Distributed data security storage and encryption system based on AI technology

Abstract

The invention relates to a distributed data security storage and encryption system based on an AI technology. The system comprises a data acquisition and preprocessing layer used for acquiring original data and preprocessing the original data to obtain an identifiable data object; the AI identification and strategy decision layer is used for identifying data features of identifiable data objects based on an interpretable AI model to obtain an encrypted instruction packet; the encryption execution and distributed storage layer is used for performing encryption storage processing on the original data content according to an encryption instruction packet to obtain data access interface information; and the dynamic access control layer is used for obtaining user information in response to a data access request instruction of a user, recombining and decrypting the data by using the data distribution mapping index based on the access control strategy table, and returning a plaintext data fragment. By adopting the system, a high-strength, differentiated and multi-level security mechanism can be realized through the AI, intelligent encryption strategy decision is carried out, and the security requirements of multiple scenes and multiple types of data are met.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of data encryption storage, and particularly relates to a distributed data security storage and encryption system based on AI technology. BACKGROUND

[0002] With the development of information technology, distributed data storage and encryption protection technology has emerged. Distributed data storage technology can store data in multiple nodes, thereby improving the reliability, scalability and high availability of storage. Encryption protection technology ensures that data is not accessed by unauthorized access during storage and transmission.

[0003] In traditional data encryption technology, symmetric encryption (such as AES) and asymmetric encryption (such as RSA) are usually used to protect data. These methods encrypt the stored data through encryption algorithms to ensure that only authorized users can decrypt and access the data.

[0004] However, the current encryption method does not have flexible encryption strategy for data type and sensitivity, and cannot dynamically adjust the encryption granularity or select the encryption algorithm according to the specific situation of the data. All data usually use the same encryption strategy, which may cause waste of performance or insufficient encryption, and the protection performance of data that needs higher level of encryption protection is insufficient. SUMMARY

[0005] Therefore, it is necessary to provide a distributed data security storage and encryption system based on AI technology which can adopt different encryption strategies according to different data types.

[0006] In a first aspect, the application provides a distributed data security storage and encryption system based on AI technology, comprising:

[0007] A data acquisition and preprocessing layer is configured to acquire raw data and preprocess the raw data to obtain identifiable data objects. The identifiable data objects include raw data content.

[0008] An AI identification and strategy decision layer is configured to identify data features of the identifiable data objects based on an interpretable AI model to obtain an encryption instruction package. The encryption instruction package includes an encryption strategy, a field level, a segmentation strategy and a target node.

[0009] An encryption execution and distributed storage layer is configured to encrypt and store the raw data content according to the encryption instruction package to obtain data access interface information. The data access interface information includes a data distribution mapping index and an access control strategy table.

[0010] The dynamic access control layer is used to obtain user information in response to the user's data access request instruction, and based on the access control policy table, use the data distribution mapping index to reorganize and decrypt the data and return the plaintext data fragment.

[0011] In one embodiment, the AI ​​identification and policy decision layer includes a data type identification module, a structure extraction module, a sensitivity assessment module, and an encryption policy decision module;

[0012] The data type identification module is used to extract semantic features from the original data content to obtain type labels and sensitive fields;

[0013] The structure extraction module is used to extract the structural boundaries of the original data content according to the type label to obtain the protection granularity; the protection granularity includes field level and segmentation strategy;

[0014] The sensitivity assessment module is used to perform sensitivity scoring based on sensitive fields and obtain the corresponding sensitivity level based on the sensitivity score;

[0015] The encryption policy decision module is used to obtain an encryption instruction package based on the policy rule base according to the type label, protection granularity and sensitivity level.

[0016] In one embodiment, the sensitivity score is obtained by the following formula:

[0017] S=αD s +βA f +γR i

[0018] Where S is the sensitivity score; D s is the sensitivity weight of the sensitive field; A f is the data access frequency within the preset time; R i The number of sensitive fields identified.

[0019] In one embodiment, the encryption execution and distributed storage layer includes an encryption execution module, a data slicing module, and a distributed scheduling module;

[0020] The encryption execution module is used to apply the encryption strategy to encrypt the original data content at the field level to obtain the encrypted data packet;

[0021] The data slicing module is used to slice the encrypted data packet according to the segmentation strategy to obtain a data segment list; the data segment list contains multiple data segments;

[0022] The distributed scheduling module is used to deliver and store the data fragment list according to the target node to obtain the data distribution mapping index;

[0023] Based on the user permission model, each data segment is configured with a policy according to the type label and the sensitivity level, and an access control list is obtained.

[0024] In one of the embodiments, the distributed scheduling module is used to deliver and store the data segment list according to the target node, and a data distribution mapping index is obtained, including:

[0025] The real-time state of the target node is obtained, and a node real-time portrait is obtained; the node real-time portrait includes the node health state and the credibility score;

[0026] According to the node real-time portrait, the node risk is evaluated, and a table of trusted target nodes is obtained;

[0027] According to the sensitivity level of each data field, the table of trusted target nodes is delivered, and a data flow path is obtained;

[0028] According to the data flow path, a data distribution mapping index is generated.

[0029] In one of the embodiments, in response to the user's data access request instruction, the user information is obtained, and based on the access control policy table, the data is reorganized and decrypted using the data distribution mapping index, and the plaintext data segment is returned, including:

[0030] According to the access control policy table, the user information is identified, and an access authorization result is obtained; the access authorization result includes access allowed, access denied, and partial access;

[0031] When the access authorization result is any one of access allowed or partial access, the data segment is extracted from the corresponding target node, and a data segment set is obtained;

[0032] The data segment set is reorganized and decoded, and the plaintext data segment is obtained and returned.

[0033] In one of the embodiments, the system further includes an audit layer and a feedback layer;

[0034] The audit layer is used to obtain an access log according to the user's data access request, and to mark an abnormal behavior according to the access log, and to obtain a behavior evaluation report;

[0035] The feedback layer adjusts the parameters of the AI identification and policy decision layer according to the behavior evaluation report.

[0036] In a second aspect, the application also provides a distributed data security storage and encryption method based on AI technology, including:

[0037] The original data content is obtained, and the original data content is preprocessed to obtain an identifiable data object; the identifiable data object includes the original data content;

[0038] The data features of the identifiable data object are identified based on the interpretable AI model to obtain an encryption instruction package; the encryption instruction package includes an encryption strategy, a field level, a segmentation strategy, and a target node;

[0039] The original data content is stored and processed according to the encryption instruction package to obtain data access interface information; the data access interface information includes a data distribution mapping index and an access control strategy table;

[0040] In response to a data access request instruction of a user, user information is obtained, and the data is reorganized and decrypted based on the access control strategy table and by using the data distribution mapping index, and a plaintext data segment is returned.

[0041] In a third aspect, the present application also provides a computer device, including a memory and a processor, the memory stores a computer program, and the processor implements the steps of any of the above-mentioned AI technology-based distributed data security storage and encryption methods when executing the computer program.

[0042] In a fourth aspect, the present application also provides a computer readable storage medium, which stores a computer program, and the computer program implements the steps of any of the above-mentioned AI technology-based distributed data security storage and encryption methods when executed by a processor.

[0043] The distributed data security storage and encryption system based on the AI technology improves the data quality and structural consistency through the preprocessing operation of the data collection and preprocessing layer, enhances the accuracy of subsequent AI model identification, realizes the format alignment of different source heterogeneous data, lays a unified foundation for cross-source data encryption and slicing, reduces the exception rate and error rate in data analysis and storage, and improves the system stability. The AI identification and strategy decision layer realizes the automatic semantic understanding and security policy matching of the original data without manual intervention, the interpretable AI model makes the encryption policy transparent, improves the controllability and regulatory compliance of the system, supports the automatic adjustment of the protection strength according to the sensitivity, realizes the "differentiated encryption", improves the safety efficiency ratio, accurately locates the data granularity and structure, and effectively supports the delicacy and controllability of the subsequent encryption and slicing process. The encryption execution and distributed storage layer encrypts the original data content at the field level based on the encryption instruction package, and distributes the data segments to multiple target nodes for storage, which effectively prevents centralized leakage; the field-level encryption cooperates with the fine-grained slicing strategy, enhances the attack resistance and confidentiality of the system; the data distribution mapping index and access control policy table serve as auxiliary metadata, support fast searching, permission verification and dynamic decryption operation; the system has flexible scheduling capability, can dynamically adjust the storage structure according to the node health and credibility, and improves the disaster recovery and availability. The dynamic access control layer realizes the fine-grained access control based on user permissions, field sensitivity and data structure, avoids unnecessary data exposure, improves the system compliance, supports the dynamic recombination and decryption mechanism, improves the data access efficiency and experience, and at the same time guarantees the security. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the following will briefly introduce the drawings needed to be used in the embodiment or related art description. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of these drawings.

[0045] Figure 1 The composition structure diagram of the distributed data security storage and encryption system based on the AI technology of the present application;

[0046] Figure 2 The flowchart of the distributed data security storage and encryption method based on the AI technology of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical scheme and advantages of the present application more clear, the following will further describe the present application in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0048] In one embodiment, as shown in Figure 1 An AI technology-based distributed data security storage and encryption system is provided. The system can be applied to a terminal, a server, or a system including a terminal and a server, and can be implemented through interaction between the terminal and the server. The system includes:

[0049] A data acquisition and preprocessing layer is configured to acquire raw data and preprocess the raw data to obtain identifiable data objects. The identifiable data objects include raw data content.

[0050] The raw data can be obtained from various data sources such as sensor data, user input, log files, image data, and documents, according to different data storage requirements. The raw data can be structured data including database records, semi-structured data in the form of XML or JSON files, and unstructured data such as pictures and videos. Specifically, for data generated by a user terminal, the data acquisition and preprocessing layer can interact with the user terminal through an API interface to obtain data in real time. For edge devices such as industrial sensors and smart home devices, the data acquisition and preprocessing layer can use a message queue to ensure stable data transmission. For data in a database, the data acquisition and preprocessing layer can periodically or in real time pull data according to a pre-set time interval or trigger condition.

[0051] The raw data stream can contain a large amount of invalid information such as garbled code and duplicate data. The data acquisition and preprocessing layer can clean, standardize, and normalize the invalid information to ensure the validity of the data and the efficiency of data flow. In this process, the data acquisition and preprocessing layer can perform preliminary structural information processing on each data to form an identifiable data object. The interface data structure of the identifiable data object is {data_id, data_type, raw_content, source_id}, which contains an identification code of each data object to ensure the uniqueness of the data and facilitate system management and query, stores raw data content, and records the source of the data to facilitate data tracing.

[0052] An AI recognition and strategy decision layer is configured to identify data features of the identifiable data objects based on an interpretable AI model to obtain an encryption instruction package. The encryption instruction package includes an encryption strategy, a field level, a segmentation strategy, and a target node.

[0053] The interpretable AI model refers to a model capable of making classification decisions and providing understandable explanations for the decision-making process, including decision trees, linear regression, LIME (Local Interpretable Model-agnostic Explanations), etc. Illustratively, a lightweight AI model based on MobileBERT is used, which has the characteristics of high computational efficiency and low resource occupation, and is suitable for use in large-scale data processing scenarios. By extracting and analyzing the features of the data, the model outputs the data features, which can include data types, field contents, and potential sensitive features of the data, etc. Further, the AI model identifies the content of the data by analyzing the semantic features and contextual information of the data. Illustratively, it determines whether the data is "personal information", "financial data", or "business log", and extracts sensitive fields based on the features, i.e., parts of the data that involve privacy or intellectual property, etc. Specifically, for user personal information data, the system identifies sensitive fields such as names, ID numbers, and mobile phone numbers. It can also evaluate the sensitivity of the data based on the access frequency of the data. If a certain data object is frequently accessed, its sensitivity may be relatively high. By evaluating the sensitivity of the fields and the potential impact on data security, a sensitivity score is obtained, and the sensitivity of the data is divided into three levels: low, medium, and high, to determine the level of encryption protection measures to be used for the data, i.e., to generate specific encryption strategies for each data segment by calling the policy rule library. Encryption strategies include symmetric encryption, asymmetric encryption, and homomorphic encryption for specific data. Encryption strategies can be accurate to the field level of protection. Further, the data is cut into multiple data segments using a segmentation strategy, and each segment is stored and processed separately. Even if a piece of data is leaked, an attacker cannot recover the complete content from a single leaked data.

[0054] The encryption execution and distributed storage layer is used to encrypt and store the original data content according to the encryption instruction package, and obtain data access interface information; the data access interface information includes data distribution mapping index and access control policy table.

[0055] The encryption execution module encrypts the data object according to the requirements in the encryption instruction package, and the encrypted data package is segmented according to the granularity rules in the encryption instruction package. Specifically, the data is divided into multiple data segments, each of which has a certain independence. At the same time, the system associates meta information for each data segment, such as the number of the data segment, the data object to which it belongs, the encryption algorithm, etc., to facilitate subsequent storage and management. The encryption execution module can dispatch the storage engine to deliver the data segments to different storage nodes for storage according to the target node information and the distribution strategy, or deliver the data segments to multiple storage nodes for storage. Even if a storage node fails, it will not affect the integrity of the entire data. During storage, the system generates a data distribution mapping index that records the storage location of each data segment for the dynamic access control layer to call.

[0056] The dynamic access control layer is configured to obtain user information in response to a data access request instruction of a user, and recombine and decrypt data based on an access control policy table and a data distribution mapping index, and return plaintext data segments.

[0057] When the user issues a data access request instruction, the dynamic access control layer obtains the user's information, including the user's role, attributes, location, device security level, etc. The user information is verified through the access control policy to determine whether the user has access rights, wherein the access control policy can be pre-set according to the data type, sensitivity level, and user's permission information, etc. After access authorization, the dynamic access control layer extracts the corresponding data segments from multiple storage nodes according to the data distribution mapping index, recombines and decrypts the data segments using the key, and returns the decrypted plaintext data segments to the user.

[0058] Optionally, the dynamic access control layer can combine an AI behavior model to analyze the user's historical behavior and determine whether the user's request conforms to the normal behavior pattern, and then determine whether the user is a normal access to decide whether to authorize.

[0059] In the above AI technology-based distributed data security storage and encryption system, the AI recognition and policy decision layer uses a lightweight AI model to identify the type of data and assess its sensitivity, and generates an encryption instruction package in combination with a policy rule library, so that the encryption policy is accurately matched with the characteristics of the data. Based on the interpretable AI model, the system can automatically analyze the data characteristics and make decisions, enhancing the intelligence and security of the system. The encryption execution and distributed storage layer encrypts the data according to the encryption instruction package, using multiple encryption algorithms such as AES and RSA, and encrypts the data at the field, paragraph, or file level, effectively preventing data from being stolen and tampered with during storage and transmission, and ensuring the confidentiality of the data. The data slicing and distributed storage technology stores the data in multiple nodes and uses fault-tolerant mechanisms such as redundancy coding to improve the security and reliability of data storage. Even if some nodes fail or are attacked, the data can be recovered through other nodes to avoid data loss. According to the user information and access control policy table, the access request is verified, and the AI behavior model is used to judge the reasonableness of the request to achieve fine-grained access control. Only users who meet the conditions can access the corresponding data, and different levels of access can be provided according to user permissions to effectively prevent data leakage.

[0060] In one embodiment, the AI recognition and policy decision layer includes a data type identification module, a structure extraction module, a sensitivity assessment module, and an encryption policy decision module.

[0061] The data type identification module is used to extract semantic features from the original data content to obtain type labels and sensitive fields.

[0062] The main function of the data type identification module is to identify the type to which the data belongs and extract sensitive fields. An exemplary architecture based on MobileBERT combined with a fine-tuned classification head is used. The context information is extracted through the multi-head attention mechanism, and the results are sent to the multi-label classifier to determine the type of data and obtain the type label. The type label can include JOAN (standard natural language paragraph or dialogue text), Image (fields related to image links, image text paths, or Base64 encoding), Audio (audio files or speech marks), Text (ordinary short text fields), Identity (identity card numbers, identity cards, SSN information), Location (GPS and other geographic location fields), Datatime (time fields), Number (amounts and other numerical fields), and Custom (for custom types). Optionally, a field can have multiple type labels. Further, MobileBERT extracts sensitive fields from the original data content according to the type label. Exemplarily, through the named entity recognition superimposed on MobileBERT, the sensitive entities that may exist in the original data content are located, and they are extracted through deep semantic analysis and context relationship to obtain sensitive fields.

[0063] The structure extraction module is used to extract the structure boundary of the original data content according to the type label to obtain the protection granularity. The protection granularity includes the field level and the segmentation strategy.

[0064] The structure extraction module extracts the structure boundary of the original data content according to the type label output by the data type identification module to determine the protection granularity, which includes the field level and the segmentation strategy. Exemplarily, the protection granularity is the smallest unit of data that can be processed individually during encryption, mainly divided into two dimensions of field level and segmentation strategy. The field level refers to the smallest structural unit that can be independently marked as sensitive in the data object. Exemplarily, the "mobile phone number" field in a certain structured table or the "address.line1" node in a JSON document. The system abstracts the fragments with semantic consistency in the text into uniform fields through syntax analysis and structure mapping, and determines whether to be independently protected as a unit according to the sensitivity prediction model of the field. The segmentation strategy involves further cutting larger fields or objects to adapt to distributed encryption and storage. The segmentation strategy automatically selects the cutting boundary according to factors such as field length, data format, access mode, and distributed node capability. Exemplarily, a medical record text is cut into multiple small segments according to the semantic boundary of the paragraph, or an image is cut at the pixel level according to the block region.

[0065] The sensitivity evaluation module is used to score the sensitivity according to the sensitive field, and to obtain the corresponding sensitivity level according to the sensitivity score.

[0066] The sensitivity evaluation module performs multi-dimensional evaluation on the data according to the sensitive fields identified by the data type identification module, forms a quantitative sensitivity score, and determines the corresponding sensitivity level according to the score result. Specifically, the scoring process comprehensively considers the ontological sensitivity of field content, the relevance of historical risk events, the position weight of the field in the data source, the access frequency, the coupling with external legal identity, and other dimensions. For example, the ontological sensitivity of the name is low, while the ontological sensitivity of the ID card is high. The historical risk event relevance in the history is higher, and the primary key field weight is higher. The data that is frequently accessed also needs more protection. If the data can point to an individual, more protection should be provided. The sensitivity evaluation module can assign weights to each dimension based on fuzzy reasoning or a scoring function and output a sensitivity score. The sensitivity score is discretized and mapped to a sensitivity level, which is usually divided into low, medium, and high levels. The level determination will significantly affect the encryption strength and resource allocation priority. For example, assume that "user_id" and "email" are sensitive fields, and "username" is a relatively insensitive field. The evaluation steps of the sensitivity evaluation module are as follows: set the weights of different fields, "user_id" weight is 0.4, "email" weight is 0.4, and "username" weight is 0.2; score each field, "user_id" score is 8 points, "email" score is 8 points, and "username" score is 3 points; the total score is 0.4 x 8 + 0.4 x 8 + 0.2 x 3 = 6.6 points. Further, according to the preset threshold, i.e., the total score is below 5 points for low sensitivity, 5-10 points for medium sensitivity, and above 10 points for high sensitivity, the sensitivity level of the data is determined to be medium.

[0067] The encryption policy decision module is used to obtain an encryption instruction package based on the policy rule library according to the type tag, protection granularity, and sensitivity level.

[0068] The encryption policy decision module is supported by a policy rule base, determines the encryption policy to be adopted by each data segment according to the type label identified above, the protection granularity extracted from the structure, and the sensitivity level, and generates a complete encryption instruction package. The policy rule base can preset multiple encryption schemes, including but not limited to symmetric encryption (such as AES-128 / 256), asymmetric encryption (such as RSA-2048), homomorphic encryption (such as Paillier, CKKS for cross-node joint calculation), searchable encryption, etc. The system recommends the policy according to the data type mapping priority, and determines the encryption strength according to the sensitivity level. For example, the priority policy according to the data type mapping is to preferentially use block symmetric encryption for image data, and the encryption strength is determined according to the sensitivity level, that is, high-sensitivity data needs to use asymmetric encryption or homomorphic encryption. The encryption policy decision module also determines the encryption granularity according to the field level, and determines whether to slice first and then encrypt or encrypt first and then distribute according to the segmentation strategy. The encryption policy decision module also needs to confirm the target node of each encrypted data, that is, the physical / logical node where the data will be stored or processed. The target node is scheduled by the system according to the node trust level, historical security record, resource occupancy rate, compliance area limit and other parameters, to ensure that sensitive data does not fall into a low-trust area or an unauthorized geographic location. The encryption instruction package will contain the correspondence between the field and the policy, the encryption algorithm identifier, the required key type, the segmentation and scheduling path, and all the control information required for encryption, and will be passed to the encryption execution and distributed storage layer as a structured instruction stream.

[0069] The above system, through the cooperative operation of the above modules, the AI recognition and policy decision layer can realize a complete closed loop from raw data perception to policy generation, support fine-grained, high-dynamic, security-aware data protection processes, ensure that the system has flexible adaptability and highly secure configurable capabilities, and provide a solid intelligent central support for distributed encryption storage and intelligent decryption.

[0070] In one embodiment, the sensitivity score S is obtained by the following formula:

[0071] S = aD + bA + gR s f i

[0072] where S is the sensitivity score; D s is the sensitivity weight of the sensitive field; A f is the data access frequency within a preset time; and R i is the number of identified sensitive fields.

[0073] In one embodiment, the encryption execution and distributed storage layer includes an encryption execution module, a data slicing module, and a distributed scheduling module. ​​

[0074] The encryption execution module is used to apply an encryption policy to encrypt the original data content at the field level to obtain an encrypted data packet.

[0075] The working principle of the encryption execution module is to perform field-level encryption processing on the original data content according to the encryption instruction packet generated by the AI recognition and policy decision layer. The encryption policy can include symmetric encryption (such as AES), asymmetric encryption (such as RSA), format-preserving encryption (FPE), hash encryption (such as SHA-3), and homomorphic encryption (such as BFV, CKKS, etc.) in some scenarios. The system first performs field-by-field recognition on the original data in combination with the field level marked in the protection granularity information, matches the sensitivity level and data type label of each field, and then matches the encryption algorithm. Illustratively, for structured data, each field can be encrypted at the field level; for semi-structured and unstructured data, the entire or partial data can be encrypted. Through the encryption operation, the original data is converted into ciphertext form, thereby protecting the confidentiality of the data.

[0076] The data slicing module is used to slice the encrypted data packet according to a splitting policy to obtain a data segment list; the data segment list includes a plurality of data segments.

[0077] After receiving the encrypted data packet, the data slicing module performs data slicing on it according to the splitting policy. The splitting policy is usually generated by an AI model based on factors such as data type, degree of coupling between fields, access frequency prediction, etc., and may adopt equal-length slicing, semantic slicing that maintains semantic consistency, sensitivity clustering slicing that aggregates data of the same sensitivity level, etc. The core purpose of slicing is to balance between data security and access efficiency. The output data segment list is a multi-element set, and each data segment can be independently decrypted and reassembled into a part of the original data packet.

[0078] The distributed scheduling module is used to deliver and store the data segment list according to the target node to obtain a data distribution mapping index.

[0079] The distributed scheduling module is responsible for securely storing data fragments into different physical or logical nodes, while generating a data distribution mapping index. Specifically, the distributed scheduling module constructs a node portrait based on the "target node" label and real-time node resource status, including the node's storage health, historical error rate, physical isolation, trust score, etc. The system calculates the node trust level with the help of a trusted computing mechanism such as TPM (Trusted Platform Module). Subsequently, the system matches and delivers data fragments of different sensitivity levels to target nodes with matching trust levels to ensure that sensitive data avoids the risk of single-point leakage caused by centralized storage. After data distribution is complete, the system generates a data distribution mapping index table, recording the physical location, access path, encryption type, etc. of each data fragment. This index will serve as the key credential for the dynamic access control layer to reconstruct plaintext data.

[0080] Based on the user permission model, the type label and the sensitivity level are combined to configure the policy for each data fragment, and an access control list is obtained.

[0081] The module also configures the policy for each data fragment based on the user permission model, combines the type label output by the data type identification module and the sensitivity level output by the sensitivity evaluation module, and generates an access control list (ACL) to ensure that only authorized users can access the corresponding data fragments. Illustratively, the ACL covers access levels such as read, write, and only metadata viewing, as well as multi-dimensional policies such as time limit and upper limit of call frequency, for real-time access authorization judgment by the dynamic access control layer.

[0082] In one embodiment, the distributed scheduling module is used to deliver and store data fragment lists by target nodes to obtain a data distribution mapping index, including:

[0083] S11, obtain the real-time state of the target node to obtain the node real-time portrait; the node real-time portrait includes the node health status and the trust score.

[0084] A distributed system may contain multiple physical or virtual storage nodes, and the running state and security level of the nodes may change at any time. In order to improve the dynamic adaptability of the system in the data scheduling process, the real-time state information of each node is obtained through the scheduling controller or edge node management agent to generate a node real-time portrait, including the CPU usage, memory occupation, disk IO condition, average response delay, online / offline state, etc. Node health status, and the node trust score obtained through the scoring mechanism by integrating historical operation behavior (such as whether abnormal data request occurs), security policy compliance degree, device authentication information (such as TPM binding information), etc. Optionally, the node real-time portrait can be obtained through periodic reporting by the node or heart-pumping pulling by the scheduling center, and synchronized to the local cache or distributed state table.

[0085] S12, evaluate node risk according to node real-time portrait, and obtain a trusted target node table.

[0086] Illustratively, after obtaining the node real-time portrait, the system uses a preset risk evaluation model to quantitatively evaluate the node state, identifies high-risk nodes and excludes them, thereby screening a group of trusted target nodes (Trusted Target Nodes). Illustratively, by setting threshold rules, nodes with a health degree < 60 or a trust degree score < 70 are directly excluded; the output trusted target node table records the list of trusted nodes available for data delivery in the current system in the form of a data structure.

[0087] S13, deliver to the trusted target node table according to the sensitivity level of each data field, and obtain a data flow path.

[0088] Illustratively, according to the sensitivity level of each data field identified by the AI recognition and policy decision layer, combined with the security capabilities, isolation level, load state and other characteristics of each node in the trusted target node table, an optimal data delivery path, referred to as a data flow path (Data Flow Path), is developed. Specific delivery strategies include but are not limited to: high-sensitivity fields are preferentially distributed to nodes with the highest trust degree and high physical isolation level; low-sensitivity data can be scheduled to nodes with lighter load or stronger computing power; the same user data is logically isolated to avoid the risk of information aggregation attacks caused by centralized storage.

[0089] S14, generate a data distribution mapping index according to the data flow path.

[0090] Illustratively, the system generates a data distribution mapping index (Data Distribution Mapping Index) according to the data flow path to record the physical location of all data segments uniformly. The form can be a key-value pair structure, a tuple list, or an object-oriented data description format. The mapping index includes data segment ID, corresponding original field information, delivery target node identification (Node ID or physical address), delivery timestamp and version number, encryption method identification (for subsequent decryption), and access control constraint information (binding access control list ACL-ID). The data distribution mapping index is the only data source for the subsequent "dynamic access control layer" when performing reorganization, decryption and authorization judgment, ensuring the integrity, consistency and security of system data access.

[0091] In one embodiment, in response to a user's data access request instruction, user information is obtained, and based on the access control policy table, the data is reorganized and decrypted using the data distribution mapping index, and the plaintext data segments are returned, including:

[0092] S21, identify the user information according to the access control policy table, and obtain an access authorization result; the access authorization result includes allowed access, denied access, and partial access.

[0093] Illustratively, when the user issues an access request instruction, the system synchronously acquires identity authentication information such as digital certificates, public keys, access tokens, IP addresses, and login terminal device IDs, and forms a complete user identity portrait. Analyzing the access control policy table (ACL table) obtains user identity and role binding information (such as roles: researcher, analyst, and auditor), a data field and user permission mapping table, access rules of type labels and sensitivity levels, restrictive policies (such as time windows, access frequencies, and source IP ranges), and auditable access behavior record policies (such as whether to leave traces). Further, the user identity portrait is matched with the ACL table, and the authorization result is output according to the rules: among them, full access (Full Access) means that the user has complete access rights to the requested field; partial access (Partial Access) means that the user can only access part of the field or part of the fragment; denied access (Denied) means that the request is not authorized, and the system returns an access denial prompt or silent processing.

[0094] S22, when the access authorization result is any one of allowed access or partial access, extract data fragments from the corresponding target node to obtain a data fragment set.

[0095] Once the user passes the permission verification, the system will extract the data fragments allowed to be accessed by the user from each target node according to the data distribution mapping index, and determine which fields or fragments are "allowed to access" according to the access authorization result, and only extract the corresponding index path in the data distribution mapping index. The system accesses the corresponding storage node through a distributed fragment access protocol (such as a distributed KV interface, a private API, or a secure channel), extracts the required encrypted data fragments, and constructs a data fragment set (Encrypted Fragment Set).

[0096] Optionally, if the fragments are end-to-end encrypted, the system needs to record and match information such as encryption methods and key types to ensure the correctness of subsequent decryption operations.

[0097] S23, recombine and decode the data fragment set to obtain and return plaintext data fragments.

[0098] Illustratively, according to the field order recorded by the distribution mapping index, the structural boundary identifier, the system sequentially splices the fragments; illustratively, if field-level encryption is adopted, the system also needs to perform field identifier mapping alignment to ensure the correctness of the structure. Further, the corresponding decryption mode is selected for decoding, specifically, the fields are decrypted according to the encryption strategy (such as AES, RSA, SM4, homomorphic encryption) and the decryption key strategy (such as symmetric / asymmetric, session key, key distribution strategy); the hierarchical decryption is adopted for the field-level sensitive fragments, and the system can realize on-demand partial decryption and return only the authorized field content.

[0099] After decryption is completed, the system recovers the original appearance of the data according to the structural boundary information generated during extraction of the original structure, and encapsulates the corresponding content as a response message to return to the user.

[0100] Optionally, if the access result is "partial access", the system will retain the placeholder information of the unauthorized field on the structure, or directly remove the unauthorized field, to ensure that sensitive data is not speculated or reconstructed.

[0101] Optionally, all access behaviors can be traced by the audit module, recording user ID, access time, access field, authorization result, etc., to meet the security compliance and tracking requirements.

[0102] In one of the embodiments, the system further includes an audit layer and a feedback layer;

[0103] The audit layer is configured to obtain an access log according to a data access request of a user, and to mark abnormal behaviors according to the access log, to obtain a behavior evaluation report.

[0104] The core responsibility of the audit layer is to comprehensively review and supervise the data access behaviors of the user, and to identify potential abnormal behaviors by collecting and analyzing the access log. When the user initiates a data access request, the system will record all information related to the request to form an access log, including the identity of the user, the access time, the accessed data content, the access method, the access behavior result, the called interface, the node path, the encryption method, and the abnormal code related to data access, etc.

[0105] The audit layer will deeply mine and analyze these access logs, and judge whether there is an abnormal behavior according to the preset rules and patterns. Illustratively, the frequency of a certain user accessing high-sensitive fields in a short period of time is abnormal, etc. frequency abnormal behavior; a role user suddenly changes the access mode or the request structure, etc. behavior switching abnormal behavior; the access path combination behavior implies the intention of bypassing the field restriction, etc. permission evading abnormal behavior; the access comes from an abnormal geographic location or a non-working time period, etc. time-space deviation abnormal behavior; repeated trial access to a specific high-value data node, etc. node focusing abnormal behavior.

[0106] Through the marking and analysis of abnormal behaviors, the audit layer finally generates a behavior evaluation report, including a user behavior summary, an abnormal score, specific abnormal cases, and a recommended handling strategy.

[0107] The feedback layer adjusts the parameters of the AI recognition and strategy decision layer according to the behavior evaluation report. Illustratively, the feedback layer analyzes the behavior evaluation report, extracts strategy adjustment suggestions, and further updates the parameters of each sub-module in the AI recognition and strategy decision layer. Specifically, the data type recognition module is updated to make some type labels more likely to trigger "sensitive" marking and increase the type recognition threshold under specific abnormal patterns (such as multiple rounds of verification). The sensitivity evaluation module dynamically increases the upper limit of the sensitivity score of certain fields and dynamically adjusts the scoring curve according to the degree of access behavior abnormality to tighten the score under risky behavior. The encryption strategy decision module adjusts the encryption strategy selection priority and enhances the field segmentation granularity to increase the access resistance. The strategy rule base adjusts the risk rules extracted from the audit behavior model to dynamically convert them into new rules in the strategy base.

[0108] It should be understood that, although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the direction of the arrow, these steps are not necessarily executed in sequence according to the direction of the arrow. Unless otherwise explicitly stated herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or stages in other steps.

[0109] Based on the same inventive concept, the embodiments of the present application also provide an AI technology-based distributed data security storage and encryption method for implementing the above-described AI technology-based distributed data security storage and encryption system. The problem-solving implementation scheme provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more AI technology-based distributed data security storage and encryption method embodiments provided below can refer to the limitations of the AI technology-based distributed data security storage and encryption system described above, which will not be repeated here.

[0110] In one exemplary embodiment, as shown in Figure 2 An AI technology-based distributed data security storage and encryption method is provided, comprising:

[0111] S201, obtain original data content, and pre-process the original data content to obtain identifiable data objects; the identifiable data objects include the original data content.

[0112] S202, identify data features of the identifiable data objects based on an interpretable AI model to obtain an encryption instruction package; the encryption instruction package includes an encryption strategy, a field level, a segmentation strategy, and a target node.

[0113] S203, perform encryption storage processing on the original data content according to the encryption instruction package to obtain data access interface information; the data access interface information includes a data distribution mapping index and an access control strategy table.

[0114] S204, obtain user information in response to a data access request instruction of a user, and recombine and decrypt data based on the access control strategy table and the data distribution mapping index to return a plaintext data segment.

[0115] In an embodiment, a computer device is provided, including a memory and a processor, the memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0116] In an embodiment, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the steps in the above method embodiments.

[0117] For the device embodiments, since they basically correspond to the method embodiments, the related parts can be referred to the part of the method embodiments. The device embodiments described above are only schematic and the components shown as separate components can or can not be physically separate and the components shown as separate components can or can not be physical components, i.e., can be located in one place or distributed on multiple network components. Some or all of the modules can be selected according to actual needs to achieve the purposes of the present disclosure. Those skilled in the art can understand and implement without creative labor.

[0118] The above embodiments only express several implementation manners of the present application, the description is more specific and detailed, but it should not be understood as a limitation to the patent scope of the application. It should be noted that, for those skilled in the art, without departing from the concept of the present application, some modifications and improvements can be made, which are all within the protection scope of the present application.

Claims

1. A distributed data security storage and encryption system based on AI technology, characterized by: The system comprises: The data acquisition and preprocessing layer is used to obtain raw data and preprocess the raw data to obtain identifiable data objects; the identifiable data objects include the raw data content; An AI recognition and policy decision layer, configured to identify data features of the identifiable data objects based on an interpretable AI model and obtain an encryption instruction packet; the encryption instruction packet includes an encryption strategy, field level, segmentation strategy, and target node; The encryption execution and distributed storage layer is used to perform encryption storage processing on the original data content according to the encryption instruction packet to obtain data access interface information; the data access interface information includes a data distribution mapping index and an access control policy table; The dynamic access control layer is used to obtain user information in response to the user's data access request instruction, and based on the access control policy table, use the data distribution mapping index to reorganize and decrypt the data and return the plaintext data fragment.

2. The system according to claim 1, wherein: The AI ​​recognition and policy decision layer includes a data type recognition module, a structure extraction module, a sensitivity assessment module, and an encryption policy decision module; The data type identification module is used to extract semantic features from the original data content to obtain type labels and sensitive fields; The structure extraction module is used to extract the structure boundary of the original data content according to the type label to obtain the protection granularity; the protection granularity includes field level and segmentation strategy; The sensitivity assessment module is used to perform sensitivity scoring according to the sensitive field and obtain a corresponding sensitivity level according to the sensitivity score; The encryption policy decision module is used to obtain an encryption instruction packet based on the policy rule library according to the type label, the protection granularity and the sensitivity level.

3. The system according to claim 2, characterized in that: The sensitivity score is obtained by the following formula: S=αD s +βA f +γR i Where S is the sensitivity score; D s is the sensitivity weight of the sensitive field; A f is the data access frequency within the preset time; R i The number of sensitive fields to be identified.

4. The system according to claim 2, wherein: The encryption execution and distributed storage layer includes an encryption execution module, a data slicing module, and a distributed scheduling module; The encryption execution module is used to apply the encryption strategy to encrypt the original data content at the field level to obtain an encrypted data packet; The data slicing module is used to slice the encrypted data packet according to the segmentation strategy to obtain a data segment list; the data segment list includes multiple data segments; The distributed scheduling module is used to deliver and store the data segment list according to the target node to obtain a data distribution mapping index; Based on the user authority model, the type tag and the sensitivity level are combined to configure a policy for each data segment to obtain an access control list.

5. The system according to claim 4, characterized in that The distributed scheduling module is used to deliver and store the data segment list according to the target node to obtain a data distribution mapping index, including: Obtain the real-time status of the target node and obtain a real-time portrait of the node; the real-time portrait of the node includes the node health status and credibility score; Assess node risks based on the real-time node portraits to obtain a trusted target node table; Delivering data to the trusted target node table according to the sensitivity level corresponding to each data field to obtain a data flow path; A data distribution mapping index is generated according to the data flow path.

6. The system according to claim 1, wherein: The step of obtaining user information in response to a user's data access request instruction, and reorganizing and decrypting the data using the data distribution mapping index based on the access control policy table to return a plaintext data fragment includes: Identify the user information according to the access control policy table to obtain an access authorization result; the access authorization result includes allowing access, denying access, and partial access; When the access authorization result is any one of the access allowed or partial access, extracting data fragments from the corresponding target node to obtain a data fragment set; The data fragment set is reassembled and decoded to obtain and return the plaintext data fragment.

7. The system according to any one of claims 1 to 5, characterized in that: The system also includes an audit layer and a feedback layer; The audit layer is used to obtain access logs according to the user's data access request, and mark abnormal behavior according to the access logs to obtain a behavior evaluation report; The feedback layer adjusts the parameters of the AI ​​recognition and strategy decision layer according to the behavior evaluation report.

8. A distributed data security storage and encryption method based on AI technology, characterized in that: The method comprises: Obtaining original data content and preprocessing the original data content to obtain an identifiable data object; the identifiable data object includes the original data content; Identify data features of the identifiable data object based on an explainable AI model, and obtain an encryption instruction package; the encryption instruction package includes an encryption strategy, a field level, a segmentation strategy, and a target node; Performing encryption storage processing on the original data content according to the encryption instruction packet to obtain data access interface information; the data access interface information includes a data distribution mapping index and an access control policy table; In response to the user's data access request instruction, the user information is obtained, and based on the access control policy table, the data distribution mapping index is used to reorganize and decrypt the data, and the plaintext data fragment is returned.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to claim 8 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to claim 8 are implemented.

Images