Security management method and system for network big data

Abstract

The present invention relates to the technical field of data security, and in particular to a security management method and system for network big data, which includes: a user terminal, an intermediate server, a background server, and a data storage module; the intermediate server includes an intermediate receiving module, an intermediate sending module, a read digital generation module, and an encryption mode matching module; the background server includes a timestamp information generation module and a feedback module; the user terminal includes an encryption module and a user terminal sending module; the background server also includes a storage module and a decryption module; wherein the storage module is used to store data in the data storage module; the decryption module is used to decrypt the data stored in the data storage module. The present application has the effect of improving the security of data during transmission.

Description

Technical Field

[0001] The present invention relates to the technical field of data security, and in particular to a security management method and system for network big data. Background Art

[0002] Information security is an important technical issue in digital information transmission systems. Existing technologies usually encrypt data after receiving it and then store it. If the data is intercepted by a third party during the transmission process, the data can be directly viewed or modified, which poses a security risk to data transmission and management. Summary of the invention

[0003] In order to improve the security of data during transmission, the present application provides a method and system for secure management of network big data.

[0004] The above-mentioned invention objective of the present application is achieved through the following technical solutions:

[0005] A network big data security management system, comprising a user terminal, an intermediate server, a background server, and a data storage module;

[0006] The intermediate server includes an intermediate receiving module, an intermediate sending module, a read digital generation module and an encryption mode matching module;

[0007] The intermediate receiving module is used to receive a storage request from a user terminal, wherein the storage request carries the location information of the user terminal;

[0008] The intermediate sending module is used to send the intermediate request and the location information of the user end to the backend server;

[0009] The reading number generation module is used to generate a reading number according to the local time stamp information of the user terminal;

[0010] The encryption mode matching module is used to match the corresponding encryption mode in the encryption mode sequence according to the read number;

[0011] The intermediate sending module is also used to send the encryption method to the user end;

[0012] The backend server includes a timestamp information generation module and a feedback module;

[0013] The timestamp information generating module is used to generate the local timestamp information of the user terminal according to the location information of the user terminal and the timestamp information when the intermediate request is received;

[0014] The feedback module is used to return feedback information to the intermediate server, and the feedback information carries the local time stamp information of the user terminal;

[0015] The user end includes an encryption module and a user end sending module;

[0016] Wherein, the encryption module is used to encrypt the data according to the encryption method;

[0017] The user-side sending module is used to send the encrypted data to the intermediate server;

[0018] The intermediate sending module is also used to transfer the received encrypted data to the backend server;

[0019] The backend server also includes a storage module and a decryption module;

[0020] Wherein, the storage module is used to store data in the data storage module;

[0021] The decryption module is used to decrypt the data stored in the data storage module.

[0022] By adopting the above technical solution, when the user has a data storage demand, a storage request is initiated by the user terminal, and then the intermediate server receives the storage request, and then sends the intermediate request together with the location information of the user terminal to the background server. When the background server receives the request, it generates the local time timestamp information of the user terminal when the request is received. On the one hand, it avoids the user terminal from sending modified timestamp information, and on the other hand, it avoids being hijacked and modified by the intermediate and then sent. Moreover, it is generated based on the timestamp information of the background server when the request is received combined with the location information of the user terminal, which can maintain randomness and is not easy to be modified from the user terminal to send false information, thereby ensuring the security of the previous communication encryption method. Then the intermediate server generates a read number based on the local time timestamp information to randomly match the corresponding encryption method, and then the user terminal encrypts according to the random encryption method, thereby ensuring the security of data transmission during the journey.

[0023] In a preferred example, the present application may be further configured as follows: generating a reading number according to the local time stamp information of the user terminal includes:

[0024] Calculate the sum of the minutes and seconds of the local time stamp information;

[0025] The remainder obtained by dividing the sum by the number of encryption methods in the encryption method sequence plus one is used as the read number.

[0026] By adopting the above technical solution, high randomness of the read numbers can be achieved.

[0027] In a preferred example, the present application may be further configured as follows: generating a reading number according to the local time stamp information of the user terminal includes:

[0028] The second digit of the local time stamp information is divided by the number of encryption methods in the encryption method sequence, and the remainder obtained by adding one to it is used as the read digit.

[0029] By adopting the above technical solution, high randomness of reading numbers can be achieved in another way.

[0030] In a preferred example, the present application can be further configured as follows: the intermediate server further includes:

[0031] An encryption program package acquisition module is used to generate a corresponding encryption program package according to the encryption method;

[0032] The intermediate sending module is also used to send the encrypted program package to the user end;

[0033] After receiving the encryption program package, the user terminal performs encryption operation on the data according to the encryption program package.

[0034] By adopting the above technical solution, the intermediate server can directly send the corresponding encrypted program package to the user terminal according to the encryption method, thereby realizing the customization of the encryption method and the encrypted program package.

[0035] In a preferred example, the present application may be further configured as follows: the intermediate sending module is also used to send the read number to a backend server;

[0036] The data storage module includes a plurality of sub-storage modules, the number of the plurality of sub-storage modules is the same as the number of the types of encryption methods, and the numbers of the plurality of sub-storage modules correspond one by one to the sequence numbers of the encryption methods in the encryption method sequence;

[0037] The storing of data in the data storage module comprises:

[0038] The data is stored in the sub-storage module numbered corresponding to the read number.

[0039] By adopting the above technical solution, data with different encryption methods can be directly stored in different sub-storage modules, thereby realizing batch decryption.

[0040] In a preferred example, the present application can be further configured as follows: the encryption methods include: RSA, DSA, ECC and DH.

[0041] In a preferred example, the present application may be further configured as follows: the intermediate server is provided in a plurality, and the plurality of intermediate servers are located in different sub-areas within a preset area;

[0042] The intermediate server is used to communicate with the user terminals in the sub-area where the intermediate server is located.

[0043] By adopting the above technical solution, unified transmission communication and orderly encryption of multiple user terminals in various locations can be achieved.

[0044] The second object of the invention is achieved by the following technical solutions:

[0045] A security management method for network big data, comprising:

[0046] receiving a storage request from a user terminal, wherein the storage request carries location information of the user terminal;

[0047] Send the intermediate request and the location information of the user terminal to the backend server;

[0048] receiving feedback information, wherein the feedback information carries local time stamp information of the user terminal;

[0049] Generate a reading number according to the local time stamp information of the user terminal;

[0050] Matching a corresponding encryption method in an encryption method sequence according to the read number;

[0051] Sending the encryption method to the client, the client encrypts the data according to the encryption method and sends it to the intermediate server;

[0052] The received encrypted data is transferred to the backend server.

[0053] In summary, the present application includes at least one of the following beneficial technical effects:

[0054] 1. When the user has a data storage demand, a storage request is initiated through the user terminal. Then, the intermediate server receives the storage request and sends the intermediate request with the location information of the user terminal to the background server. When the background server receives the request, it generates the local time stamp information of the user terminal when the request is received. On the one hand, it avoids the user terminal from sending the modified timestamp information, and on the other hand, it avoids being hijacked and modified by the middleman and then sent. Moreover, it is generated based on the timestamp information of the background server when the request is received combined with the location information of the user terminal, which can maintain randomness and is not easy to be modified from the user terminal to send false information, thus ensuring the security of the previous communication encryption method. Then, the intermediate server generates a read number based on the local time stamp information to randomly match the corresponding encryption method, and then the user terminal encrypts according to the random encryption method, thus ensuring the security of data transmission.

[0055] 2. The intermediate server can directly send the corresponding encryption package to the user end according to the encryption method, so as to realize the customization of encryption method and encryption package;

[0056] 3. Data with different encryption methods can be directly stored in different sub-storage modules, thereby realizing batch decryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a schematic diagram of the connection of various modules of the network big data security management system in one embodiment of the present application;

[0058] Figure 2 It is a flow chart for implementing a method for secure management of network big data in one embodiment of the present application. DETAILED DESCRIPTION

[0059] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0060] It should be noted that the terms "first", "second", etc. in the present invention are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure.

[0061] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0062] Figure 1 Schematic diagram of the connection of various modules of the network big data security management system in one embodiment of the present application. Figure 1 As shown, the network big data security management system includes a user terminal, an intermediate server, a background server, and a data storage module; the user terminal is installed on a user terminal, which can be an electronic device such as a mobile phone, a tablet computer, an e-book reader, a multimedia player, a wearable device, a vehicle terminal, etc. The user can download the user terminal on the user terminal, then upload file data, etc., and communicate with the intermediate server through the user terminal.

[0063] Specifically, there are multiple intermediate servers, which are located in different sub-regions within the preset area. The intermediate servers are used to communicate with the user terminals within the sub-regions where they are located. For example, the preset area is a province, and each city in the province is a sub-region. Each city in the province is equipped with the intermediate server, and the intermediate server is configured to communicate only with the user terminals within the city where it is located, that is, the user terminals in a certain city can communicate with the intermediate servers in the city and perform file data transmission, etc. The user terminal is equipped with an encryption module and a user terminal sending module. The encryption module encrypts the user's data, and then the user terminal sending module is used to send the encrypted data to the intermediate server;

[0064] The intermediate server includes an intermediate receiving module, an intermediate sending module, a reading digital generation module and an encryption method matching module; wherein the intermediate receiving module is used to receive a storage request from a user terminal, and the storage request carries the location information of the user terminal; specifically, the location information is acquired by the user terminal calling the positioning module of the user terminal, and the intermediate receiving module is also used to receive the encrypted data transmitted by the user terminal.

[0065] The intermediate sending module is used to send the intermediate request and the location information of the user terminal to the backend server; after the user terminal sends the storage request to the intermediate sending module, the intermediate sending module sends the intermediate request and the location information carried in the storage request of the user terminal to the backend server;

[0066] The above-mentioned backend server includes a timestamp information generation module and a feedback module; wherein the timestamp information generation module is used to generate the local time timestamp information of the user terminal according to the location information of the user terminal and the timestamp information when the intermediate request is received; the local time timestamp information can be directly converted according to the latitude and longitude information in the location information, combined with the timestamp information when the backend server receives the intermediate request, that is, Beijing time. The feedback module is used to return feedback information to the intermediate server, and the feedback information carries the local time timestamp information of the user terminal.

[0067] The reading number generation module of the above-mentioned intermediate server is also used to generate a reading number according to the local time stamp information of the user terminal, and the encryption method matching module is used to match the corresponding encryption method in the encryption method sequence according to the reading number; the encryption method includes but is not limited to: RSA, DSA, ECC and DH encryption algorithms.

[0068] For example, after the backend server feeds back feedback information carrying the local time stamp information of the user terminal, the read number is generated according to the local time stamp information in the feedback information. Specifically, generating the read number according to the local time stamp information of the user terminal includes:

[0069] Calculate the sum of the minute digit and the second digit of the local time stamp information; add 1 to the remainder obtained by dividing the sum by the number of encryption methods in the encryption method sequence as the read number.

[0070] For example, the local time stamp information is 14:31:14 on July 30, 2022, where the minute digit is 31 and the second digit is 14, then the sum is 45. There are 6 encryption methods in the encryption method sequence, then the remainder 3 of the sum 45 divided by the number of encryption methods 6 plus 1, that is, 4 is taken as the reading number; then the encryption method ranked 4 in the encryption method sequence is used as the encryption method for encrypting the data.

[0071] In another embodiment, generating a reading number according to the local time stamp information of the user terminal includes:

[0072] The second digit of the local time stamp information is divided by the number of encryption methods in the encryption method sequence, and the remainder obtained by adding one to it is used as the read digit.

[0073] For example, the local time stamp information is 14:31:14 on July 30, 2022, where the second digit is 14. There are 6 encryption methods in the encryption method sequence. The remainder 2 of the second digit 14 divided by the number of encryption methods 6 plus 1, that is, 3, is taken as the reading number; the encryption method ranked 3 in the encryption method sequence is used as the encryption method for encrypting the data.

[0074] The intermediate sending module is also used to send the encryption method to the user end; after the user end receives the encryption method, the encryption module encrypts the data according to the encryption method, and then the user end sending module sends the encrypted data to the intermediate server;

[0075] In one embodiment, the intermediate server also includes an encryption package acquisition module, which is used to generate a corresponding encryption package according to the encryption method; that is, multiple encryption packages are pre-stored in the intermediate server, corresponding to multiple encryption methods. After obtaining the encryption method, the intermediate server retrieves the corresponding encryption package and sends it to the user end. After receiving the encryption package, the user end performs encryption operations on the data according to the encryption package.

[0076] The intermediate receiving module of the intermediate server receives the encrypted data, and then transfers the received encrypted data to the backend server through the intermediate sending module. The intermediate sending module is also used to send the above-mentioned read numbers to the backend server;

[0077] The backend server also includes a storage module and a decryption module; wherein the storage module is used to store data in the data storage module; the data storage module includes a plurality of sub-storage modules, the number of the plurality of sub-storage modules is the same as the number of the types of encryption methods, and the numbers of the plurality of sub-storage modules correspond one by one to the serial numbers of each encryption method in the encryption method sequence; that is, the number, the serial number and the read number correspond one by one. Specifically, the storage module stores the data in the sub-storage module whose number corresponds to the read number. Then, the decryption module of the backend server decrypts the data stored in the data storage module. Thus, the encrypted transmission of the data at the user end is realized, and the security of the network big data is improved.

[0078] This application also provides a method for the security management of network big data, referring to Figure 2 ,include:

[0079] S1. Receive a storage request from a user terminal, where the storage request carries location information of the user terminal;

[0080] S2, sending the intermediate request and the location information of the user terminal to the backend server;

[0081] S3, receiving feedback information, the feedback information carries the local time stamp information of the user end;

[0082] S4, generating a reading number according to the local time stamp information of the user terminal;

[0083] S5. Matching a corresponding encryption method in the encryption method sequence according to the read number;

[0084] S6, sending the encryption method to the user end, the user end encrypts the data according to the encryption method and sends it to the intermediate server;

[0085] S7: The received encrypted data is transferred to the backend server.

[0086] The specific definition of the network big data security management method can be found in the above definition of the network big data security management system, which will not be repeated here. Each step of the above network big data security management method can be implemented in whole or in part by software, hardware and their combination.

[0087] Various implementations of the systems and techniques described herein can be realized in digital electronic circuit systems, integrated circuit systems, dedicated ASICs (application specific integrated circuits), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0088] These computer programs (also referred to as programs, software, software applications, or code) include machine instructions for programmable processors and can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or means (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0089] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0090] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0091] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution disclosed in this application can be achieved, and this document is not limited here.

[0092] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A security management system for network big data, characterized in that: Includes user end, intermediate server, backend server, and data storage module; The intermediate server includes an intermediate receiving module, an intermediate sending module, a read digital generation module and an encryption mode matching module; The intermediate receiving module is used to receive a storage request from a user terminal, wherein the storage request carries the location information of the user terminal; The intermediate sending module is used to send the intermediate request and the location information of the user end to the backend server; The reading number generation module is used to generate a reading number according to the local time stamp information of the user terminal; The encryption mode matching module is used to match the corresponding encryption mode in the encryption mode sequence according to the read number; The intermediate sending module is also used to send the encryption method to the user end; The backend server includes a timestamp information generation module and a feedback module; The timestamp information generating module is used to generate the local timestamp information of the user terminal according to the location information of the user terminal and the timestamp information when the intermediate request is received; The feedback module is used to return feedback information to the intermediate server, and the feedback information carries the local time stamp information of the user terminal; The user end includes an encryption module and a user end sending module; Wherein, the encryption module is used to encrypt the data according to the encryption method; The user-side sending module is used to send the encrypted data to the intermediate server; The intermediate sending module is also used to transfer the received encrypted data to the backend server; The backend server also includes a storage module and a decryption module; Wherein, the storage module is used to store data in the data storage module; The decryption module is used to decrypt the data stored in the data storage module.

2. The network big data security management system according to claim 1, characterized in that: The generating of the reading number according to the local time stamp information of the user terminal includes: Calculate the sum of the minutes and seconds of the local time stamp information; The remainder obtained by dividing the sum by the number of encryption methods in the encryption method sequence plus one is used as the read number.

3. The network big data security management system according to claim 1, characterized in that: The generating of the reading number according to the local time stamp information of the user terminal includes: The second digit of the local time stamp information is divided by the number of encryption methods in the encryption method sequence, and the remainder obtained by adding one to it is used as the read digit.

4. The network big data security management system according to claim 1, characterized in that: The intermediate server also includes: An encryption program package acquisition module is used to generate a corresponding encryption program package according to the encryption method; The intermediate sending module is also used to send the encrypted program package to the user end; After receiving the encryption program package, the user terminal performs encryption operation on the data according to the encryption program package.

5. The network big data security management system according to claim 3, characterized in that: The intermediate sending module is also used to send the read numbers to the backend server; The data storage module includes a plurality of sub-storage modules, the number of the plurality of sub-storage modules is the same as the number of the types of encryption methods, and the numbers of the plurality of sub-storage modules correspond one by one to the sequence numbers of the encryption methods in the encryption method sequence; The storing of data in the data storage module comprises: The data is stored in the sub-storage module numbered corresponding to the read number.

6. The network big data security management system according to claim 4, characterized in that: The encryption methods include: RSA, DSA, ECC and DH.

7. The network big data security management system according to claim 1, characterized in that: The intermediate server is configured to be multiple, and the multiple intermediate servers are located in different sub-areas within the preset area; The intermediate server is used to communicate with the user terminals in the sub-area where the intermediate server is located.

8. A method for the security management of network big data, the method being applied to the network big data security management system as claimed in claim 1, characterized in that: include: receiving a storage request from a user terminal, wherein the storage request carries location information of the user terminal; Send the intermediate request and the location information of the user terminal to the backend server; receiving feedback information, wherein the feedback information carries local time stamp information of the user terminal; Generate a reading number according to the local time stamp information of the user terminal; Matching a corresponding encryption method in an encryption method sequence according to the read number; Sending the encryption method to the client, the client encrypts the data according to the encryption method and sends it to the intermediate server; The received encrypted data is transferred to the backend server.

Images