters of other dimensions, such as the user's historical access records, the security assessment of the current session, and the priority access requirements for specific sensitive data. These parameters together constitute the dynamic characteristics of access control, enabling the system to automatically adjust the permission configuration when facing complex access scenarios to avoid unnecessary security vulnerabilities. In order to further enhance the security of access control, the present invention introduces a time dimension constraint based on the traditional access control model. The addition of the time dimension is mainly reflected in two aspects: one is to prevent the long-term abuse of permissions, and the other is to update the access control vector in real time to adapt to changes in data and environment. In actual operation, the system generates a unique timestamp for each access request and binds the timestamp to the user's permission level to form a time-sensitive access token. This token is time-sensitive and is only valid within a specific time window, thus avoiding the problem of long-term idle permissions being maliciously exploited. In addition, the timestamp will also serve as a trigger for the dynamic update of the access control vector. When the timestamp expires or the key is updated, the system will re-evaluate the user's access rights and refresh the access control vector. This real-time refresh mechanism ensures that even if the data status or key changes, access control can still accurately adapt to new security requirements. On this basis, step 2 also introduces a dynamic enhancement mechanism for access behavior to further enhance the flexibility and security of access control. The key to dynamic enhancement is to combine the operating parameters of the storage node with the user's permission level to analyze and adjust the user's access request in real time. For example, when the load of a storage node is high, the system will dynamically divert the access requests on the node according to the node's operating parameters (such as bandwidth, CPU usage, memory usage, etc.), and give priority to allocating resources to access requests from high-privilege users or high-priority data. At the same time, for users with lower permissions, the system may reduce their access frequency or extend the queuing time of their requests to ensure the stability of the overall system performance. This dynamic reinforcement mechanism based on operating parameters can not only effectively avoid resource bottlenecks caused by high concurrent access, but also ensure the access security of highly sensitive data.

[0022] It is worth noting that in step 2, the dynamic refresh of the access control vector not only depends on the timestamp, but is also directly related to the update frequency of the key. When the encryption key is updated, the system will automatically trigger the reconstruction process of the access control vector. At this time, the new encryption key will be combined with the user's permissions and access behavior to regenerate an access control policy that matches the current environment. For example, when the key level of a certain type of data is upgraded from medium to high, the system will automatically adjust the user permissions related to the data in the access control vector, and may temporarily restrict access rights for some low-privileged users until they pass a higher level of authentication or the system load is reduced. This key-driven dynamic refresh mechanism not only enhances the security of the data, but also enables access control to quickly respond to changes in keys and environments, thereby maintaining the flexibility and stability of the system. By constructing a dynamic access control vector and introducing time dimension constraints, the real-time and refined management of permission allocation is achieved, which is in sharp contrast to the existing static access control mechanism. In traditional distributed storage systems, access rights are usually set when the system is initialized and are relatively fixed, lacking the ability to dynamically adjust. The present invention introduces multiple factors such as user permissions, data characteristics, storage node status and time dimensions into the access control model, so that the system can dynamically optimize the access strategy according to actual conditions. For example, when access requests for highly sensitive data surge, the system can improve the security level of related access controls in real time, giving priority to ensuring the normal operation of key businesses without the need to shut down or manually adjust permission settings. This dynamic optimization capability greatly improves the system's adaptability when facing complex business scenarios.

[0023] Step 3: For each encrypted data block, calculate the hash value, cyclic redundancy check value, error correction code and message authentication code, and normalize them accordingly in combination with the access control vector to complete data integrity verification and consistency check; calculate a load balancing factor based on the real-time total data access load and the total number of concurrent requests, and combine it with the preliminary average optimal number of shards to guide the average optimal number of shards of all encrypted data blocks in the distributed storage system to evolve towards the optimal state.

[0024] In order to ensure the integrity of encrypted data blocks during storage and transmission, the system generates multiple check values ​​for each data block, including hash values, cyclic redundancy check values ​​(CRC), error correction codes (ECC), and message authentication codes (MAC). The generation of these check values ​​is not only a means of verifying the content of the encrypted data block, but also an important basis for subsequent consistency checks. Among them, the hash value is used to quickly determine whether the data block has been tampered with. By comparing the hash value generated during storage and the hash value recalculated during access, the abnormal data block can be quickly located; the cyclic redundancy check value provides efficient verification support through low-level error detection of the data block, and the error correction code provides automatic repair capabilities when the data block is slightly damaged; the message authentication code further ensures that the data will not be maliciously tampered with when transmitted between multiple nodes. These multi-level verification mechanisms complement each other and jointly build a secure and stable integrity verification framework. On the basis of completing the data integrity verification, the system will normalize the data based on the access control vector to further implement consistency checks. The core of the normalization process is to unify information such as multiple verification results, access permission levels, and data block priorities into a standardized indicator. This not only simplifies the processing of multi-dimensional information, but also provides a general quantitative basis for subsequent optimization calculations. In this process, the access control vector plays an important role. It not only determines whether the user has the right to access certain encrypted data blocks, but also provides a reference for access behavior for consistency checks. For example, when the system detects that a user's access request frequency is abnormal or the permission level does not meet expectations, the weight parameters in the normalization process can be dynamically adjusted to further strengthen the constraints and optimization of data access behavior.

[0025] After the data integrity verification and consistency check are completed, the system will calculate a global load balancing factor based on the real-time total data access load and the total number of concurrent requests. The calculation of this factor is the key to the entire step 3, which determines how the distributed storage system dynamically adjusts the data block sharding strategy to adapt to the current load status. The core logic of the load balancing factor is to combine the resource usage of the storage node (such as bandwidth, CPU usage, memory usage, IOPS, etc.) and the characteristics of the data block (such as access frequency, sensitivity, data size, etc.), and calculate a comprehensive optimization value through a mathematical model. This optimization value not only reflects the current load of the system, but also guides the system to evolve to the optimal load state through a dynamic adjustment weight mechanism. For example, when the load of some storage nodes is too high, the load balancing factor will dynamically divert the data blocks on these nodes and migrate some high-priority data blocks to low-load nodes, thereby achieving a balanced distribution of the load. It is worth noting that in the process of calculating the load balancing factor, the initial average optimal number of shards plays an important role. The initial average optimal number of shards is the initial sharding strategy calculated based on the resource capacity of the distributed storage nodes in step 1, which provides a basic reference value for the optimization calculation in step 3. In practical applications, the system will adjust the number and distribution of shards of the current data block in combination with the initial average optimal number of shards and the real-time load status. Through this dynamic iteration method, the system can gradually approach the global optimal sharding state and maximize the storage efficiency and access performance. In addition, the sharding optimization in step 3 also fully considers the security requirements of the data. In traditional distributed storage systems, the goal of data sharding is often limited to performance optimization, while ignoring the focus on security. The present invention introduces access control vectors and data integrity verification results into the calculation process of sharding optimization to ensure that highly sensitive data blocks can be preferentially allocated to high-security nodes for storage. For example, when the access frequency and sensitivity score of a certain type of data block are high, the system will automatically divide it into nodes with higher bandwidth, lower load and higher security for storage, while low-priority data blocks will be allocated to nodes with relatively ordinary resources, thereby achieving dual optimization of performance and security. Different from the traditional static sharding strategy, the present invention introduces load balancing factors and dynamic sharding optimization mechanisms, so that the system can automatically adjust the sharding strategy according to the real-time changing load status and access requirements. This dynamic adjustment not only improves the resource utilization efficiency of the system, but also greatly enhances the adaptability of the distributed storage system in high concurrency and complex business scenarios. For example, in certain peak access scenarios, the system can allocate more resources to the access of key data blocks by optimizing the load balancing factors in real time, thereby ensuring the continuity and stability of the business without human intervention or system restart.

[0026] Embodiment 2: The operating parameters of the storage node include: bandwidth capacity, CPU usage, memory usage, disk input and output operations per second, average response time and concurrency.

[0027] Specifically, in actual operation, the bandwidth capacity of the storage node determines its ability to handle large-scale data transmission. Especially in a distributed storage environment, bandwidth limitations may directly become a bottleneck for system performance. Encrypted databases need to frequently transmit encrypted data blocks between nodes, such as multi-copy synchronization, large data volume query, or backup and recovery operations, all of which rely on the adequacy of bandwidth. Therefore, the system monitors the bandwidth utilization of each node in real time and dynamically adjusts the allocation of data according to the available bandwidth of the node. For example, when the bandwidth of a node is close to saturation, the system will give priority to nodes with larger bandwidth margins to store data blocks with high access frequency, thereby avoiding data access delays caused by network congestion. This dynamic bandwidth allocation mechanism not only improves the throughput of the system, but also maintains stable performance in high-concurrency scenarios. In addition to bandwidth, CPU usage is an important indicator of the operating status of storage nodes, which reflects the pressure of nodes when processing computationally intensive tasks such as encryption, decryption, and data verification. In encrypted databases, encryption and integrity verification of data blocks are common high-load computing tasks. When the CPU usage of a node is too high, it may lead to reduced data processing efficiency or even task timeout. Therefore, the system dynamically evaluates CPU usage and reasonably allocates computing tasks to balance the load. For example, intensive encryption operations are preferentially allocated to nodes with lower CPU loads, while high-load nodes are mainly used to complete lightweight tasks such as data transfer or temporary storage. This regulation mechanism for CPU usage enables the system to find the best balance between encryption computing tasks and storage operations, thereby improving overall resource utilization efficiency.

[0028] Memory usage is a key parameter that reflects the storage buffering capacity of a node and is closely related to the cache and read performance of encrypted data blocks. In high-frequency access scenarios, encrypted databases need to frequently read and cache data blocks, so the adequacy of memory resources is crucial to system performance. By monitoring the memory usage of nodes in real time, the system can dynamically adjust the distribution strategy of encrypted data blocks and store high-frequency access data blocks on nodes with abundant memory first, thereby reducing the pressure of disk I / O and improving the speed of data access. In addition, the system can also optimize access control and permission allocation based on the memory usage status, such as limiting the access requests of low-priority users on nodes with tight memory to ensure the service quality of high-priority users. Disk input and output operations per second (IOPS) is a core indicator for measuring the disk performance of storage nodes, which is particularly important in the distributed environment of encrypted databases. The storage and reading of each encrypted data block depends on the read and write capabilities of the disk. Especially when dealing with large-scale concurrent access, IOPS determines the system's ability to respond to high-load requests. When the IOPS of some nodes approaches its maximum value, the system will reduce the read and write operations on these nodes through dynamic adjustment of the sharding strategy, and allocate the newly generated encrypted data blocks to nodes with more sufficient IOPS resources for storage. At the same time, for hot data blocks that need to be accessed frequently, the system will give priority to nodes with higher IOPS performance for storage, thereby avoiding data access delays caused by disk performance bottlenecks. This dynamic optimization mechanism makes full use of the storage resources of the nodes and improves the robustness of the distributed storage system in high-load scenarios.

[0029] The average response time is another key parameter for the system to evaluate node performance. It comprehensively reflects the efficiency of the node when performing data storage, transmission and computing tasks. For encrypted databases, each access request may involve data interaction between multiple nodes. Nodes with longer response times will directly affect the completion speed of the entire request. Therefore, the system dynamically monitors the response time of each node and preferentially allocates encrypted data blocks with high sensitivity or high real-time requirements to nodes with shorter response times. This allocation strategy based on response time not only improves the access efficiency of key data, but also gradually reduces the global delay of the system by optimizing resource distribution. Finally, the number of concurrency, as a load status indicator of the storage node, reflects the ability of the node to process multiple requests at the same time. In encrypted databases, high-concurrency access scenarios are very common, such as multiple users querying or modifying the same data set at the same time. Too high a concurrency will cause the node to be overloaded, thereby reducing the service quality and even causing the node to be unavailable. Therefore, the system monitors the number of concurrency in real time and takes current limiting or traffic migration measures for high-concurrency nodes in the sharding strategy and load balancing mechanism. For example, when the concurrency of a node exceeds the threshold, the system will allocate some newly generated encrypted data blocks to other nodes for storage, and dynamically adjust the access control vector to limit the access requests of low-priority users. This dynamic concurrency control mechanism effectively avoids performance bottlenecks caused by single-node overload, while ensuring the overall stability of the system.

[0030] Embodiment 3: The business attributes include: sensitivity score, data access frequency, data type identifier, response time requirement, data size, number of concurrent access users, encryption level and timestamp; the sensitivity score ranges from 1 to 10, indicating the security sensitivity level of this type of data, and the higher the sensitivity score, the greater the contribution to the key; the data access frequency indicates the access frequency of this type of data; the data type identifier takes a value of 1, 2 or 3, when the value is 1, it indicates structured data, when the value is 2, it indicates semi-structured data, and when the value is 3, it indicates unstructured data; the response time requirement indicates the response time constraint on this type of data, and the smaller the value, the higher the real-time requirement; the encryption level ranges from 1, 2 or 3, and the higher the value, the higher the corresponding encryption level.

[0031] Specifically, the sensitivity score is a crucial dimension in the business attributes of data, which directly reflects the security level of the data. The score ranges from 1 to 10, and the higher the value, the more sensitive the data. For example, financial account information, medical records, or commercial confidential documents are usually assigned a higher sensitivity score. The sensitivity score plays a weighted role in the key generation process, and highly sensitive data contributes more to the strength of the key. Through such a design, the system can generate keys with differentiated strengths according to the importance of the data, thereby achieving targeted protection under limited resources and avoiding the waste of computing resources caused by excessive encryption of low-sensitivity data. The frequency of data access is an important indicator for measuring data activity, reflecting the frequency of access to a certain type of data over a period of time. Data with a high access frequency, such as inventory information of popular products or real-time transaction logs, usually needs to be encrypted and stored on high-performance nodes in priority to reduce access delays and improve user experience. The system monitors the access frequency in real time and introduces this attribute into the feature vector to ensure that high-frequency data is more reasonably distributed in the distributed storage system. At the same time, a higher weight is given to high-frequency data during the key generation process to improve security.

[0032] The data type identifier is used to distinguish the differences between structured, semi-structured and unstructured data. Specifically, structured data (value 1) is usually stored in a relational database with clear field definitions; semi-structured data (value 2) such as JSON files or XML documents has a certain structure but a more flexible format; unstructured data (value 3) such as video, image or audio files has no fixed structure at all. The system uses this identifier to adopt different encryption and storage strategies for different types of data. For example, structured data usually requires fast query and efficient decryption, so lightweight encryption algorithms are preferred, while unstructured data may be stored in blocks and encrypted in pieces due to its large size and relatively low access frequency. The response time requirement represents the real-time constraint on data processing. The smaller the value, the higher the requirement for response speed. In actual applications, transaction data or user authentication data usually requires millisecond-level responses, so the response time requirement will be set lower. Access to historical archived data may allow higher latency, so the response time requirement is higher. The system will take this attribute into consideration when allocating storage nodes, and allocate data with low response time requirements to nodes with higher performance. At the same time, this attribute will be weighted during the key generation process, so that high real-time data will be given priority protection in encryption and access control. Data size is a key indicator reflecting the cost of data storage and transmission. When the system is distributed, it is necessary to adjust the sharding strategy according to the size of the data block. For example, large data blocks can be split into smaller units for distributed storage and fast access. At the same time, the size of the data will also affect the key generation. Larger data blocks will require higher key strength, thereby increasing security and anti-cracking capabilities during encryption.

[0033] The number of concurrent access users is an indicator of the number of requests that the system needs to process in the same time period. This attribute is of great significance to load balancing and access control. High-concurrency data, such as shared documents or public service interfaces, usually need to be allocated to storage nodes that support high concurrency first. At the same time, the system will dynamically adjust the access control policy according to the number of concurrency to limit the access frequency of low-priority users to ensure the overall stability of the system. The encryption level is a direct attribute that describes the data security requirements. Its value range is 1, 2, or 3, corresponding to low, medium, and high levels respectively. Data with high encryption levels are usually used in sensitive scenarios, such as the financial and medical industries. The system will assign higher-strength keys to them, use more complex encryption algorithms, and add copies or redundancy when storing to improve fault tolerance. Data with low encryption levels may only require basic encryption protection to reduce the system's computing burden and resource consumption. Timestamp is a key attribute that introduces dynamicity and is used to mark the time when data is generated or modified. In the key generation process, timestamp is used as a dynamic variable, which together with other attributes determines the uniqueness and timeliness of the key. This design can effectively prevent the reuse of keys and ensure that the regeneration of keys can be automatically triggered when data is updated, thereby further improving the security of the system. Through the comprehensive definition and combination of the above business attributes, the present invention constructs a flexible multi-dimensional feature system that can accurately describe the business characteristics of data and play an important role in encryption key generation, data storage optimization and dynamic access control. Compared with traditional technologies, the innovation of the present invention lies in integrating these attributes in the form of quantization and feature vectors, and giving them a dynamic weight control mechanism in the key management system, thereby realizing differentiated management of different scenarios and different types of data. This differentiated management not only improves the utilization efficiency of system resources, but also significantly enhances the security and controllability of data, providing unprecedented technical support for efficient data governance in large-scale distributed storage systems.

[0034] Embodiment 4: Assume The multidimensional feature vector of the class data is: ; in, For the Sensitivity score of class data; For the The frequency with which the data of the class data is accessed; For the Data type identifier of class data; For the Response time requirements for class data; For the The data size of the class data; For the The number of concurrent users accessing class data; For the The encryption level of the class data; For the The timestamp of the class data; a unique encryption key is generated by the following formula : ; in, is the number of categories of data; Represents the L1 norm of the multidimensional feature vector; is the set encrypted large prime number; It is a modulo operation.

[0035] Specifically, the principle of the formula proposed in Example 4 is to comprehensively utilize the multi-dimensional characteristics of the data, and use nonlinear transformation and dynamic parameter coupling to generate an encryption key that can fully reflect the security requirements, access requirements and real-time status of each type of data. This section explains how it constructs a core sub-expression that numerically reflects both the data security level and the access load characteristics by multiplying the sensitivity score, access frequency, and data size, and combining the data type and exponential factor. This sub-expression amplifies the nonlinear impact of the sensitivity score through exponential operations, and takes the square root of the product of the response time requirement and the number of concurrent access users in the denominator, thereby limiting the security risks that may be caused by high concurrency and low latency scenarios. In business practice, highly sensitive and frequently accessed data often require stricter encryption strength, and this formula cleverly reflects this requirement in the index processing, thereby achieving accurate weighting of sensitive data. At the same time, for large data volumes, the formula introduces The cumulative sum is combined in the denominator and The square root operation can prevent the system performance bottleneck caused by excessive expansion of encryption strength. This structure logarithmically transforms the product of data size and encryption level, and combines it with a timestamp hash function to constrain the denominator. In this way, the system can dynamically adjust the impact of the logarithmic result according to the timestamp when constructing the encryption key. On the one hand, it improves the randomness of the key changing over time, and on the other hand, it also brings the convenience of traceability and expiration update mechanism to the key management system. After the logarithmic operation, data with a high encryption level will obtain additional numerical gain, thereby improving the strength of the final key in combination with the hash value. At the same time, if a certain type of data has a high encryption level, but the data block is not large, or the timestamp has changed recently, then in the The contribution to the overall key can also be moderately controlled in the term to prevent excessive accumulation of encryption complexity and affect actual usage efficiency. This flexible mechanism ensures that the system can adaptively find the balance between security and performance when facing data of different types and sizes. In the overall structure of this formula, the multi-dimensional features of each type of data are quantified and then summed, and finally modulo a large prime number. , which can not only ensure that the generated key is controlled in the numerical range, but also enhance the resistance to reverse inference by attackers. Through modulo operation, the key management system can fix the effective length of the encryption key and avoid transmitting too long key values ​​between distributed storage nodes. Furthermore, adding the vector norm The purpose is to introduce a measure of the overall scale of multidimensional features into the formula, so that when the eigenvalues ​​are distributed in different orders of magnitude, their normalized differences within the same data category can also be reflected through the norm. In this way, if the sensitivity score and access frequency of the same type of data are both particularly high, then The weight of this type of data in key generation will also be larger, correspondingly increasing the proportion of this type of data in key generation, thereby achieving focused protection of key data. If the overall indicators of each dimension of a certain type of data are low, even if the value is more prominent in a specific dimension, it will not excessively push up the overall key generation amount, maintaining the balance and robustness of the formula. At the implementation level, when the distributed storage system receives various types of data in the database, it will generate a feature vector for each category, and then use this formula to calculate the contribution value of each category one by one and accumulate them. During this period, the timestamp hash function It will change with the advancement of the system clock. When the key is updated periodically or event-driven, it will bring different hash values ​​to the new round of calculations, so that the final key will show significant time-varying characteristics. The key management system can flexibly version the keys, regularly abolish expired keys and enable new keys to prevent the same key from being brute-forced or leaked due to long-term use. At the same time, the nonlinear factors and logarithmic operations in the formula ensure the accurate weighting of highly sensitive, highly concurrent, and highly accessed data, so that it can obtain higher encryption strength than other ordinary data during the key generation process, and the data that requires a higher level of security protection will also be fully weighted in numerical terms. This design not only meets the needs of refined control of large-scale data in a distributed environment, but also enables the key management process to have higher dynamic adaptability.

[0036] Embodiment 5: Each type of data is encrypted using an encryption key using the CBC mode of the AES encryption algorithm.

[0037] Specifically, during the implementation process, each type of data first dynamically generates a unique encryption key based on its business attributes. . The generation of this key comprehensively considers the multi-dimensional characteristics of the data, such as the sensitivity score, access frequency, encryption level and timestamp, so that the key can not only match the security requirements of the data in a targeted manner, but also can be dynamically adjusted with changes in time or environment. This dynamically generated key, when input into the AES encryption algorithm, provides a highly unique and unpredictable encryption parameter for each type of data, greatly improving the security of the encryption process. The core of the AES algorithm is to convert plaintext data into ciphertext through a series of complex operations such as substitution, shift and column confusion. This encryption process is extremely sensitive to the input data, and any slight change in the key will result in completely different encryption results. Therefore, the dynamic key generation mechanism in the present invention is the cornerstone to ensure the overall security of the system. The introduction of the CBC mode further enhances the randomness and anti-attack capabilities of encryption. In the CBC mode, the plaintext data is divided into blocks of fixed size (for example, 128 bits), and each data block is XORed with the previous ciphertext block before being input into the AES algorithm for encryption. In order to initialize the encryption process, the CBC mode requires an initial vector IV as the input before the encryption of the first data block. The design of IV needs to meet the requirements of randomness and uniqueness, which ensures that even if the same plaintext and key are encrypted at different times, completely different ciphertexts will be generated. This mechanism effectively prevents the possibility of repeated data patterns being exploited by attackers. In the present invention, IV is generated based on the timestamp of the data. And the running status of the nodes in the system, by hashing or pseudo-random number transformation of these dynamic parameters, to ensure the unpredictability of IV. This method not only increases the dynamic nature of encryption, but also makes the data more secure during storage and transmission.

[0038] The core advantage of the AES-CBC mode lies in the chain dependency between data blocks, and the generation of each ciphertext block depends on the output of the previous ciphertext block. This chain structure makes it impossible for an attacker to independently decrypt the original plaintext even if he can obtain a ciphertext block, because the input of the previous ciphertext block is a necessary condition for the decryption process. In addition, during the decryption process, if a ciphertext block is tampered with, the chain structure will make all subsequent data blocks starting from this block unable to be correctly decrypted, thereby playing a role in data integrity protection. In the scenario of the present invention, this feature is particularly suitable for data management in a distributed storage environment, because each encrypted data block may be distributed on different storage nodes, and the chain dependency of CBC can provide additional guarantees for data consistency and tamper-proof in this distributed structure. At the same time, the performance of the AES-CBC mode is also very suitable for the needs of distributed encrypted databases. The amount of encryption and decryption operations is relatively small with the support of modern hardware, and large-scale data processing can be completed efficiently. In addition, since distributed storage systems usually split large files into multiple small data blocks for storage, the AES-CBC mode is naturally suitable for this block-based encryption scenario. The encryption of each data block is completed independently. Although they are logically associated through chain dependencies, they can be physically distributed to different nodes for parallel processing, thereby greatly improving the encryption and decryption efficiency of the system. In a distributed storage system, the distribution of data blocks is closely related to the management of encryption keys. The present invention binds dynamically generated keys to encrypted data blocks through a key management system, and records metadata for the encryption process of each data block. These metadata include information such as the identifier of the encryption key, the value of IV, the mode of the encryption algorithm, etc., which are securely stored in the key management system and dynamically retrieved when the data is decrypted. In this way, the system can quickly locate the encryption key and complete the decryption operation in a high-concurrency access scenario. In addition, the key management system also supports periodic rotation and expiration management of keys. When the key reaches the expiration date, the system triggers a re-encryption operation, generates a new key and encrypts and updates the relevant data blocks, further enhancing the security of the data. Compared with traditional static keys or simple encryption modes, the present invention achieves a comprehensive improvement in dynamics, anti-attack and flexibility. The disadvantage of traditional static keys is that once the key is leaked, all related data will be at risk. However, the present invention combines dynamic key generation with the AES-CBC mode, so that even if the key of a certain time period is leaked, the attacker cannot crack the data of other time periods. In addition, the random IV design of the AES-CBC mode makes the ciphertext of the same data completely different when encrypted at different times, thereby preventing known plaintext attacks and pattern recognition attacks. For the high concurrency and multi-node characteristics of distributed storage systems, the encryption scheme of the present invention can efficiently collaborate between nodes and be uniformly controlled by the key management system, achieving a perfect balance between security and performance.

[0039] Example 6: Preliminary average optimal number of fragments for all encrypted data blocks Calculated by the following formula: ; in, For the Memory usage of storage nodes; For the The number of disk input and output operations per second for each storage node; is the determinant operator; is the number of storage nodes; For the The bandwidth capacity of each storage node; For the The CPU usage of each storage node.

[0040] Specifically, the core idea of ​​the formula is to The resource capacity of each storage node is mathematically modeled. The resource status of each node is represented in matrix form, including memory usage , Disk IOPS , bandwidth capacity , and CPU usage Through determinant calculation, these indicators are combined into a scalar to reflect the overall performance of a single node. The introduction of the determinant can not only capture the interaction between resource indicators, but also give certain key parameters (such as bandwidth or IOPS) higher weights through the diagonal advantage of the matrix, thereby enhancing the sensitivity to resource bottlenecks in the system. For example, when the bandwidth capacity of a node When the CPU usage is high, the determinant value will increase significantly, indicating that the node has an advantage in supporting high-throughput data transmission tasks; When it is lower, it will also have a positive impact on the determinant value, indicating that the node has greater potential in processing encryption or decryption tasks. It is one of the important parameters in the formula, which directly affects the cache capacity and storage performance of the node. Nodes with lower memory usage usually have higher resource margins, can support frequent access requests and improve the response speed of data access. Therefore, in the sharding optimization process, memory usage becomes one of the key bases for evaluating node priority. Disk IOPS It measures the read and write performance of storage devices and is an important indicator for processing high-frequency access tasks. For encrypted data blocks that need to be read or written frequently, the priority of high IOPS nodes will be significantly increased. Bandwidth capacity The formula reflects the node's capacity at the network transmission level, especially in distributed storage systems, where synchronization between multiple nodes and user access require significant bandwidth. When the node's bandwidth capacity is high, the sharding strategy will prioritize allocating data blocks that need to be frequently transmitted or accessed to these nodes to reduce network latency and improve access performance.

[0041] In addition, the CPU usage in the formula Represents the computing resource load of the node. For encrypted database systems, operations such as encryption, decryption, and integrity verification of data blocks consume a lot of CPU resources. Therefore, nodes with low CPU usage can better support these computing-intensive tasks and thus receive higher priority in the sharding strategy. The formula combines these resource parameters and quantifies the comprehensive performance score of each node through determinant calculation, which can fully reflect the node's capabilities in storage, computing, and transmission. By normalizing the scores of all nodes, the formula finally calculates the preliminary average optimal number of shards. . This value is the global optimization result of the distribution of encrypted data blocks in the entire distributed storage system, and can allocate a reasonable number of shards and distribution strategy for each type of data. For example, for data blocks with high access frequency, the system will give priority to nodes with higher performance scores; while for cold data with low access frequency, the system will select nodes with low performance scores but sufficient storage capacity. Such a strategy can not only maximize the utilization efficiency of system resources, but also avoid single-point overload or performance bottlenecks by balancing the load. The determinant operation in the formula also has the characteristics of dynamic adaptation. When the resource status of a node changes, such as the increase in memory usage or the decrease in bandwidth capacity, its determinant value will be adjusted accordingly, thereby affecting the global optimization result. This dynamic adjustment mechanism enables the distributed storage system to achieve real-time balance between resource utilization and data distribution, ensuring that the system can still run efficiently in high concurrency and complex business scenarios. In addition, the formula integrates the originally scattered resource information into a unified performance indicator through a comprehensive evaluation of node resources, simplifies the design and execution of sharding strategies, and has high practicality. Compared with traditional sharding strategies, the formula proposed in the present invention establishes a strong correlation between data characteristics and node performance. Traditional strategies usually use data size or simple random distribution as the basis for sharding, ignoring the differences in storage node resource status, which can easily lead to resource waste or performance bottlenecks. However, the present invention dynamically adjusts data distribution and the number of shards by comprehensively evaluating multiple dimensions such as memory, IOPS, bandwidth, and CPU usage, thereby achieving dual optimization of resource utilization and data access performance. In addition, the design of the formula also fully considers the characteristics of dynamic changes in resources in distributed storage systems, allowing the system to adapt to load fluctuations during operation, further improving the robustness and stability of the system.

[0042] Example 7: Access Control Vector Calculated by the following formula: ; in, The user's permission level is an integer from 1 to 5. The CPU usage allowed for the access corresponding to the user. The number of concurrent accesses allowed for the user. The number of disk input and output operations per second allowed for the access corresponding to this user; The access bandwidth allowed for the user; The average response time allowed for the access corresponding to the user; The memory usage allowed for access by the user; No. A hash value of the timestamp of the class data; is the minimum function; For the The number of concurrent storage nodes; For the The average response time of each storage node.

[0043] The access control vector in the specific formula It is a six-dimensional vector, each dimension of which represents the upper limit of the resources that the user is allowed to access in the system, including CPU usage , concurrent number , Disk IOPS ,bandwidth , Average response time and memory usage These dimensions comprehensively describe the dynamic relationship between user access rights and system resources, which can effectively limit the excessive consumption of system resources by user access behaviors, while providing priority protection for access by high-priority users and highly sensitive data. It is one of the core variables in the calculation of access control vector. The value range of permission level is an integer from 1 to 5. The higher the value, the greater the user permission. This design provides a basis for the system to implement multi-level access control. The system can adjust resource allocation priorities for different users globally. For example, high-authority users (such as system administrators or key business users) will receive greater Weights are assigned to high-privilege users, allowing them to occupy more system resources when accessing data, such as higher CPU usage, greater bandwidth, and lower response time. In contrast, resource allocation for low-privilege users is restricted to prevent them from affecting system performance and security.

[0044] The operating parameters of the storage node are calculated through the minimum function The formula is introduced to provide dynamic constraints for the access control vector. Specifically, the resource upper limit of each dimension is determined by the minimum value of the corresponding parameter of all storage nodes in the system. For example, CPU usage The minimum CPU usage of all storage nodes Determined by bandwidth The minimum bandwidth capacity of the node is This minimum constraint ensures that the user access rights will not exceed the system's current minimum resource level, avoiding the problem of global resource over-allocation due to insufficient performance of a single node. Data characteristics are determined by exponential decay functions and timestamp hash values. The calculation of access control vector is introduced to reflect the impact of data dynamic attributes on user access rights. Describes the key strength , Data size , and response time requirements A comprehensive effect on access rights. Among them, data with stronger key strength usually has higher security requirements, so the constraints on user rights in the access control vector are more stringent; data with larger data size or lower response time requirements will further increase the difficulty of access rights to prevent large-scale data access from impacting system resources. Timestamp hash value The introduction of gives the access control vector dynamics and randomness, allowing user permissions to be automatically updated over time, further improving the security of the system. The formula also includes the accumulation and normalization of timestamp hash values ​​for all data categories. Specifically, by The timestamp hash values ​​of the data are summed and normalized, and the system can globally balance the access rights of different data categories. This global processing method helps to ensure the access priority of highly sensitive data in multi-user concurrent scenarios, while limiting the excessive access of low-priority users to non-critical data. The calculation result of is output in the form of a six-dimensional vector, which contains the specific limit value of each resource dimension. Possibly , indicating that the user can occupy up to 20% of the CPU usage, allow 100 concurrent requests, use up to 500 disk I / O operations, occupy 1Gbps of bandwidth, ensure the average response time is less than 100ms, and limit the memory usage below 50%. This quantified access restriction can be directly applied to the access control module of the distributed storage system to make real-time judgments and restrictions on user access requests. Compared with the traditional static access control model, the access control vector formula in the present invention has significant dynamics and adaptability. Traditional methods often set user permissions based on predefined fixed rules and cannot be dynamically adjusted according to system status and data characteristics. This formula combines user permission levels, node operating parameters and data dynamic characteristics to enable access control to be automatically updated as system resources change, ensuring that the system can still maintain stability and efficiency in high concurrency and complex business scenarios. At the same time, the introduction of timestamps makes the calculation results of access rights time-effective, effectively preventing long-term idle permissions from being abused.

[0045] Embodiment 8: The verification value is calculated by the following formula to complete data integrity verification and consistency check: ; in, No. The verification value of the encrypted data block corresponding to the class data. When the verification value is within the set threshold range, it means that the encrypted data block corresponding to the class data has passed the verification and is allowed to be accessed. Otherwise, the access is denied. for The hash value of the encrypted data block corresponding to the class data; for The error correction code of the encrypted data block corresponding to the class data; for The message authentication code of the encrypted data block corresponding to the class data.

[0046] Specifically, verify the value It is a comprehensive indicator that dynamically evaluates whether the data block meets the requirements of integrity and consistency by performing nonlinear calculations on multiple verification parameters of the data block, combining the business attributes of the data and the optimization results of the storage system. When the verification value is within the set security threshold range, it means that the data block has not been tampered with or damaged, and the system allows access to the data block; otherwise, the access request will be rejected. This verification mechanism can not only efficiently identify data corruption or illegal tampering, but also adapt to different data security requirements and system performance requirements through threshold adjustment. In the formula, the hash value It is the basis for data integrity verification. Each encrypted data block generates a unique hash value when it is stored, which reflects the fixed fingerprint of the data content. When the data is accessed, the system recalculates the hash value of the current data block and compares it with the hash value recorded when it was stored. Compare. If the two are consistent, it means that the data block has not been tampered with or damaged during storage and transmission. As a core part of the formula, the comparison of hash values ​​can quickly and efficiently complete the basic integrity verification.

[0047] Error Correction Code The robustness of data verification is further enhanced in the formula. Unlike hash values, error correction codes can not only detect errors in data blocks, but also automatically repair errors to a certain extent. For example, during data transmission, if some bits are flipped, the error correction code can restore the original data through redundant information. This feature allows the system to automatically complete repairs even when faced with small-scale data corruption without having to reject access requests, thereby improving data availability and system fault tolerance. Message Authentication Code The authentication function is introduced for data verification. It can not only verify the integrity of the data, but also ensure that the source of the data is credible. The message authentication code is composed of the encryption key It is generated together with the data block content, and its value is closely related to the encryption key. When an attacker tries to tamper with the data, even if he forges a new hash value or error correction code, he cannot access or reproduce it. , generated The addition of message authentication codes greatly improves the system's ability to resist malicious tampering and forgery, and provides additional protection for data security in distributed storage systems. The key strength, data size, and response time requirements are combined to dynamically adjust the weight distribution of verification values. Key Strength The larger the size, the higher the security requirement for the data and the stricter the verification requirement. and response time It regulates the dynamic characteristics of the formula, ensuring that the calculation of the verification value can balance the relationship between security and performance in large data blocks or high real-time scenarios. The introduction of gives the formula dynamics and timeliness, ensuring that the verification value can be automatically adjusted over time to prevent long-term static verification parameters from being exploited by attackers. When calculating the verification value, the formula also introduces a global optimization parameter and access control vector . It is the optimal number of shards obtained through global storage node resource evaluation, reflecting the current storage status and performance indicators of the system. Including it in the verification value calculation can ensure the consistency of the data verification process and system performance optimization, and avoid excessive verification load affecting the overall performance of the system. Access Control Vector Combined with user permissions and system resource allocation, dynamic constraints are provided for data validation, further improving the adaptability and refinement of the formula. It is a comprehensive value generated by the combined effect of the above parameters. When the verification value falls within the preset security threshold, it indicates that the data block has passed the integrity and consistency check and the access request is allowed; otherwise, the system will deny access and may trigger the corresponding security incident handling process. Through this mechanism, the system can efficiently and reliably maintain data security and consistency in a distributed storage environment.

[0048] Embodiment 9: The average optimal number of shards for all encrypted data blocks in the distributed storage system is guided to evolve toward the optimal state by the following formula: ; in, For time The load balancing factor is calculated as follows: ; in, For time The total number of concurrent requests at the time; For time Total data access load at time ; For time The total number of concurrent requests at the time.

[0049] Specifically, the formula It shows that the optimal number of fragments for encrypted data blocks is the average optimal number of fragments calculated initially. and time Load balancing factor Joint decision. Here, It is the static optimization result calculated in Example 6, which provides the basic sharding solution of the system based on the resource status of the storage node (such as bandwidth, CPU usage, memory usage, etc.). It is a dynamic adjustment factor that can dynamically modify the sharding strategy according to the real-time load and concurrent requests of the system at different time points, so that it can gradually evolve to the optimal state. Load balancing factor The calculation formula is complex and sophisticated, reflecting an in-depth analysis of system resource utilization and load distribution characteristics. The formula is divided into two main parts: the first part Describes a Poisson distribution probability density function, which is used to model the randomness and volatility of data access requests in a system. The parameters of the Poisson distribution are Indicates time The greater the total load at the time, the higher the load pressure of the system; is the total number of concurrent requests, which is used to describe the number of requests that the system handles at the same time. and When the ratio is close to 1, the probability density value of the Poisson distribution is the largest, indicating that the system is in a state of balanced resource utilization; when the ratio deviates from 1, the efficiency of load distribution decreases. The second part of the formula is a normalized gamma distribution function, which is used to describe the system's responsiveness and resource allocation efficiency under high load scenarios. The shape parameter and scale parameter of the gamma distribution are respectively and Decision, among which Describes the degree of consumption of system resources by the number of concurrent requests, and It represents the overall ability of the system to handle these requests. The exponential decay term in the distribution function High load scenarios are constrained to ensure When the number of shards for a single request is reduced, the system can maintain overall performance. Combining the above two parts, the load balancing factor Dynamically balances system load and concurrent requests The relationship between It can be adjusted dynamically according to the actual operation conditions. For example, when the total system load Higher number of concurrent requests When the weight of the Poisson distribution part is moderate, the system will give priority to increasing the number of shards to relieve node pressure; Increase to nearly When the gamma distribution reaches its limit, the weight of the gamma distribution increases, and the system will gradually reduce the number of shards to ensure overall load balance. In addition, the integral term in the formula is a specific form of the gamma function, which is used to normalize the distribution results. Through this integral term, the formula can generate a comparable value under different load and concurrency conditions. This allows distributed storage systems to quickly adapt to new sharding strategies in highly dynamic scenarios without having to recalculate the entire storage layout.

[0050] The present invention is described in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. An efficient data management method for encrypted database based on a key management system, characterized in that: The method comprises: Step 1: Store the database through a distributed storage system. According to the business attributes of the data in the database, a multi-dimensional feature vector is established for each type of data, and a unique encryption key is generated based on it. Each type of data is encrypted using the encryption key to generate a corresponding encrypted data block. Based on the operating parameters of each storage node, the comprehensive evaluation value between each storage node in the distributed storage system is calculated to determine the resource capacity of each storage node, and the preliminary average optimal number of shards for all encrypted data blocks in the distributed storage system is determined. Step 2: Combine the operating parameters of each storage node and the permission level allowed for the user's role in the distributed storage system to obtain an access control vector, and combine the time dimension to constrain it to prevent timeout access or unauthorized access, thereby dynamically strengthening the access control vector; when the time or key is updated, the access control vector will also be dynamically refreshed; Step 3: For each encrypted data block, calculate the hash value, cyclic redundancy check value, error correction code and message authentication code, and normalize them accordingly in combination with the access control vector to complete data integrity verification and consistency check; calculate a load balancing factor based on the real-time total data access load and the total number of concurrent requests, and combine it with the preliminary average optimal number of shards to guide the average optimal number of shards of all encrypted data blocks in the distributed storage system to evolve towards the optimal state.

2. The method for efficient data management of encrypted database based on key management system according to claim 1, characterized in that: The operating parameters of the storage node include: bandwidth capacity, CPU utilization, memory utilization, disk input and output operations per second, average response time and concurrency.

3. The efficient data management method for encrypted database based on key management system as claimed in claim 2, characterized in that: The business attributes include: sensitivity score, data access frequency, data type identifier, response time requirement, data size, number of concurrent access users, encryption level and timestamp; the sensitivity score ranges from 1 to 10, indicating the security sensitivity level of this type of data, and the higher the sensitivity score, the greater the contribution to the key; the data access frequency indicates the access frequency of this type of data; the data type identifier takes a value of 1, 2 or 3, when the value is 1, it indicates structured data, when the value is 2, it indicates semi-structured data, and when the value is 3, it indicates unstructured data; the response time requirement indicates the response time constraint on this type of data, and the smaller the value, the higher the real-time requirement; the encryption level ranges from 1, 2 or 3, and the higher the value, the higher the corresponding encryption level.

4. The method for efficient data management of encrypted database based on key management system as claimed in claim 3, characterized in that: Set up The multidimensional feature vector of the class data is: ； in, For the Sensitivity score of class data; For the The frequency with which the data of the class data is accessed; For the Data type identifier of class data; For the Response time requirements for class data; For the The data size of the class data; For the The number of concurrent users accessing class data; For the The encryption level of the class data; For the The timestamp of the class data; a unique encryption key is generated by the following formula : ； in, is the number of categories of data; Represents the L1 norm of the multidimensional feature vector; is the set encrypted large prime number; is the modulo operation; express The hash value of .

5. The method for efficient data management of encrypted database based on key management system as claimed in claim 4, characterized in that: Each type of data is encrypted using the encryption key using the CBC mode of the AES encryption algorithm.

6. The method for efficient data management of encrypted database based on key management system as claimed in claim 5, characterized in that: The initial average optimal number of shards for all encrypted data blocks Calculated by the following formula: ； in, For the Memory usage of storage nodes; For the The number of disk input and output operations per second for each storage node; is the determinant operator; is the number of storage nodes; For the The bandwidth capacity of each storage node; For the The CPU usage of each storage node.

7. The method for efficient data management of encrypted database based on key management system as claimed in claim 6, characterized in that: Access Control Vector Calculated by the following formula: ； in, The user's permission level is an integer from 1 to 5. The CPU usage allowed for the access corresponding to the user. The number of concurrent accesses allowed for this user. The number of disk input and output operations per second allowed for the access corresponding to this user; The access bandwidth allowed for the user; The average response time allowed for the access corresponding to the user; The memory usage allowed for access by the user; No. A hash value of the timestamp of the class data; is the minimum function; For the The number of concurrent storage nodes; For the The average response time of each storage node.

8. The method for efficient data management of encrypted database based on key management system as claimed in claim 7, characterized in that: The verification value is calculated using the following formula to complete data integrity verification and consistency check: ； in, No. The verification value of the encrypted data block corresponding to the class data. When the verification value is within the set threshold range, it means that the encrypted data block corresponding to the class data has passed the verification and is allowed to be accessed. Otherwise, the access is denied. for The hash value of the encrypted data block corresponding to the class data; for The error correction code of the encrypted data block corresponding to the class data; for The message authentication code of the encrypted data block corresponding to the class data; for The cyclic redundancy check code of the encrypted data block corresponding to the class data.

9. The method for efficient data management of encrypted database based on key management system as claimed in claim 8, characterized in that: The following formula is used to guide the average optimal number of shards for all encrypted data blocks in the distributed storage system to evolve toward the optimal state: ; in, For time The load balancing factor is calculated as follows: ； in, For time The total number of concurrent requests at the time; For time Total data access load at time ; For time The total number of concurrent requests at the time.

Images