A ransom virus prevention data backup method and system based on isolated storage

Abstract

The application provides a ransom virus data backup method and system based on isolated storage, and relates to the technical field of data processing.The method comprises the following steps: step 1, a storage area physically isolated from a business platform is deployed in a data center, and the storage area is not physically connected with an internal office network and an external service network; step 2, by means of an encrypted transmission channel, incremental data of the business platform is batch-transmitted to the storage area for backup in a daily preset low-traffic time window, and three characteristic anchor points, including a head anchor point, a middle anchor point and a tail anchor point, are extracted in chronological order.The application realizes data transmission storage security protection, efficient backup and accurate verification by deploying a physically isolated storage area, encrypting incremental data, constructing a dynamic chain structure to generate characteristic value fingerprints and verification, and finally cutting off an attack path by physical isolation to protect data from ransom virus threats.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to a ransomware prevention data backup method and system based on isolated storage. BACKGROUND

[0002] Although the traditional data backup method can restore data to a certain extent, it faces many challenges when facing advanced ransomware attacks:

[0003] In most cases, if the isolation measures of the backup system and the production network are not perfect, the ransomware may invade the backup data through the network transmission path, and then cause the data recovery to fail. In terms of data verification, the existing backup system mostly uses file integrity checking means such as MD5, SHA-1, etc., but such checking methods have certain limitations in detecting data logical abnormalities, and attackers have the opportunity to achieve data tampering through fake check values. In addition, the traditional physical isolated storage represented by tape library has a relatively complex recovery process, often requiring manual intervention, and it is difficult to fully meet the needs of enterprises to quickly restore business in terms of recovery efficiency.

[0004] Some enterprises use air isolation storage technology to protect backup data through physical disconnection, but this technology has difficulties in implementing automatic incremental backup functions, and the operation and maintenance cost is relatively high. Some solutions also try to introduce blockchain technology to verify data integrity, but in actual application, performance bottlenecks and excessive storage resource occupation have been exposed. SUMMARY

[0005] The technical problem to be solved by the present application is to provide a ransomware prevention data backup method and system based on isolated storage, which can effectively protect critical business data from ransomware attacks.

[0006] To solve the above technical problems, the technical scheme of the present application is as follows:

[0007] In a first aspect, a ransomware prevention data backup method based on isolated storage, the method comprising:

[0008] Step 1: deploying a storage area physically isolated from the business platform in the data center, the storage area has no physical connection with the internal office network and the external service network;

[0009] Step 2: transmitting the incremental data of the business platform to the storage area for backup in batches through an encrypted transmission channel during the daily preset low-traffic time window, and extracting three feature anchors in chronological order, including the head anchor, the middle anchor and the tail anchor;

[0010] Step 3, connect the three feature anchors in transmission time sequence into an initial three-point chain structure, and adjust the edge length according to the daily incremental data amount to generate the distance values of each segment of the deformed chain structure;

[0011] Step 4, convert the distance values of each segment of the deformed chain structure into binary data segments, splice and insert a separator identifier in the order of head-middle-tail, and perform bit operation on the spliced result to synthesize a unique feature value fingerprint;

[0012] Step 5, use the feature value fingerprint to perform verification operation, and cut off the physical connection of the storage area after the operation is completed.

[0013] Further, three feature anchors are extracted, including a head anchor, a middle anchor and a tail anchor, including:

[0014] Head anchor: data block at a fixed offset position after the start position of the backup data;

[0015] Middle anchor: data block at a position 50% of the total length of the backup data;

[0016] Tail anchor: data block at a fixed offset position before the end position of the backup data.

[0017] Further, the three feature anchors are connected in transmission time sequence into an initial three-point chain structure, and the edge length is adjusted according to the daily incremental data amount to generate the distance values of each segment of the deformed chain structure, including:

[0018] Calculate the first distance value between the head anchor and the middle anchor; calculate the second distance value between the head anchor and the tail anchor; and calculate the third distance value between the middle anchor and the tail anchor;

[0019] According to the daily incremental data amount, the first distance value, the second distance value and the third distance value are proportionally scaled to generate the distance values of each segment of the deformed chain structure.

[0020] Further, according to the daily incremental data amount, the first distance value, the second distance value and the third distance value are proportionally scaled to generate the distance values of each segment of the deformed chain structure, including:

[0021] Obtain the total amount of daily incremental data as a reference parameter;

[0022] Take the reference parameter as the scaling factor to perform synchronous linear proportional scaling operation on the first distance value, the second distance value and the third distance value to obtain the scaled head-middle distance value, head-tail distance value and middle-tail distance value;

[0023] Take the scaled head-middle distance value, head-tail distance value and middle-tail distance value as the distance values of each segment of the deformed chain structure.

[0024] Further, the distance values of each segment of the transformed chain structure are converted into binary data segments, which are spliced in the order of head-middle-tail and inserted with a separator identifier, and a bit operation is performed on the spliced result to synthesize a unique characteristic value fingerprint, including:

[0025] The scaled head-middle distance value is converted into a first binary data segment; the scaled head-tail distance value is converted into a second binary data segment; and the scaled middle-tail distance value is converted into a third binary data segment;

[0026] The first, second, and third binary data segments are spliced head-to-tail in the order of head-middle distance value, head-tail distance value, and middle-tail distance value to form a primary data chain;

[0027] A separator identifier of a preset fixed length is inserted at the end position of the primary data chain to form an intermediate data chain with identifier;

[0028] The intermediate data chain with identifier is spliced head-to-tail with the third binary data segment to output a continuous data stream containing identifier;

[0029] After performing a cyclic bit shift operation on the continuous data stream, a fixed-length unique characteristic value fingerprint is compressed and generated through a bitwise XOR operation.

[0030] Further, after performing a cyclic bit shift operation on the continuous data stream, a fixed-length unique characteristic value fingerprint is compressed and generated through a bitwise XOR operation, including:

[0031] A cyclic left shift operation is performed on the continuous data stream containing identifier to generate a shifted data stream;

[0032] The shifted data stream is divided into a front data block and a rear data block, and a bitwise XOR operation is performed on the front data block and the rear data block to generate a primary compression block;

[0033] If the length of the primary compression block does not meet the fixed length requirement, the primary compression block is taken as a new input data stream, and the cyclic left shift operation, data block division, and bitwise XOR operation are repeatedly performed until a fixed-length binary data is output;

[0034] The finally output fixed-length binary data is taken as a unique characteristic value fingerprint.

[0035] Further, the characteristic value fingerprint is used to perform a verification operation, and after the operation is completed, the physical connection of the storage area is cut off, including:

[0036] Based on the current backup data, the head anchor, the middle anchor, and the tail anchor are re-extracted from the fixed offset position after the starting position, the total length 50% position, and the fixed offset position before the end position, and a verification characteristic value fingerprint is generated;

[0037] The verification feature value fingerprint is compared with the fixed-length unique feature value fingerprint bit by bit, and when the number of inconsistent bits is less than a preset fault tolerance threshold, a physical isolation control signal is generated.

[0038] According to the physical isolation control signal, a physical switch device is driven to cut off all physical connection cables between the storage area and the external network.

[0039] In a second aspect, a ransomware data backup system based on isolated storage includes:

[0040] A storage module is configured to deploy a storage area physically isolated from a business platform in a data center, and the storage area is not physically connected to an internal office network and an external service network.

[0041] A backup module is configured to transmit incremental data of the business platform to the storage area in batches through an encrypted transmission channel during a preset low-traffic time window every day, and extract three feature anchors including a header anchor, a middle anchor and a tail anchor in chronological order.

[0042] A modeling module is configured to connect the three feature anchors into an initial three-point chain structure according to the transmission time sequence, and adjust the edge length according to the amount of incremental data on the day to generate distance values of each segment of the deformed chain structure.

[0043] A fingerprint module is configured to convert the distance values of each segment of the deformed chain structure into binary data segments, splice and insert a separator identifier in the order of header-middle-tail, and perform bit operation on the spliced result to synthesize a unique feature value fingerprint.

[0044] An isolation module is configured to perform a verification operation using the feature value fingerprint, and cut off the physical connection of the storage area after the operation is completed.

[0045] In a third aspect, a computing device includes:

[0046] One or more processors;

[0047] A storage device is configured to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method.

[0048] In a fourth aspect, a computer-readable storage medium stores a program, and the program is executed by a processor to implement the method.

[0049] The above-mentioned scheme of the present application at least has the following beneficial effects:

[0050] By deploying a storage area physically isolated from the business platform, the way that ransomware spreads through the network to infect backup data is completely cut off, and even if the business platform is attacked, the isolated backup data can remain safe, ensuring the effectiveness of data recovery. By using the daily low-traffic time window to batch transfer incremental data, the impact on normal business is reduced, and efficient data backup is achieved; at the same time, the encrypted transmission channel ensures the security of the data during transmission, preventing data leakage. Three feature anchors are constructed into a three-point chain structure, and the distance value is adjusted based on the amount of incremental data to generate a unique feature value fingerprint for verification. Compared with traditional verification methods, this method not only detects data integrity, but also effectively identifies data logic anomalies, improves data verification accuracy, and prevents attackers from bypassing detection by forging data. The automated backup process and efficient verification mechanism, combined with the operation of cutting off the physical connection after verification, simplify the data recovery process and improve the timeliness of data recovery under the premise of ensuring data security. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 is a flowchart of a ransomware prevention data backup method based on isolated storage provided by an embodiment of the present application.

[0052] Figure 2 is a schematic diagram of a ransomware prevention data backup system based on isolated storage provided by an embodiment of the present application. DETAILED DESCRIPTION

[0053] Exemplary embodiments of the present disclosure will be described in greater detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. Rather, these embodiments are provided so that the present disclosure can be more thoroughly understood and the scope of the present disclosure can be accurately conveyed to those skilled in the art.

[0054] As Figure 1 shown, an embodiment of the present application proposes a ransomware prevention data backup method based on isolated storage, which includes the following steps:

[0055] Step 1, deploy a storage area physically isolated from the business platform in the data center, the storage area has no physical connection with the internal office network and the external service network;

[0056] Step 2, through an encrypted transmission channel, batch transfer incremental data of the business platform to the storage area for backup in a daily preset low-traffic time window, and extract three feature anchors in chronological order, including a head anchor, a middle anchor and a tail anchor;

[0057] Step 3, connect the three characteristic anchor points in the transmission time sequence into an initial three-point chain structure, and adjust the edge length according to the daily incremental data amount, to generate the distance values of each segment of the deformed chain structure;

[0058] Step 4, convert the distance values of each segment of the deformed chain structure into binary data segments, splice and insert a separator identifier in the order of head-middle-tail, and perform a bit operation on the spliced result to synthesize a unique characteristic value fingerprint;

[0059] Step 5, use the characteristic value fingerprint to perform a verification operation, and cut off the physical connection of the storage area after the operation is completed.

[0060] In the embodiment of the present application, by deploying a storage area completely physically isolated from the business platform, office network and external service network, the way for ransomware to penetrate into the backup data through the network is blocked from the source, providing an "immune zone" for data recovery, and avoiding the failure of backup data due to attacks. By using an encrypted transmission channel and a low-traffic time window to transmit incremental data, both data theft or tampering during transmission and the performance impact of normal business by backup operations are prevented, achieving a balance between data security transmission and stable business operation. Based on three characteristic anchor points, a dynamic three-point chain structure is constructed, and the distance values are adjusted to generate a characteristic value fingerprint. Compared with the traditional verification method, this method can more accurately identify subtle changes and logical abnormalities of data, improve the accuracy and reliability of data integrity verification, and effectively resist counterfeit attacks. After completing the verification, the physical connection is automatically cut off, further enhancing the security of the storage area, while the automated operation process reduces manual intervention, shortens the time consumption of data verification and isolation, and meets the dual needs of enterprises for fast data recovery and safe control.

[0061] In a preferred embodiment of the present application, the above-mentioned step 1, deploying a storage area physically isolated from the business platform in the data center, the storage area has no physical connection with the internal office network and the external service network, can include:

[0062] In the embodiment of the present application, a dedicated area (such as an independent cabinet, a computer room module) is divided in the data center as an isolated storage area, which maintains a spatial distance of at least 5 meters from the physical devices of the business platform, office network and external service network, avoiding sharing of infrastructure such as power lines and network cables. A dedicated switch and router are configured for the storage area, and network devices are prohibited from being shared with other networks. The switch port is only connected to the storage device, and all unnecessary physical interfaces (such as USB and serial port) are disabled. Independent UPS power supply and cooling system are used to ensure that the power supply and heat dissipation of the storage area are independent of other network areas, preventing the spread of attacks through power lines.

[0063] Three-layer network isolation design:

[0064] Core layer: Deploy dedicated core switches, only connect to the aggregation layer devices of the storage area;

[0065] Aggregation layer: Connect storage devices and backup servers, configure ACL (Access Control List) to prohibit cross-area traffic;

[0066] Access layer: Allow only authorized devices to access through physical port binding.

[0067] Allocate a separate VLAN (such as VLAN 100) for the storage area, logically isolate it from the business network (VLAN 200) and office network (VLAN 300), and block cross-VLAN communication through the firewall. The network cable of the storage area is not connected to the enterprise core switch, but to the dedicated storage gateway through independent optical fiber or network cable. The gateway device is in the default off state, and the connection is activated only during the backup window period through a physical switch (such as an intelligent PDU). The storage area management interface requires three-factor authentication (username + password + dynamic token), and administrator permissions are strictly separated (such as network administrator, storage administrator). Only allow backup servers to access the storage area through a pre-set IP address (such as 192.168.100.0 / 24), and all other IP segment requests are rejected. Deploy a separate log server to record access behavior in real time, including connection time, operation content, data transfer volume, etc., and automatically trigger an alarm for abnormal access.

[0068] During the backup window period, establish an encrypted tunnel from the business platform to the storage area through a hardware encryption device (such as an IPsec VPN gateway), and update the key automatically every day. Use optical one-way transmission equipment (such as a network lock) to achieve "read-only" data transmission, block the reverse attack path at the physical layer, and ensure that the storage area does not send any data to the external network. Use double hash verification (such as SHA-256) during transmission to ensure data consistency before and after transmission, and any tampering will cause the backup task to be interrupted. The storage area machine room is equipped with a fingerprint / human face recognition access control system, only authorized personnel can enter within the specified time. Deploy temperature and humidity sensors, smoke alarms, cameras, and other devices to monitor the physical environment of the storage area in real time, and automatically trigger power protection in case of abnormal conditions. When using removable media for storage devices (such as tape libraries, disk arrays), physical numbering and registration are required, and virus scanning and data verification are performed before and after each use.

[0069] In a preferred embodiment of the present application, step 2 above, through an encrypted transmission channel, batch-transmits the incremental data of the business platform to the storage area backup during the pre-set low-traffic time window every day, and extracts three feature anchors in chronological order, including the head anchor, the middle anchor, and the tail anchor, which can include:

[0070] Head anchor: Data block at a fixed offset from the start of the backup data;

[0071] Mid-Anchor: Data block at 50% of total backup data length;

[0072] Tail-Anchor: Data block at a fixed offset before the end of the backup data.

[0073] In the embodiments of the present application, hardware devices and software components required for encrypted transmission are deployed at both the service platform and the storage area. At the hardware level, a special encryption network card supporting the Advanced Encryption Standard (AES) is installed at both ends, which has a built-in encryption chip to quickly process encryption operations. At the software level, the mature SSL / TLS protocol is selected as the encryption transmission protocol and is configured in detail.

[0074] At the server end (storage area), the administrator logs in to the server management interface and imports the digital certificate issued by the authoritative certificate authority (CA). The digital certificate contains the server's public key, server domain name, certificate validity period, and other key information. After importing the certificate, the administrator sets the supported encryption suite in the server configuration, and preferentially enables the suite with high security and good performance, such as the TLS_AES_256_GCM_SHA384 suite under the TLS1.3 protocol. This suite uses the AES-256-GCM algorithm for data encryption, providing confidentiality and integrity protection, and uses the HMAC-SHA384 algorithm for message authentication.

[0075] At the client end (service platform), the relevant configurations are also performed. The client system adds the root certificate of the server digital certificate to the trust list. When the client initiates a connection request, it will first send a "Client Hello" message, which contains the list of supported SSL / TLS protocol versions, the list of encryption suites, and a random number (ClientRandom). After receiving the "Client Hello", the server selects the protocol version and encryption suite that both parties support and have the highest security from the list provided by the client. For example, the server selects the TLS1.3 protocol and the TLS_AES_256_GCM_SHA384 suite, and sends the selected results along with the server digital certificate and the server-generated random number (ServerRandom) to the client. After receiving the server response, the client first verifies the validity of the server digital certificate, including checking whether the certificate has expired, whether it has been marked as revoked by the Certificate Revocation List (CRL) or the Online Certificate Status Protocol (OCSP), whether the domain name in the certificate is consistent with the actual server domain name connected, etc. After verification, the client first has two key random numbers: the ClientRandom generated by itself and sent to the server, and the ServerRandom returned by the server. These two random numbers play a key role in the entire key agreement process, and their combination can ensure the uniqueness of the session key each time, preventing the key from being predicted or cracked.

[0076] In terms of obtaining the pre-master key, the client uses its own private key to encrypt a specific random data, generating an encrypted data block. Then, the client uses the public key in the server's digital certificate to encrypt this encrypted data block again, ultimately obtaining the pre-master key. This process takes advantage of the characteristics of asymmetric encryption, ensuring the security of the pre-master key during transmission. Only the server that holds the corresponding private key (i.e., the server's private key) can decrypt and obtain the pre-master key. The client takes the ClientRandom, ServerRandom, and pre-master key as inputs. First, the client will concatenate these three data in a specific order to form a complete data sequence. This order is specified in the SSL / TLS protocol specification to ensure that the client and server process according to the same logic. After concatenation, the client will perform multiple hash operations and XOR operations on the data sequence. Hash operations use the protocol-specified hash algorithm (such as SHA-256), which compresses longer data sequences into fixed-length hash values. This process not only reduces data volume but also further obscures data, increasing the difficulty of cracking. XOR operations are used to further process the hash values, making the final result more random and unpredictable by XORing different parts of the hash values.

[0077] After multiple iterations of hash operations and XOR operations, the client finally obtains a fixed-length data, which is the final session key. Subsequently, the client uses the session key to encrypt the "Client Finished" message and sends it to the server. After receiving it, the server generates the session key using the same calculation method, decrypts the "Client Finished" message, and returns the encrypted "Server Finished" message, thus establishing the encrypted transmission channel.

[0078] Retrieve at least three months of running log data from the business platform's log management system. These logs detail the number of business requests, data processing scale, server CPU usage, memory occupancy, and other key indicators at each time point. To more accurately analyze the business volume trend, the time granularity is refined to every 5 minutes, and the values of each indicator in each 5-minute period are counted. For example, count the number of business requests every 5 minutes from 0 to 24 hours each day, and draw a detailed line chart of the number of business requests changing over time. At the same time, combined with indicators such as server CPU usage and memory occupancy, the business busy degree is comprehensively judged. In the analysis process, automatically exclude data of special dates such as holidays and promotional activity days, as the business volume of these dates has special characteristics and cannot represent normal business conditions.

[0079] After analyzing a large amount of data, it is found that from Monday to Friday, the number of business requests in the period from 2:00 to 4:00 is always at the lowest level in the whole day, and the average number of business requests is only about 10% of that in the peak period (such as from 10:00 to 12:00), and the CPU usage and memory occupancy of the server also maintain a very low level, usually the CPU usage is less than 10% and the memory occupancy is less than 20%. Moreover, the business volume fluctuates very little in this time period, and the data processing scale is relatively stable.

[0080] In order to ensure the reliability of the time window, the time period is continuously monitored and verified. If the business volume remains stable and low in this time period for a week, and all indicators meet the preset standards, the system will officially set the period from 2:00 to 4:00 every morning as the preset low business volume time window. In addition, a dynamic adjustment mechanism is also set up. Once the number of business requests suddenly increases in this time period, exceeding the pre-set threshold (such as reaching 20% of the peak period), or the CPU usage of the server exceeds 30%, the system will immediately start the emergency adjustment program, and the time window will be postponed by 15 minutes, and the system administrator will be notified by SMS and email, so that the administrator can understand the situation in time and take corresponding measures.

[0081] A special data change tracking module is set up inside the business platform, which will monitor the changes of business data in real time. Taking the database as an example, the data change tracking module will closely cooperate with the database management system and continuously listen to the database transaction log. The transaction log records in detail every data operation in the database, including the time of data insertion, update, deletion and other operations, the data table involved, the data row and the data content before and after the operation, etc. When entering the preset low business volume time window, the backup system first obtains the timestamp of the last backup from the backup management database. Then, according to the timestamp, all transaction records occurring after the last backup timestamp are filtered out from the database transaction log. For example, if the last backup timestamp is 1:00 on June 5, 2025, the backup system will find all transaction records from that time point in the transaction log. For each transaction record filtered out, the backup system will further analyze its operation type and the data table and data row involved. If it is an insertion operation, the backup system will obtain the specific content of the newly inserted data row; if it is an update operation, the backup system will obtain the data content before and after the update; if it is a deletion operation, the backup system will obtain the original content of the deleted data row. All the identified incremental data are classified and arranged according to the data table, and the data of each data table are grouped according to certain rules. For example, for a data table with large data volume, it is divided into groups of 1000 data; for a data table with small data volume, the data of the whole table is taken as a group.

[0082] Each data packet is numbered for sequential management during transmission. Meanwhile, to improve transmission efficiency, each data packet is compressed using an efficient compression algorithm such as the LZ4 algorithm. After compression, the data packets are transmitted sequentially to the storage area through the established encrypted transmission channel. During transmission, the sender calculates the hash value of each data packet (using the SHA-256 algorithm) and appends it to the end of the data packet. Upon receiving the data packet, the receiver also calculates the hash value of the packet and compares it with the hash value sent by the sender. If they match, it means the data packet has not been tampered with during transmission and the reception is successful; if they do not match, the sender is requested to resend the data packet. To ensure the accuracy and integrity of data transmission, the sender also sends a check packet containing the sum of all data packet hash values after sending all data packets. The receiver performs a second check on all received data packets based on the check packet.

[0083] Extracting the first anchor point:

[0084] After all incremental data is successfully transmitted to the storage area, the file system of the storage area allocates storage addresses for these data, and the metadata management module of the file system obtains the starting storage address of the backup data to determine the starting position of the data. According to the pre-set fixed offset (assuming 4096 bytes, which matches the block size of the storage device to improve data reading efficiency), move 4096 bytes backward from the starting position of the backup data on the storage medium of the storage device.

[0085] After moving to the specified position, send a data reading instruction to the storage device, which specifies the starting address and data length (4096 bytes) to be read. After receiving the instruction, the storage device reads data from the corresponding storage medium (such as a hard disk or solid state disk) through its internal storage controller and data transmission interface. During reading, the storage device caches the data to improve data transmission speed. After reading is complete, the storage device returns the 4096 bytes of data to the system. The system stores the received data in a cache area specially set for the feature anchor point as the first anchor point, waiting for subsequent processing. During the entire reading process, the system checks the integrity of data transmission to ensure that the read data is not lost or damaged.

[0086] Extracting the middle anchor point:

[0087] The total length information of the backup data is obtained by the file system metadata management module of the storage area. After obtaining the total length, the 50% position of the total length of the backup data is calculated. For example, if the total length of the backup data is 20480 bytes, the 50% position is the 10240th byte. Taking this position as the center, 2048 bytes (i.e. 2KB) are extended forward and backward, and the range of data reading is determined to be from the 8192nd byte to the 12288th byte. The system sends a data reading instruction to the storage device, which specifies the starting address (8192nd byte) and data length (4096 bytes) of the reading. After receiving the instruction, the storage device positions to the corresponding position on the storage medium according to the instruction and reads the data in sequence. During the reading process, the storage device uses pre-reading and caching techniques to improve the data reading speed. After reading is completed, the 4096 bytes of data are returned to the system. The system stores the received data in the cache area as the middle anchor point. Similarly, during the data reading process, multiple checks are performed, including parity check, CRC check, etc., to ensure the accuracy of the read data.

[0088] Extracting the tail anchor point:

[0089] The end position of the backup data in the storage area is determined, and this information can be obtained from the metadata of the file system. According to the pre-set fixed offset (the same as the fixed offset of the head anchor point, which is 4096 bytes), move 4096 bytes forward from the end position of the backup data. Taking this position as the starting point, read the data block of 4096 bytes in size continuously forward on the storage medium of the storage device. Send a reading instruction to the storage device, and after receiving the instruction, the storage device reads the data from the corresponding position through the internal channel and data reading mechanism. During the reading process, the storage device performs error detection and correction processing on the data to ensure its accuracy. After reading is completed, the 4096 bytes of data are returned to the system. The received data is stored in the cache area as the tail anchor point. At this time, the head anchor point, middle anchor point and tail anchor point have been successfully extracted, and the three anchor point data are further packaged and marked.

[0090] By encrypting the transmission channel, using SSL / TLS protocol, AES-256 and RSA encryption algorithm, the data in the transmission process is encrypted and protected, preventing data from being stolen and tampered with during transmission, effectively resisting network attacks, and ensuring the safety of data transmission from the business platform to the storage area. In the daily preset low business volume time window, data transmission is carried out, avoiding the occupation of network bandwidth and system resources during the peak period of business, reducing the impact of backup operations on the normal operation of the business platform to the minimum, and ensuring the continuity and stability of the business. Only incremental data is transmitted, compared with full backup, reducing data transmission volume and storage resource occupation, shortening backup time, improving backup efficiency, and also reducing storage costs. By extracting three feature anchor points, the representative data features of the start, middle and end of the data are obtained, which can more comprehensively and accurately verify the integrity and consistency of the data, and timely detect whether the data has been tampered with maliciously, providing reliable protection for data recovery.

[0091] In a preferred embodiment of the present application, the step 3 of connecting the three feature anchor points into an initial three-point chain structure according to the transmission time sequence, and adjusting the edge length according to the daily incremental data amount to generate the distance values of each segment of the deformed chain structure can include:

[0092] Step 300, calculating the first distance value between the first anchor point and the middle anchor point; calculating the second distance value between the first anchor point and the tail anchor point; calculating the third distance value between the middle anchor point and the tail anchor point;

[0093] Step 301, according to the daily incremental data amount, the first distance value, the second distance value and the third distance value are proportionally scaled to generate the distance values of each segment of the deformed chain structure, specifically including:

[0094] Obtaining the total amount of daily incremental data as a reference parameter;

[0095] Taking the reference parameter as the scaling factor, the first distance value, the second distance value and the third distance value are synchronously linearly scaled to obtain the scaled first-middle distance value, the first-tail distance value and the middle-tail distance value;

[0096] The scaled first-middle distance value, the first-tail distance value and the middle-tail distance value are taken as the distance values of each segment of the deformed chain structure.

[0097] In the embodiment of the present application, after the data backup and feature anchor extraction are completed, the head anchor, the middle anchor and the tail anchor are obtained. At this time, the three anchors are regarded as three key nodes of the data feature. According to the time sequence of data transmission, the head anchor is obtained first, the middle anchor is obtained second, and the tail anchor is obtained last. The system connects the head anchor as the starting end of the chain, connects the middle anchor by a virtual "chain", and connects the tail anchor from the middle anchor by another virtual "chain", thereby forming an initial three-point chain structure including three nodes and two virtual connections. In this structure, each virtual connection corresponds to an "edge length".

[0098] In step 300, the data contents of the head anchor and the middle anchor are taken out. Since each anchor data is a fixed-size byte block (such as 4 KB), the byte data is arranged in order, and the two anchor data are compared byte by byte. For example, the first byte of the head anchor is 0x41 (corresponding to ASCII code 'A'), and the first byte of the middle anchor is 0x42 (corresponding to ASCII code 'B'). Then the difference at this position is recorded as 1. Starting from the first byte, the last byte is compared in turn, and the number of byte positions with differences is counted. Finally, the cumulative number of different bytes is taken as the first distance value between the head anchor and the middle anchor. If the two anchor data are completely the same, the distance value is 0; the greater the difference, the greater the distance value.

[0099] The second distance value between the head anchor and the tail anchor is calculated as follows:

[0100] The data of the head anchor and the tail anchor are arranged in order by using the same byte-by-byte comparison method as that for calculating the first distance value, and the first byte is compared one by one. For example, the 10th byte of the head anchor is 0x50, and the 10th byte of the tail anchor is 0x51. Then the difference at this position is recorded as 1. The comparison is continued until the last byte, and the number of difference bytes is counted to determine the second distance value. Since the head anchor and the tail anchor are far apart in data, the difference in data content is large, and therefore the second distance value is greater than the first distance value.

[0101] The third distance value between the middle anchor and the tail anchor is calculated as follows:

[0102] The data of the middle anchor and the tail anchor are taken out, and the two anchor data are compared byte by byte in order from the first byte to the last byte. Each time a byte difference is found, the difference count is incremented by 1. Finally, the cumulative number of different bytes after the comparison of the entire data block is taken as the third distance value between the middle anchor and the tail anchor. The three distance values quantify the difference degree between the three anchor data from different dimensions.

[0103] Step 301, the total amount of incremental data of the day is called from the data backup management module, and this total amount information has been recorded in real time during the data transmission process. For example, the newly added data generated by the business platform of the day is 5242880 bytes (i.e. 5MB), which represents the scale of data change of the day. The first distance value, the second distance value and the third distance value calculated in the first step are respectively associated with the reference parameter. The specific operation is as follows:

[0104] The first distance value is divided by the reference parameter to obtain a proportion coefficient. For example, if the first distance value is 200 and the reference parameter is 5242880, the proportion coefficient is 200÷5242880. Then, the proportion coefficient is multiplied by a pre-set scaling reference value (assuming 10000) to obtain the scaled head-middle distance value, i.e. (200÷5242880)×10000.

[0105] The same calculation process is performed on the second distance value and the third distance value:

[0106] First, divide by the reference parameter to obtain the proportion coefficient, and then multiply by the scaling reference value. For example, the second distance value is 500, and the calculation process is 500÷5242880×1000; the third distance value is 300, and the calculation process is 300÷5242880×10000. This synchronous linear scaling method ensures that the relative relationship between the three distance values remains unchanged, while adjusting their absolute values according to the data size.

[0107] After the above scaling operation, the head-middle distance value (0.38), the head-tail distance value (0.95) and the middle-tail distance value (0.57) obtained will replace the initial distance values and become the distance values of the transformed chain structure. These new distance values not only reflect the differences of anchor point data, but also establish a quantitative correlation with the data size of the day, so that the chain structure can dynamically adapt to the changes in data size.

[0108] The distance value of the chain structure is adjusted according to the incremental data amount of the day, so that the data feature representation can dynamically change with the change of the data amount. When the incremental data amount is large, the distance value is enlarged accordingly, highlighting the difference of the data features; when the data amount is small, the distance value is reduced, ensuring the accuracy of the features. This dynamic adjustment mechanism makes the data feature representation more flexible and can adapt to the changing characteristics of different sizes of data. By comparing the feature value fingerprints generated by these distance values, it can effectively detect whether the data has been tampered with. Compared with the fixed feature representation method, this dynamically adjusted chain structure distance value can capture the subtle changes of the data, improving the accuracy and reliability of data verification. The chain structure represents the data features in a simple way, reducing the redundancy of data storage. At the same time, through the proportional scaling operation, the distance value is controlled within a reasonable range, improving the data processing efficiency and saving the computing resources and time cost.

[0109] In a preferred embodiment of the present application, step 4 of converting the distance values of each segment of the transformed chain structure into binary data segments, concatenating and inserting a separator identifier in the order of header-middle-tail, and performing a bit operation on the concatenation result to synthesize a unique feature value fingerprint can include:

[0110] Step 400, converting the scaled header-middle distance value into a first binary data segment; converting the scaled header-tail distance value into a second binary data segment; and converting the scaled middle-tail distance value into a third binary data segment;

[0111] Step 401, concatenating the first, second and third binary data segments in the order of header-middle distance value, header-tail distance value and middle-tail distance value to form a primary data chain;

[0112] Step 402, inserting a separator identifier of a preset fixed length at the end of the primary data chain to form an intermediate data chain with identifier;

[0113] Step 403, concatenating the intermediate data chain with identifier with the third binary data segment at the beginning and end to output a continuous data stream containing identifier;

[0114] Step 404, after performing a cyclic bit shift operation on the continuous data stream, a fixed-length unique feature value fingerprint is generated by performing a bitwise XOR operation, specifically including:

[0115] Step 4040, performing a cyclic left shift operation on the continuous data stream containing identifier to generate a bit-shifted data stream;

[0116] Step 4041, the data stream after displacement is divided into a front data block and a rear data block, and bitwise XOR operation is performed on the front data block and the rear data block to generate a primary compression block;

[0117] Step 4042, if the length of the primary compression block does not reach the length requirement, the primary compression block is taken as a new input data stream, and the loop left shift operation, data block division and bitwise XOR operation are repeatedly performed until the output length of the binary data reaches the length requirement.

[0118] Step 4043, the final output length of the binary data is taken as a unique feature value fingerprint.

[0119] In the embodiment of the application, the three distance values after scaling are processed first. For the head-middle distance value (such as 0.38), it is multiplied by 10000 to convert it into an integer 3800, and then 3800 is converted into a 16-bit binary number (0 is added on the left side if it is less than 16 bits), to obtain 0000111011101000 as the first binary data segment; similarly, the head-tail distance value 0.95 is multiplied by 10000 to obtain 9500, which is converted into a 16-bit binary number 0010010100011100 to become the second binary data segment; the middle-tail distance value 0.57 is multiplied by 10000 to obtain 5700, which is converted into a 16-bit binary number 0001011000100100 to become the third binary data segment.

[0120] Step 401, the first, second and third binary data segments are sequentially connected in the order of head-middle, head-tail and middle-tail. That is, 0000111011101000, 0010010100011100 and 0001011000100100 are spliced together to form a 48-bit binary string, that is, 000011101110100000100101000111000001011000100100, which is the primary data chain.

[0121] Step 402, a preset 8-bit separator identifier 11010101 is inserted at the end of the primary data chain, and after the insertion, a 56-bit intermediate data chain with an identifier is formed: that is, 00001110111010000010010100011100000101100010010011010101.

[0122] Step 403, the intermediate data chain with identifier (56 bits) and the third binary data segment (16 bits) are spliced again to form a 72-bit continuous data stream with identifier, that is, 000011101110100000100101000111000001011000100100110101010001011000100100.

[0123] Step 4040, a 72-bit continuous data stream is executed to perform a 3-bit left shift operation. That is, the leftmost 3 bits 000 are moved to the rightmost to obtain the post-shift data stream.

[0124] Step 4041, the post-shift data stream is divided into a front data block (the first 36 bits) and a rear data block (the last 36 bits) of equal length, and a bitwise XOR operation (the same bit is 0, and the different bit is 1) is performed on the two data blocks to generate a 36-bit primary compression block.

[0125] Step 4042, since the length of the primary compression block (36 bits) does not reach the preset fixed length requirement (such as 24 bits), it is treated as a new input data stream for continuous processing. A 5-bit left shift operation is performed again, and the front segment (the first 18 bits) and the rear segment (the last 18 bits) are re-divided. After the XOR operation, an 18-bit data block is obtained, which still does not meet the 24-bit requirement, and a 7-bit left shift operation and XOR operation are continuously performed, and finally a 24-bit binary data meeting the length is obtained.

[0126] Step 4043, the final output 24-bit binary data is taken as a unique feature value fingerprint. This fingerprint will be used for subsequent data integrity verification and comparison.

[0127] By converting the three distance values into binary and compressing them into a fixed-length fingerprint, the storage space of the data features is reduced, while the key difference information of the original data is retained. The combination of the cyclic shift and the XOR operation makes even a slight change in the input data result in a significantly different fingerprint, effectively preventing data from being tampered with without being detected. The fixed-length fingerprint structure facilitates fast comparison, and when verifying data integrity, only the consistency of the fingerprints needs to be compared, without the need to process the original large amount of data, thereby improving the verification efficiency. Through the specific splicing order (head-middle-tail) and the insertion of the identifier, the time sequence characteristics of the data are implied in the fingerprint, which helps to identify the order abnormalities in the data transmission process. Bit operation processing makes the fingerprint have a certain fault tolerance to noise and small errors in data transmission, while it can sensitively detect intentional tampering behavior.

[0128] In a preferred embodiment of the present application, the above step 5 uses the feature value fingerprint to perform a verification operation, and after the operation is completed, the physical connection of the storage area is cut off, which can include:

[0129] Step 500, based on the current backup data, re-extract the head anchor, middle anchor and tail anchor from the fixed offset after the starting position, the total length 50% position and the fixed offset before the end position, and generate the verification feature value fingerprint;

[0130] Step 501, compare the verification feature value fingerprint with the fixed-length unique feature value fingerprint bit by bit, and when the number of inconsistent bits is less than the preset fault tolerance threshold, generate a physical isolation control signal;

[0131] Step 502, according to the physical isolation control signal, drive the physical switch device to cut off all physical connection cables between the storage area and the external network.

[0132] In the embodiment of the application, first, the current backup data is scanned, which is located to the starting position of the backup data in the storage area, and the corresponding data block is read as the new head anchor by moving the offset from the starting position backward according to the pre-set fixed offset (for example, 4KB). Then, the system calculates the total length of the backup data, finds the position of 50% of the total length, and extends a certain length (for example, 2KB before and after, a total of 4KB) forward and backward from the position as the center, and extracts the part of data as the middle anchor. Finally, the end position of the backup data is determined, and the corresponding data block is read as the tail anchor by moving the fixed offset from the end position forward.

[0133] After obtaining the new head anchor, middle anchor and tail anchor, the three anchors are connected into a three-point chain structure according to the transmission time sequence, and the same calculation process as generating the feature value fingerprint before is repeated. First, the distance values between the head anchor and the middle anchor, the head anchor and the tail anchor, and the middle anchor and the tail anchor are calculated, and then the distance values are scaled according to the daily incremental data volume. The scaled distance values are converted into binary data segments, spliced in the order of head-middle-tail, and inserted into the preset separator identifier to form a continuous data stream. The data stream is subjected to a cyclic shift operation and a bitwise XOR operation, and is compressed through multiple iterations until a verification feature value fingerprint equal in length to the previous feature value fingerprint is generated.

[0134] Step 501, the newly generated verification feature value fingerprint is compared with the previously stored fixed-length unique feature value fingerprint bit by bit. Starting from the first binary bit of the fingerprint, the comparison is carried out sequentially until the last binary bit. Every time an inconsistent bit is found, the difference count is incremented by 1. For example, if the first bit of the first fingerprint is 0 and the first bit of the second fingerprint is 1, the difference count is incremented by 1, and then the next bit is compared. After all the bits have been compared, the number of inconsistent bits obtained is compared with the preset fault tolerance threshold. The preset fault tolerance threshold is a value preset according to the data characteristics and business requirements, for example, 5. If the number of inconsistent bits is less than or equal to the fault tolerance threshold, it means that the difference between the current backup data and the original backup data is within an acceptable range, and the data integrity is guaranteed. At this time, the system generates a physical isolation control signal; otherwise, if the number of inconsistent bits exceeds the fault tolerance threshold, it is determined that the data may have been tampered with, and no control signal is generated and a data anomaly alarm is triggered.

[0135] Step 502, after the physical isolation control signal is generated, the signal is transmitted to the controller that controls the physical switch device. The physical switch device is composed of dedicated hardware equipment, such as an electromechanical switch on a network line. After receiving the physical isolation control signal, the controller sends an operation instruction to the physical switch device.

[0136] Taking an electromechanical switch as an example, the controller drives the mechanical components inside the switch to act through electrical signals, disconnecting the physical cables such as network lines or optical fibers connecting the storage area with the external network from the electrical or optical level, and completely cutting off the data transmission path. The entire process is completed in a very short time, ensuring that the storage area and the external network are no longer physically connected, preventing ransomware or other malicious attacks from penetrating the storage area through the network, and protecting the security of the backup data.

[0137] By re-extracting the feature anchor points and generating the verification feature value fingerprint, and comparing it with the original fingerprint, it can accurately detect whether the backup data has been tampered with. Even if the data changes slightly, it will be reflected in the fingerprint comparison, improving the accuracy and reliability of data integrity verification compared with traditional verification methods.

[0138] The preset fault tolerance threshold is set, so that the system does not misjudge the data anomaly when facing some non-malicious data changes (such as small errors of storage devices), which ensures the strictness of data verification and increases the practicability and stability of the system. Once the verification is passed, the physical connection of the storage area is immediately cut off, completely blocking the network attack path from the physical layer, forming a solid security line. Even if the business system is attacked by ransomware, the isolated backup data can remain safe, providing reliable protection for data recovery and avoiding significant losses caused by data loss. The entire verification and isolation process is automatically executed by the system without human intervention, reducing the risk of human operation errors and improving the timeliness and efficiency of data security protection, realizing the automated security closed-loop management from data backup, verification to isolation.

[0139] As shown in Figure 2 The embodiment of the present application also provides a ransomware prevention data backup system based on isolated storage, comprising:

[0140] A storage module is configured to deploy a storage area physically isolated from a business platform in a data center, and the storage area is not physically connected to an internal office network and an external service network;

[0141] A backup module is configured to transmit incremental data of the business platform to the storage area in batches through an encrypted transmission channel in a daily preset low-traffic time window, and extract three feature anchors including a head anchor, a middle anchor and a tail anchor in chronological order;

[0142] A modeling module is configured to connect the three feature anchors into an initial three-point chain structure according to the transmission time sequence, and adjust the edge length according to the amount of incremental data of the day to generate distance values of each segment of the deformed chain structure;

[0143] A fingerprint module is configured to convert the distance values of each segment of the deformed chain structure into binary data segments, splice and insert a separator identifier in the order of head-middle-tail, and perform a bit operation on the splicing result to synthesize a unique feature value fingerprint;

[0144] An isolation module is configured to perform a verification operation using the feature value fingerprint, and cut off the physical connection of the storage area after the operation is completed.

[0145] It should be noted that the system corresponds to the above method, and all implementation manners in the above method embodiment are applicable to this embodiment and can achieve the same technical effects.

[0146] The embodiment of the present application also provides a computing device, comprising a processor and a memory storing a computer program, wherein the computer program is executed by the processor to perform the method as described above. All implementation manners in the above method embodiment are applicable to this embodiment and can achieve the same technical effects.

[0147] An embodiment of the present application also provides a computer readable storage medium storing instructions which, when executed on a computer, cause the computer to perform the method described above. All implementation manners in the above method embodiment are applicable to this embodiment and can achieve the same technical effects.

[0148] The above is the preferred embodiment of the present application. It should be pointed out that, for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, which should also be considered as the protection scope of the present application.

Claims

1. A ransom virus data backup prevention method based on isolated storage, characterized by, The method comprises: Step 1, deploying a storage area physically isolated from the business platform in the data center, which is not physically connected with the internal office network and the external service network; Step 2, transmitting the incremental data of the business platform to the storage area in batches through an encrypted transmission channel during a preset low-traffic time window every day, and extracting three feature anchors in chronological order, including a head anchor, a middle anchor and a tail anchor; Step 3, calculating a first distance value between the head anchor and the middle anchor, a second distance value between the head anchor and the tail anchor, and a third distance value between the middle anchor and the tail anchor; obtaining the total amount of incremental data of the day as a reference parameter; performing a synchronous linear scaling operation on the first distance value, the second distance value and the third distance value by taking the reference parameter as a scaling factor to obtain the scaled head-middle distance value, the scaled head-tail distance value and the scaled middle-tail distance value; and taking the scaled head-middle distance value, the scaled head-tail distance value and the scaled middle-tail distance value as the distance values of each segment of the deformed chain structure; Step 4, converting the scaled head-middle distance value into a first binary data segment, converting the scaled head-tail distance value into a second binary data segment, and converting the scaled middle-tail distance value into a third binary data segment; sequentially splicing the first, second and third binary data segments to form a primary data chain; inserting a preset fixed-length separator identifier at the end of the primary data chain to form an intermediate data chain with an identifier; splicing the intermediate data chain with the identifier at the beginning and the third binary data segment at the end to output a continuous data stream containing an identifier; performing a cyclic left shift operation on the continuous data stream containing an identifier to generate a bit-shifted data stream; dividing the bit-shifted data stream into a front data block and a rear data block, and performing a bitwise XOR operation on the front data block and the rear data block to generate a primary compression block; if the length of the primary compression block does not meet the fixed length requirement, taking the primary compression block as a new input data stream, and repeatedly performing the cyclic left shift operation, the data block division and the bitwise XOR operation until a fixed-length binary data is output; taking the final output fixed-length binary data as a unique feature value fingerprint; Step 5, performing a verification operation using the feature value fingerprint, and cutting off the physical connection of the storage area after the operation is completed.

2. The ransom virus data backup prevention method based on isolated storage according to claim 1, characterized in that, The three feature anchors include a head anchor, a middle anchor and a tail anchor, which include: The head anchor: a data block at a fixed offset position after the start position of the backup data; The middle anchor: a data block at a position of 50% of the total length of the backup data; The tail anchor: a data block at a fixed offset position before the end position of the backup data.

3. The ransom virus data backup prevention method based on isolated storage according to claim 2, characterized in that, Performing a verification operation using the feature value fingerprint, and cutting off the physical connection of the storage area after the operation is completed, which includes: Based on the current backup data, re-extracting the head anchor, the middle anchor and the tail anchor from the fixed offset position after the start position, the position of 50% of the total length and the fixed offset position before the end position, and generating a verification feature value fingerprint; The verification feature value fingerprint is compared with the fixed-length unique feature value fingerprint bit by bit, and when the number of inconsistent bits is less than a preset fault tolerance threshold, a physical isolation control signal is generated; According to the physical isolation control signal, the physical switch device is driven to cut off all physical connection cables between the storage area and the external network.

4. A ransomware data backup system based on isolated storage, the system implementing the method of any one of claims 1 to 3, characterized in that, Comprise: The storage module is used for deploying a storage area physically isolated from the business platform in the data center, and the storage area is not physically connected with the internal office network and the external service network; The backup module is used for transmitting the incremental data of the business platform to the storage area in batches through an encrypted transmission channel in a daily preset low-traffic time window, and extracting three feature anchors including a head anchor, a middle anchor and a tail anchor in time sequence; The modeling module is used for connecting the three feature anchors into an initial three-point chain structure according to the transmission time sequence, and adjusting the edge length according to the amount of incremental data of the day to generate distance values of each segment of the deformed chain structure; The fingerprint module is used for converting the distance values of each segment of the deformed chain structure into binary data segments, splicing and inserting a separator identifier in the order of head-middle-tail, and performing bit operation on the splicing result to synthesize a unique feature value fingerprint; The isolation module is used for performing a verification operation using the feature value fingerprint, and cutting off the physical connection of the storage area after the operation is completed.

5. A computing device, comprising: Comprise: One or more processors; Storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, so that the one or more processors implement the method as claimed in any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a program which is executed by the processor to implement the method as claimed in any one of claims 1 to 3.

Images