Data security encryption method for distributed storage of mass data
By dynamically assessing the importance of storage nodes and the distribution of data shards, and dynamically allocating differentiated key lengths, the single point of leakage problem caused by static key policies is solved, thereby improving the security and performance of distributed storage systems.
Patent Information
- Application Number
- CN202511416638.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-30
- Publication Date
- 2025-11-07
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Existing distributed storage encryption technologies employ static or single key length strategies, which makes it easy for attackers to decrypt global data in bulk when a single key is leaked, resulting in low security.
By analyzing the historical load and disk read/write activity of storage nodes, the importance of nodes is dynamically assessed. Combined with the uniformity of data shard distribution, differentiated key lengths are dynamically allocated, and encryption is performed using algorithms such as AES, thereby achieving adaptive differentiated encryption.
It improves the overall security of distributed storage systems, achieves the optimal balance between security and performance, and prevents global data leakage caused by single-point key leakage.
Smart Images
Figure CN120910890A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of data encryption processing, and particularly relates to a data security encryption method for massive data distributed storage. BACKGROUND
[0002] With the advent of the big data era, the data scale presents explosive growth, and the traditional centralized storage has been difficult to meet the storage demand of massive data due to its inherent single point of failure and expansion bottleneck. The distributed storage which can meet the storage demand of massive data has become the mainstream storage technology. The distributed storage system has the characteristics of data dispersed storage, cross-node and cross-regional transmission, significantly expands the attack surface of the system, and makes the data face security risks such as leakage and illegal tampering. Therefore, encryption technology has become the core of the whole life cycle security protection in the process of massive data distributed storage.
[0003] The existing distributed storage encryption technology usually adopts a static or single key length strategy to encrypt data, but once the encryption key of a node is leaked, since other nodes adopt the same encryption mode and key strength, the attacker can easily deduce and decrypt the data on other nodes in batches, causing systematic data security risks, resulting in low security of data encryption of distributed storage. SUMMARY
[0004] In order to solve the technical problem that the global data is destroyed due to the leakage of single point key caused by the static uniform key length strategy, the purpose of the present application is to provide a data security encryption method for massive data distributed storage, and the technical solution adopted is as follows: The present application provides a data security encryption method for massive data distributed storage, which comprises the following steps: Obtaining the number of users served by each storage node in the distributed storage system in the historical analysis period and the daily disk read-write volume; According to the load condition and the change trend of the disk read-write volume of the storage node in the historical analysis period, the data importance of the storage node is obtained, and according to the number of users served by the storage node in the historical analysis period and the data importance, the ideal key length required by the encryption process of the storage node in the distributed storage system is determined; According to the distribution uniformity of the data shards stored by the storage node during real-time data storage, the key complexity of each data shard on the storage node is obtained, the key complexity of each data shard on the storage node is matched with the key length supported by the encryption algorithm, the ideal key length is adjusted, and the preferred key length required by the encryption process of each data shard on the storage node is obtained; and the data shards on the storage node are encrypted based on the preferred key length.
[0005] Further, the data importance of the storage node is obtained according to the overall repetition degree, the read-write trend value and the overall read-write amount. The disk I / O peak value and its duration of the storage node in each day within the historical analysis period are obtained, the cumulative sum of the duration of all disk I / O peaks of the storage node in each day is recorded as the reuse degree, the reuse degrees of all days within the historical analysis period are averaged to obtain the overall repetition degree of the storage node. The disk read-write amount of the storage node in all days within the historical analysis period is linearly fitted, and the slope of the obtained fitting straight line is recorded as the read-write trend value. The disk read-write amount of the storage node in all days within the historical analysis period is averaged to obtain the overall read-write amount. The data importance of the storage node is obtained according to the overall repetition degree, the read-write trend value and the overall read-write amount.
[0006] Further, the ideal key length required by the encryption process of the storage node in the distributed storage system is determined according to the encryption complexity. The ratio of the number of users served by each storage node in the distributed storage system to the number of users served by all storage nodes in the historical analysis period is taken as the user complexity of each storage node. The product of the data importance and the user complexity is taken as the encryption complexity of the storage node. The ideal key length required by the encryption process of the storage node is determined based on the encryption complexity.
[0007] Further, the ideal key length required by the encryption process of the storage node is determined based on the encryption complexity. Based on the encryption complexity, all storage nodes in the distributed storage system are clustered to obtain different clustering clusters; the number of clustering clusters is the number of types of key lengths supported by the encryption algorithm. The encryption complexity of all storage nodes in the same clustering cluster is averaged to obtain the overall complexity of each clustering cluster; all types of key lengths supported by the encryption algorithm and the overall complexity of all clustering clusters are arranged in the same order to form a key length sequence and a complexity sequence, respectively. The key length at each index in the key length sequence is taken as the ideal key length required by the encryption process of all storage nodes in the corresponding clustering cluster corresponding to the overall complexity at the corresponding index in the complexity sequence.
[0008] Further, the key complexity of each data shard on the storage node is obtained. The number of shards of the original data to which each data shard on the storage node belongs when the data is stored in real time is obtained. The ratio of the number of shards of the original data to which each data shard on the storage node belongs to the total number of shards of the original data to which all data shards belong is taken as the key complexity of each data shard on the storage node.
[0009] Further, the preferred key length required by the encryption process of each data shard on the storage node is obtained, including: All data shards on the storage node are arranged in order of the key complexity to generate a shard sequence. The shard sequence of the storage node is divided into different subsequences, and the target subsequence has more elements than the remaining subsequences; the number of subsequences is equal to the number of key length types supported by the encryption algorithm, and the order of the target subsequence in all subsequences of the shard sequence is the same as the order of the ideal key length of the storage node in the key length sequence. Optionally, one of the subsequences is taken as an example sequence, and the preferred key length required by the encryption process of the data block in the example sequence is obtained; the order of the example sequence in all subsequences of the shard sequence is the same as the order of the preferred key length in the key length sequence.
[0010] Further, the shard sequence and the key length sequence are sorted in the same way.
[0011] Further, the clustering method for all storage nodes in the distributed storage system is the K-means clustering algorithm.
[0012] Further, the encryption method for the data shards on the storage node is the AES algorithm.
[0013] Further, the overall repetition degree, the read-write trend value and the overall read-write amount are positively correlated with the data importance.
[0014] The present application has the following beneficial effects: First aspect: by analyzing the load status and the change trend of the disk read-write amount of the storage node every day in the historical analysis period, the importance of the data stored by the storage node is evaluated, the data importance of the storage node is determined, the number of users served by the storage node presents the attack surface of the storage node, the encryption complexity required by the storage node is analyzed by quantifying these factors, and then the ideal key length is dynamically allocated, and the importance level of different storage nodes is distinguished.
[0015] The second aspect is that the storage node is uniform in distribution of data shards when storing data in real time. The logical association degree of the shard data of each storage node with other storage nodes is measured, the encryption level required by the shard data on the storage node is analyzed, the key complexity is determined, and the ideal key length is adjusted by using the key complexity, so as to dynamically allocate an optimal key length to each shard data on the storage node. Based on the optimal key length, the shard data on the storage node is differentially encrypted, so that the encryption strategy of the distributed storage system can sensitively respond to the current running state of the system, intelligently accurately allocate limited security computing resources to the key storage node, and thus realize the optimal balance between security and performance overhead.
[0016] The scheme dynamically allocates different key lengths to each shard data of different storage nodes through a two-level adaptive adjustment mechanism, realizes dynamic and fine adaptive encryption, effectively solves the problem that global data is submerged due to single-point key leakage caused by the use of a fixed key length, and greatly improves the overall security of the distributed storage system. BRIEF DESCRIPTION OF DRAWINGS
[0017] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the drawings needed in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.
[0018] Figure 1 A step flowchart of a data security encryption method for massive data distributed storage provided by an embodiment of the present application; Figure 2 A flowchart of an ideal key length acquisition method provided by an embodiment of the present application; Figure 3 A computer device schematic diagram of a data security encryption device for massive data distributed storage provided by an embodiment of the present application. DETAILED DESCRIPTION
[0019] In order to further illustrate the technical means and effects adopted by the present application to achieve the predetermined application purpose, the specific implementation, structure, features and effects of the data security encryption method for massive data distributed storage according to the present application are described in detail as follows by combining the drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. In addition, the specific features, structures or characteristics in one or more embodiments can be combined in any suitable form.
[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.
[0021] The application provides a data security encryption method for distributed storage of massive data.
[0022] Embodiment 1 The application provides a data security encryption method for distributed storage of massive data. Figure 1 Fig. 1 shows a step flow chart of the data security encryption method for distributed storage of massive data according to an embodiment of the application, which comprises the following steps. Step S1: Obtain the number of users served by each storage node in the distributed storage system during historical analysis period and the daily disk read-write volume.
[0023] Distributed storage stores data on multiple computers or servers to achieve high reliability, scalability and performance of data. Each computer or server in the distributed storage can be regarded as a storage node, and the storage nodes are connected through the network to communicate and cooperate with each other to achieve distributed storage and management of data. User original data refers to complete data objects that the user wants to store in the distributed storage system. The system generates multiple data shards by sharding the user original data for the convenience of storage and fault tolerance, and the data shards are distributed and stored on different storage nodes.
[0024] For each storage node in the distributed storage system, the monitoring system is configured to obtain the disk I / O rate and the total amount of disk read-write data of the storage node per day in the historical analysis period at a sampling frequency of once per minute. For each day in the historical analysis period, the disk I / O rate at all times of the day is curve-fitted to generate an I / O curve, and the amplitude of the maximum value on the curve is taken as the disk I / O peak value of the day. The continuous time during which each disk I / O peak value is maintained at no less than a preset percentage of the peak value is recorded as the duration of the peak value. The storage node in the distributed storage system generates an access log for each data access request, and each log records at least a timestamp and a user identifier. From the logs of each storage node, log records with timestamps within the historical analysis period are screened out, and the total number of non-repeated user identifiers in these records is recorded as the number of users served by each storage node in the historical analysis period. From the logs of each storage node, log records with timestamps within each day of the historical analysis period are screened out, and the number of these records is taken as the disk read-write amount of the corresponding day. At the same time, when the original data of a user is stored into the distributed storage system, the number of data shards of the original data to which each data shard belongs on each storage node is obtained. The disk I / O rate refers to the number of read-write operations per second of the disk, the original data refers to the original data object that the user wants to store into the distributed storage system, and the sampling frequency can be set as appropriate.
[0025] In one implementation manner of the embodiment of the present application, time is taken as the horizontal axis and the disk I / O rate is taken as the vertical axis to construct a two-dimensional space, the disk I / O rate at all times of each day in the historical analysis period is mapped into the two-dimensional space, and corresponding scattered points are obtained. Further, the least square method is used for fitting to obtain an I / O curve.
[0026] In one implementation manner of the embodiment of the present application, the preset percentage is set to 90%.
[0027] In one implementation manner of the embodiment of the present application, the adjacent 5 days before the time when the original data of a user is stored into the distributed storage system are taken as the historical analysis period.
[0028] Step S2: According to the load status and the change trend of the disk read-write amount of the storage node per day in the historical analysis period, the data importance of the storage node is obtained; and according to the number of users served by the storage node in the historical analysis period and the data importance, the ideal key length required by the encryption process of the storage node in the distributed storage system is determined.
[0029] The load status of the storage node per day reflects the possibility of storing more active and important hot data, and the change trend of the disk read-write amount of the storage node in the historical analysis period reflects the future importance of the storage node. The two factors are comprehensively evaluated to evaluate the importance of the data stored by the storage node.
[0030] The number of users served by the storage node is a core indicator for measuring its business criticality and risk level, and the more the number of users means the wider the attack surface of the storage node, and once data leakage occurs, the consequences are more serious, making the fault tolerance worse; the data value of the storage node with greater data importance is higher, and the risk is greater, and stronger encryption measures need to be allocated for protection. By quantifying these factors to analyze the encryption complexity required by the storage node, and then dynamically allocating the ideal key length, it ensures that the security policy of the distributed storage system can adapt to the changes of business load, intelligently accurately allocate limited security computing resources to key storage nodes, thereby achieving the optimal balance between security and performance overhead.
[0031] Step S3: According to the distribution uniformity of the data shards stored by the storage node during real-time storage of data, the key complexity of each data shard on the storage node is obtained; the key complexity of each data shard on the storage node is matched with the key length supported by the encryption algorithm, the ideal key length is adjusted, and the preferred key length required by the encryption process of each data shard on the storage node is obtained; the data shards on the storage node are encrypted based on the preferred key length.
[0032] Although the ideal key length required by the encryption process of the storage node has been determined, if the attacker masters the optimization attack method for a specific key length, it may threaten the data in the entire storage node at one time. When performing encrypted storage, the key length of the data shards on the storage node needs to be dispersed as much as possible under the premise of complying with the ideal key length.
[0033] The distribution uniformity of the data shards of the storage node during real-time storage of data, by measuring the logical association degree of the shard data of each storage node with other storage nodes, analyzing the encryption level required by the data shards on the storage node, and determining the key complexity. The key complexity of each data shard on the storage node is matched with the key length supported by the encryption algorithm, the ideal key length is adjusted, and the preferred key length is determined, which realizes the differential encryption of the data shards on a single storage node under the premise of complying with the ideal key length of the storage node, guarantees the overall level, and takes into account individual differences, and realizes the optimal balance between security and performance.
[0034] The scheme is applicable to an encryption algorithm whose encryption strength, i.e., the ability to resist brute force cracking, is determined by the key length, and the number of types of key lengths supported by the encryption algorithm needs to be greater than 1. The Advanced Encryption Standard (AES) algorithm can be selected, and data on the storage node is encrypted based on the preferred key length. The AES algorithm supports key lengths of 128 bits, 192 bits, and 256 bits, and the AES algorithm is a known technique to those skilled in the art, which will not be described here. In other embodiments, the Camellia algorithm, the Pisces algorithm, the Serpent algorithm, or the like can also be selected.
[0035] Preferably, in some possible implementation manners of the embodiments of the present application, the data importance acquisition method comprises: acquiring a disk I / O peak value and a duration thereof of the storage node in each day within a historical analysis period, accumulating durations of all disk I / O peak values of the storage node in each day, and recording the accumulation as a reuse degree; performing linear fitting on disk read / write amounts of the storage node in all days within the historical analysis period, and recording a slope of the obtained fitting straight line as a read / write trend value; averaging the disk read / write amounts of the storage node in all days within the historical analysis period to obtain an overall read / write amount; and acquiring the data importance of the storage node according to the overall reuse degree, the read / write trend value, and the overall read / write amount. In this embodiment, the least square method is used for linear fitting.
[0036] It should be noted that the reuse degree measures the frequency and severity of the storage node bearing a continuous high load pressure; the greater the overall reuse degree, the more times the disk I / O peak value appears and the longer the duration in the access process of the storage node in the historical analysis period, the storage node needs to process a large number of intensive data requests, and the possibility that the storage node stores more active and more important hot data is greater. The greater the read / write trend value, the more obvious the increasing trend of the disk read / write amount of the storage node in the historical analysis period, and the importance and load of the storage node in the future are significantly improved. The greater the overall read / write amount, the more data the storage node stores and manages, and the total value of the data is higher, which is a more critical component in the entire system. Therefore, the overall reuse degree, the read / write trend value, and the overall read / write amount are all positively correlated with the data importance. In the embodiments of the present application, the result of taking the read / write trend value of the storage node as an index and a natural constant as a base number is calculated, and the product of the result, the overall reuse degree, and the overall read / write amount is normalized to obtain the data importance of the storage node.
[0037] In the embodiments of the present application, other basic mathematical operations can also be used to construct the correlation between the overall reuse degree, the read / write trend value, the overall read / write amount, and the data importance, which is not limited or described here.
[0038] In the embodiment of the present application, the normalization processing is performed using the maximum minimum normalization, and normalization methods such as a Sigmoid function and function conversion can also be selected, which are not limited herein.
[0039] Preferably, in some possible implementation manners of the embodiment of the present application, the method for obtaining the ideal key length can refer to Figure 2 FIG. 1 shows a flowchart of a method for obtaining an ideal key length according to an embodiment of the present application, and the method comprises the following steps. Step S210: Taking the ratio of the number of users served by each storage node in the distributed storage system in the historical analysis period to the number of users served by all storage nodes in the historical analysis period as the user complexity of each storage node.
[0040] It should be noted that the number of users served by the storage node directly reflects the access load and business attention of the node, and the data normalization is performed by using the number of users served by all storage nodes, so that the storage nodes in different sizes of storage clusters have comparability.
[0041] Step S220: Taking the product of the data importance and the user complexity as the encryption complexity of the storage node.
[0042] It should be noted that the greater the user complexity, the greater the attack attraction of the storage node storing more sensitive data of more users, and the more serious the consequences of data leakage, and the poorer the reliability and fault tolerance of the storage node, so the storage node needs stronger security protection to reduce the probability of catastrophic consequences, so the encryption complexity of the data on the storage node is higher. The data value of the storage node with greater data importance is higher, and the risk is greater, and stronger encryption measures need to be allocated for protection. Therefore, the user complexity and the data importance are positively correlated with the encryption complexity.
[0043] Step S230: Determining the ideal key length required by the encryption process of the storage node based on the encryption complexity.
[0044] Preferably, in some possible implementation manners of the embodiment of the present application, the method for obtaining the ideal key length comprises clustering all storage nodes in the distributed storage system based on the encryption complexity to obtain different clustering clusters; the number of clustering clusters is the number of types of key lengths supported by the encryption algorithm; the encryption complexity of all storage nodes in the same clustering cluster is averaged to obtain the overall complexity of each clustering cluster; all types of key lengths supported by the encryption algorithm and the overall complexity of all clustering clusters are arranged in the same order respectively to form a key length sequence and a complexity sequence; and the key length of each subscript in the key length sequence is taken as the ideal key length required by the encryption process of all storage nodes in the corresponding clustering cluster corresponding to the overall complexity of the corresponding subscript in the complexity sequence.
[0045] It should be noted that the overall complexity reflects the overall security requirement level of all storage nodes in each cluster, and all storage nodes in the same cluster use the same key length for encryption. The key length sequence and the elements in the complexity sequence are arranged in descending or ascending order to establish a strict order correspondence between the two sequences, and to allocate the ideal key length matching the security requirement level of the storage nodes in different clusters.
[0046] In the embodiment of the present application, the K-means clustering algorithm is selected for clustering the storage nodes, where K is the number of key lengths supported by the encryption algorithm.
[0047] Preferably, in some possible implementation manners of the embodiment of the present application, the key complexity acquisition method comprises: acquiring the number of data shards of the original data to which each data shard belongs when the storage node stores data in real time; and taking the ratio of the number of data shards of the original data to which each data shard on the storage node belongs to the total number of data shards of the original data to which all data shards belong as the key complexity of each data shard on the storage node.
[0048] It should be noted that the larger the ratio is, the more data shards of the original data to which each shard data on each storage node belongs are distributed on other storage nodes, indicating that the logical association between each shard data on the storage node and other storage nodes is stronger, and the analysis data is broken to cause bulk leakage of associated data, which needs to be protected by a stronger encryption method, and the key complexity is larger.
[0049] Preferably, in some possible implementation manners of the embodiment of the present application, the preferred key length acquisition method comprises: arranging all data shards on the storage node in order of key complexity to generate a shard sequence; dividing the shard sequence of the storage node into different subsequences, the subsequences including a target subsequence, the number of elements in the target subsequence being greater than the number of elements in the remaining subsequences; the number of subsequences being equal to the number of key lengths supported by the encryption algorithm, and the order of the target subsequence in all subsequences of the shard sequence being the same as the order of the ideal key length of the storage node in the key length sequence; optionally taking one subsequence as an example sequence, and acquiring the preferred key length required by the data block encryption process in the example sequence; the order of the example sequence in all subsequences of the shard sequence being the same as the order of the preferred key length in the key length sequence.
[0050] It should be noted that the order of the fragment sequence and the key length sequence is the same, assuming that the elements in the key length sequence are arranged from large to small, the key complexity of the fragment data from front to back in the fragment sequence is in descending order, so that the i-th position in both sequences represents the i-th highest security level or encryption strength. The fragment sequence is divided into sub-sequences to match the key length supported by the encryption algorithm; in order to achieve the best balance between security and performance, it is necessary to ensure that the key length of most of the fragment data in the storage node is mainly the ideal key length, and the fragment data of the target sub-sequence with the largest number of elements is preferred in the encryption process. The key length of the storage node is the ideal key length.
[0051] So far, the application is completed.
[0052] Embodiment 2: The application also provides a computer device schematic diagram of a data security encryption device for distributed storage of massive data, which refers to Figure 3 The computer device includes a memory 401, a processor 402, and a computer program 403 stored in the memory 401 and running on the processor 402, wherein when the processor 402 executes the computer program 403, the computer device can execute any of the data security encryption methods for distributed storage of massive data described above.
[0053] In addition, the embodiments of the present application also protect a device, which can include a memory and a processor, wherein the memory stores executable program code, and the processor is used to call and execute the executable program code to execute the data security encryption method for distributed storage of massive data provided by the embodiments of the present application.
[0054] The embodiments can divide the device into functional modules according to the above method examples, for example, corresponding to each functional module, or two or more functions can be integrated into one processing module, and the integrated module can be realized in the form of hardware. It should be noted that the division of modules in the embodiments is illustrative, and is only a logical function division, and actual implementation can have another division mode.
[0055] In the case of dividing each module corresponding to each function, the device can also include a communication module, a signal analysis module, a complexity analysis module, and a positioning module, etc. It should be noted that all related contents of each step involved in the above method embodiments can be referred to the function description of the corresponding functional module, which will not be repeated here.
[0056] It should be understood that the device provided by the embodiments is used to execute the above data security encryption method for distributed storage of massive data, and therefore can achieve the same effect as the above implementation method.
[0057] In the case of employing the integrated unit, the device can include a processing module, a storage module. Wherein, when the device is applied to the equipment, the processing module can be used to control and manage the actions of the equipment. The storage module can be used to support the equipment to execute the mutual program code and the like.
[0058] Wherein, the processing module can be a processor or a controller, which can realize or execute various exemplary logical blocks, modules and circuits contained in combination with the disclosure of the present application. The processor can also be a combination of realizing computing functions, such as including one or more microprocessor combinations, a combination of digital signal processing (Digital Signal Processing, DSP) and microprocessor, and the like. The storage module can be a memory.
[0059] Embodiment 3: The embodiment also provides a computer program product, when the computer program product runs on the computer, so that the computer executes the above-mentioned related steps to realize the data security encryption method for mass data distributed storage provided by the above-mentioned embodiment.
[0060] Wherein, the device, computer program product or chip provided by the embodiment are used to execute the corresponding method provided above, so the beneficial effects that can be achieved are referred to the beneficial effects in the corresponding method provided above, which will not be repeated here.
[0061] In the embodiments provided by the present application, it should be understood that the disclosed device and method can be implemented by other ways. For example, the device embodiment described above is only schematic, for example, the division of the module or unit is only a logical function division, and the actual implementation can be other division manners, for example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.
[0062] It should be noted that: the sequence of the above-mentioned embodiments of the present application is only for description, not representing the advantages and disadvantages of the embodiments. The processes described in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are also possible or can be advantageous.
[0063] Each embodiment in the specification is described in a progressive manner, and the same or similar parts between each embodiment can be referred to each other. Each embodiment focuses on the difference from other embodiments.
Claims
1. A data security encryption method for distributed storage of mass data, characterized in that, The method comprises: obtaining the number of users served by each storage node in the distributed storage system in a historical analysis period and the disk read / write volume per day; obtaining the data importance of the storage node according to the load condition and the change trend of the disk read / write volume of the storage node per day in the historical analysis period; determining the ideal key length required by the encryption process of the storage node in the distributed storage system according to the number of users served by the storage node in the historical analysis period and the data importance; obtaining the key complexity of each data shard stored on the storage node according to the distribution uniformity of the data shard stored on the storage node when storing data in real time; matching the key complexity of each data shard on the storage node with the key length supported by the encryption algorithm, adjusting the ideal key length, and obtaining the preferred key length required by the encryption process of each data shard on the storage node; and encrypting the data shard on the storage node based on the preferred key length.
2. The data security encryption method for massive data distributed storage according to claim 1, characterized in that, The data importance of the storage node is obtained, comprising: obtaining the disk I / O peak value and its duration of the storage node per day in the historical analysis period; summing up the duration of all disk I / O peak values per day of the storage node, and recording the sum as the reuse degree; averaging the reuse degrees of all days in the historical analysis period to obtain the overall reuse degree of the storage node; performing linear fitting on the disk read / write volume of the storage node per day in the historical analysis period; recording the slope of the obtained fitting straight line as the read / write trend value; averaging the disk read / write volume of the storage node per day in the historical analysis period to obtain the overall read / write volume; obtaining the data importance of the storage node according to the overall reuse degree, the read / write trend value and the overall read / write volume.
3. The data security encryption method for massive data distributed storage according to claim 1, characterized in that, The ideal key length required by the encryption process of the storage node in the distributed storage system is determined, comprising: taking the ratio of the number of users served by each storage node in the distributed storage system in the historical analysis period to the number of users served by all storage nodes in the historical analysis period as the user complexity of each storage node; taking the product of the data importance and the user complexity as the encryption complexity of the storage node; determining the ideal key length required by the encryption process of the storage node based on the encryption complexity.
4. The data security encryption method for massive data distributed storage according to claim 3, characterized in that, The ideal key length required by the encryption process of the storage node based on the encryption complexity, comprising: clustering all storage nodes in the distributed storage system based on the encryption complexity to obtain different clustering clusters; the number of clustering clusters is the number of types of key lengths supported by the encryption algorithm; averaging the encryption complexity of all storage nodes in the same clustering cluster to obtain the overall complexity of each clustering cluster; arranging all types of key lengths supported by the encryption algorithm and the overall complexity of all clustering clusters in the same order to form a key length sequence and a complexity sequence, respectively; taking the key length of each subscript in the key length sequence as the overall complexity of the corresponding subscript in the complexity sequence, which corresponds to the ideal key length required by the encryption process of all storage nodes in the corresponding clustering cluster.
5. The data security encryption method for massive data distributed storage according to claim 1, characterized in that, The key complexity of each data shard on the storage node is obtained, comprising: Obtaining the number of shards of the original data to which each data shard belongs when the data is stored in real time; Taking the ratio of the number of shards of the original data to which each data shard on the storage node belongs and the total number of shards of the original data to which all data shards belong as the key complexity of each data shard on the storage node.
6. The data security encryption method for massive data distributed storage according to claim 4, characterized in that, The preferred key length required by the encryption process of each data shard on the storage node is obtained, including: Arranging all data shards on the storage node in order of the key complexity to generate a shard sequence; Dividing the shard sequence of the storage node into different subsequences, including a target subsequence, the number of elements in the target subsequence is greater than that in the remaining subsequences; the number of subsequences is equal to the number of key length types supported by the encryption algorithm, and the order of the target subsequence in all subsequences of the shard sequence is the same as the order of the ideal key length of the storage node in the key length sequence; Optionally, one of the subsequences is recorded as an example sequence, and the preferred key length required by the data block encryption process in the example sequence is obtained; the order of the example sequence in all subsequences of the shard sequence is the same as the order of the preferred key length in the key length sequence.
7. The data security encryption method for facing mass data distributed storage according to claim 6, characterized in that, The shard sequence and the key length sequence are sorted in the same way.
8. The data security encryption method for facing mass data distributed storage according to claim 4, characterized in that, The method for clustering all storage nodes in the distributed storage system is the K-means clustering algorithm.
9. The data security encryption method for facing mass data distributed storage according to claim 1, characterized in that, The method for encrypting data shards on the storage node is the AES algorithm.
10. The data security encryption method for massive data distributed storage according to claim 2, characterized in that, The overall repetition degree, the read-write trend value, and the overall read-write amount are positively correlated with the data importance.