An office data encryption storage system and method based on the Internet

Abstract

The present invention discloses an office data encryption storage system and method based on the Internet, and relates to the field of encryption storage technology. The system comprises a data acquisition module, a data transmission module, an analysis and detection module, and a data storage module. The data acquisition module pre-processes and classifies the collected data, obtains sensitive data and its level in the data, and uses fingerprints for identity recognition. The technical key points are: corresponding data encryption means are used when collecting, transmitting and storing data, and in response to different actual scenarios during data transmission, a wireless transmission or a wired transmission mode is automatically selected by an identification switching unit, and a multi-layer security channel is established to ensure the privacy and integrity of the data, provide additional protection for the internal higher-level data, and combine the session key design dynamically generated between channels to further improve the security of the data.

Description

Technical Field

[0001] The present invention relates to the technical field of encrypted storage, and in particular to an Internet-based office data encrypted storage system and method. Background Art

[0002] Data encryption storage is a technology for protecting data security. It converts data into ciphertext using encryption algorithms and stores the ciphertext in storage media to prevent unauthorized visitors from obtaining or tampering with the data content. Data still needs to be collected and transmitted before it can be stored. For enterprises and organizations, data encryption storage can provide higher data security. Even if the storage medium is lost or stolen, attackers cannot obtain the true content of the data. Especially for sensitive personal information and business secrets, data encryption storage can effectively prevent data leakage and improper use.

[0003] The existing Chinese invention patent with application publication number CN114996737A and titled "A data processing method, device and storage medium" points out that the data processing method includes: the terminal device generates a first indication in response to a user operation or a timer trigger, obtains operation data acting on the design interface according to the first indication, and after encrypting the operation data, stores the processed operation data in the target storage space of the terminal device; the existing Chinese invention patent with authorization announcement number CN112118247B and titled "A method and system for encrypting vehicle network data" points out that during the process of encrypting vehicle network data, the encryption process of the first encryption node is executed with the encryption field set of the first encryption node, when the first encryption node is in an unencrypted marked state in the vehicle network data, the second encryption service of the second encryption node is obtained, and when it is determined based on the second encryption service that the second encryption node is not in the current encryption process of the first encryption node, at least the second encryption node is executed in the current encryption process of the first encryption node.

[0004] In the above application, when working in the office, although the data can be saved to prevent loss in the event of a network outage during office data storage, it is impossible to continue to complete subsequent data transmission and storage. At the same time, in the process of data storage, only the storage step is usually encrypted. Even if node encryption can be performed on multiple channels in data transmission, adjacent channels use the same encryption method, and the cracking process can be directly applied to other channels, greatly reducing the security of the entire data. Summary of the invention

[0005] 1. Technical issues to be solved

[0006] In view of the deficiencies in the prior art, the present invention provides an Internet-based office data encryption storage system and method, which adopts corresponding data encryption means when collecting, transmitting and storing data. In response to different actual scenarios during data transmission, the system automatically selects wireless transmission or wired transmission by identifying the switching unit, and establishes a multi-layer security channel to ensure the privacy and integrity of the data, provide additional protection for higher-level data inside, and combine the design of dynamically generated session keys between channels to further improve the security of the data and solve the problems raised in the background technology.

[0007] (II) Technical solution

[0008] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0009] An Internet-based office data encryption storage system and method, the system includes a data acquisition module, a data transmission module, an analysis and detection module, and a data storage module;

[0010] Among them, the data acquisition module collects data through the Internet of Things technology, pre-processes and classifies the collected data on the basis of the Internet of Things, obtains sensitive data and its level in the data, and uses fingerprints for identity recognition, and accesses sensitive data of corresponding levels according to the differential access rights granted by the user identity; the data transmission module determines whether there is a network environment by identifying the switching unit, and automatically switches to select the virtual channel sub-unit or the security channel sub-unit according to the result, and completes the transmission of the collected data; the analysis and detection module is used to extract n groups of collected sensitive data within a given cycle time, obtain and derive the predicted effective coefficient XYzs of the computer office data information after encrypted storage based on the integrity rate wz, access time T and transmission rate Vr corresponding to each group of data, and determine the validity of the computer office data information after encrypted storage by comparing the effective coefficient XYzs with the effective coefficient threshold; the data storage module encrypts and stores the analyzed data using hardware encryption technology.

[0011] Further, the data acquisition module includes a pre-processing unit, a primary classification unit, an identification unit, a secondary classification unit, a data encryption unit, and an access rights management unit which are executed in sequence;

[0012] Among them, the pre-processing unit cleans the collected data;

[0013] The first-level classification unit is used to initially classify the data according to the data type;

[0014] The recognition unit compares the initially classified data with the pre-labeled data in the database to identify and extract sensitive data;

[0015] The secondary classification unit uses machine learning algorithms to train the labeled sensitive data. Parallel technology is used during training to build a classification model. Predefined rules are set in the database simultaneously. Different sensitive data levels are defined according to the characteristics of sensitive data. Feature extraction technology is used in the classification model to obtain the sensitive data level.

[0016] Data encryption unit, which adopts corresponding encryption methods according to the level of sensitive data;

[0017] The access permission management unit formulates access control and permission management strategies during the data collection process, uses fingerprints for identity recognition, and accesses sensitive data of corresponding levels based on the differentiated access permissions granted according to the user's identity.

[0018] Furthermore, during the response period of the identification switching unit determining whether there is a network environment, the transition of the transmission data is completed by the cache subunit set under the identification switching unit. In a network environment, the virtual channel subunit is used by wireless transmission to establish a multi-layer security channel during data encryption transmission. The outermost channel performs data encryption transmission under the secure socket layer protocol, and the security channels correspond to sensitive data levels from low to high from the outside to the inside. The innermost channel is established using a virtual private network (VPN). A key negotiation protocol is also provided between the internal security channels, and the key exchange protocol dynamically generates session keys between the channels, and different keys are used between adjacent channels.

[0019] In an environment without a network, it switches to a stand-alone state and uses a secure channel subunit through wired transmission. The secure channel subunit includes several layers of wrapped ring channel lines and alarm lines buried between adjacent ring channel lines. Like the virtual channel subunit, the ring channel lines correspond to sensitive data levels from low to high from the outside to the inside. When any alarm line is broken, an alarm operation can be made within a response time of 0.05s.

[0020] Further, the analysis and detection module includes a timing unit, a collection setting unit, and a processing unit that are executed in sequence;

[0021] Wherein, the predetermined periodic detection time is set by the timing unit, and any n groups of data are extracted from the sensitive data collected in the data collection module by the collection setting unit. A prediction model is built in the processing unit, and the completeness rate wz corresponding to each group of data, the access time T of the corresponding data, and the transmission rate Vr of the corresponding data are used as parameters to obtain the predicted effective coefficient XYzs of the encrypted and stored computer office data information;

[0022] The steps to obtain and process the effective coefficients XYzs are as follows:

[0023] S101, normalize the completeness rate wz, the access time T and the transmission rate Vr of each group of data, and associate them to obtain the effective index Yzs;

[0024] Here is how:

[0025]

[0026] Wherein, α1, α2, and α3 are preset proportional coefficients of the completeness rate wz, the access time T, and the transmission rate Vr, respectively, and α1, α2, and α3 are all greater than 0, and G1 is a constant correction coefficient.

[0027] S102, obtaining n groups of effective indexes Yzs to establish a data set, marking the data set as P, then P = Yzs} = {Yzs1, Yzs2, ..., Yzsn}, n is a positive integer, calculating the average value of the n groups of effective indexes Yzs, which is the effective coefficient XYzs of the computer office data information after encryption and storage;

[0028] Here is how:

[0029]

[0030] In the formula, n≥10, if the effective coefficient XYzs is larger, the effectiveness of the computer office data information after encrypted storage is higher;

[0031] S103, comparing the effective coefficient XYzs with the effective coefficient threshold;

[0032] If the effective coefficient XYzs is greater than or equal to the effective coefficient threshold, it means that the computer office data information is highly effective after encrypted storage, and subsequent data storage can be directly performed; if the effective coefficient XYzs is less than the effective coefficient threshold, it means that the computer office data information is less effective after encrypted storage, and data collection needs to be performed again to achieve a cycle processing; if after at least three cycles of processing, the effective coefficient XYzs is still less than the effective coefficient threshold, an alarm operation is performed, and relevant repair strategies are executed after an overall inspection of the system.

[0033] Furthermore, the hardware encryption technology used in the data storage module is: encrypting the data on the hard disk through a hardware encryption chip.

[0034] An Internet-based office data encryption storage method comprises the following steps:

[0035] Step 1: After collecting computer office data, pre-process and classify the collected data to obtain sensitive data and its level in the data, and use fingerprints for identity recognition to access sensitive data of corresponding levels based on the differential access rights granted by the user identity;

[0036] Step 2: Before transmitting the collected data, it is necessary to determine whether there is a network environment, and automatically switch to select a virtual data transmission channel or an actual secure transmission channel according to the result;

[0037] If in a network environment, data encryption is performed through wireless transmission, and a multi-layer security channel is established during data encryption transmission. The outermost channel performs data encryption transmission under the secure socket layer protocol, and the security channels correspond to the sensitive data levels from low to high from the outside to the inside. The innermost channel is established using a virtual private network, and a key negotiation protocol is also set between the internal security channels to dynamically generate session keys between adjacent channels;

[0038] If it is in an environment without network, it will switch to stand-alone state, and use each ring channel line in the security channel subunit to encrypt data transmission through wired transmission. Since alarm lines are set between adjacent ring channel lines, when any alarm line 102 is broken, the disconnection alarm will be triggered;

[0039] Step 3: extract n groups of collected sensitive data within a given period, obtain and derive the predicted validity coefficient XYzs of the computer office data information after encryption and storage based on the integrity rate wz, access time T and transmission rate Vr corresponding to each group of data;

[0040] Step 4. By comparing the effective coefficient XYzs with the effective coefficient threshold, if the effective coefficient XYzs is greater than or equal to the effective coefficient threshold, it means that the computer office data information is highly effective after encrypted storage, and subsequent data storage operations can be performed directly; if the effective coefficient XYzs is less than the effective coefficient threshold, it means that the computer office data information is poor in effectiveness after encrypted storage, and the data collection work in step 1 needs to be repeated.

[0041] (III) Beneficial effects

[0042] The present invention provides an Internet-based office data encryption storage system and method, which has the following beneficial effects:

[0043] In the process of collecting computer office data, two classification operations are implemented to obtain sensitive data and its level, which is convenient for subsequent access to sensitive data of corresponding levels according to user permissions, and improves the security based on the Internet of Things from the two aspects of identity recognition and access control;

[0044] Corresponding data encryption methods are used when collecting, transmitting and storing data. During collection, the data encryption unit is used to adopt different degrees of encryption methods according to the level of sensitive data. During transmission, multi-layer security channels or actual transmission cables are automatically selected according to the presence or absence of a network. Hardware encryption technology is used during storage, which is safer than software encryption. Encryption protection is performed at all links, further improving data security.

[0045] In response to different actual scenarios during data transmission, the identification switching unit automatically selects wireless transmission or wired transmission to avoid data transmission failure. At the same time, a multi-layer security channel is established to ensure the privacy and integrity of data, and provide additional protection for higher-level data inside. Combined with the design of dynamically generated session keys between channels, mutual interference between channels is avoided. Even if an attacker cracks the encryption of the outer channel, it cannot be directly applied to other channels. The overall design increases the difficulty for attackers to steal and steal. Combined with the use of the security channel sub-unit, it can provide protection for data transmission from both software and hardware directions;

[0046] The newly designed analysis and detection module can complete the verification operation before data storage. By building a prediction model, the validity of computer office data information can be judged, thereby indirectly verifying the practicality of the entire encrypted storage system. If the validity of the computer office data information is judged to be strong, it can be determined that the entire encrypted storage system is practical, and the data collection and transmission are carried out within the error range, which has promotion value. If the validity of the computer office data information is judged to be poor, the cycle operation can be performed again to avoid prediction errors. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a block diagram of the overall structure of the Internet-based office data encryption storage system of the present invention;

[0048] Figure 2 It is a structural flow chart of a data acquisition module in the Internet-based office data encryption storage system of the present invention;

[0049] Figure 3 It is a structural flow chart of a data transmission module in the Internet-based office data encryption storage system of the present invention;

[0050] Figure 4 It is a cross-sectional view of a security channel subunit in the Internet-based office data encryption storage system of the present invention;

[0051] Figure 5 It is a structural flow chart of the analysis and detection module and the data storage module in the Internet-based office data encryption storage system of the present invention;

[0052] Figure 6 The present invention is a flow chart of the method for encrypting and storing office data based on the Internet.

[0053] Legend: 10, safety channel subunit; 101, ring channel line; 102, alarm line. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] Embodiment 1:

[0056] See also Figure 1-Figure 5 The present invention provides an Internet-based office data encryption storage system and method, the system comprising:

[0057] The data collection module includes a pre-processing unit, a primary classification unit, an identification unit, a secondary classification unit, a data encryption unit, and an access rights management unit, which are executed in sequence; the data collection module collects data through the Internet of Things technology, and is used to pre-process and classify the collected data, obtain sensitive data and its level in the data, and use fingerprints for identity recognition, and access sensitive data of corresponding levels according to the differential access rights granted by the user identity;

[0058] It should be noted that the Internet of Things technology is a technology that connects physical devices, sensors and networks. Through the Internet of Things technology, real-time monitoring and remote control of equipment can be achieved, and data collection is one of the important application scenarios. Specifically, the data collected by the sensor or the network computer office data can be transmitted to the data center through the Internet of Things gateway. The transmission can be through wireless technology such as Wi-Fi, Bluetooth or 4G / 5G network, and wired transmission can be selected as needed.

[0059] Among them, the pre-processing unit cleans the collected data, and the primary classification unit performs preliminary classification of the data according to the data type. Then, the identification unit compares the preliminary classified data with the pre-marked data in the database to identify and extract sensitive data. The secondary classification unit uses the machine learning algorithm to train the marked sensitive data. Parallel technology is used during training to build a classification model. Predefined rules are set in the database simultaneously. Different sensitive data levels are defined according to the characteristics of sensitive data. Feature extraction technology is used in the classification model to obtain the sensitive data level. Then, the data encryption unit adopts the corresponding encryption method according to the sensitive data level.

[0060] The above-mentioned design using a primary classification unit, an identification unit, and a secondary classification unit can implement two classification operations in the process of collecting computer office data, thereby obtaining sensitive data and its level, facilitating subsequent access to sensitive data of corresponding levels according to user permissions, and improving security based on the Internet of Things from the two aspects of identity recognition and access control.

[0061] For example: sensitive data is divided into sensitive level, secret level, confidential level and top secret level. The encryption method corresponding to the sensitive level is the DES symmetric algorithm. This algorithm has standard data encryption and is fast, and is suitable for encrypting large amounts of data; the secret level corresponds to the 3DES symmetric algorithm, which is a symmetric algorithm based on DES. It encrypts a piece of data three times with three different keys, which is more powerful; the confidential level corresponds to the IDEA data encryption algorithm, which uses a 128-bit key to provide very strong security; the top secret level corresponds to the AES algorithm, which uses the advanced encryption standard's symmetric algorithm, and is the next generation of encryption algorithm standard with fast speed and higher security level.

[0062] Finally, the access rights management unit is used. During the data collection process, access control and rights management strategies need to be formulated.

[0063] Fingerprints are used for identity recognition, and sensitive data of corresponding levels are accessed based on the differential access rights granted by the user's identity. For example, if user A is granted an access level of S, the sensitive data he can access is top secret. If user B is granted an access level of A, the sensitive data he can access is confidential.

[0064] The data transmission module switches and selects the virtual channel subunit and the secure channel subunit by identifying the switching unit according to different network environments;

[0065] Among them, during the response period of the identification switching unit determining whether there is a network environment, the transition of the transmission data is completed by the cache subunit set under the identification switching unit. The cache subunit here is to compensate for the short interruption of data transmission during the response period of the identification switching unit, and can ensure the stability of data transmission. Usually, the duration of the response period of the identification switching unit is between 0.5ms and 1ms. In an environment with a network, a virtual channel subunit is used by wireless transmission. A multi-layer security channel is established during data encryption transmission. The data is transmitted through the multi-layer security channel in the transition in the cache subunit. The outermost channel performs data encryption transmission under the secure socket layer protocol, and the security channels correspond to sensitive data levels from low to high from the outside to the inside. The innermost channel is established using a virtual private network (VPN), and a key negotiation protocol is also provided between the internal security channels; a key exchange protocol (such as Diffie-Hellman key exchange) is used to dynamically generate session keys between channels, and different keys are used between adjacent channels, so that even if an attacker cracks the encryption of one channel, it cannot be directly applied to other channels, which plays an encryption protection role from the software direction;

[0066] In response to different actual scenarios during data transmission, the identification switching unit automatically selects wireless transmission or wired transmission to avoid data transmission failure. At the same time, a multi-layer security channel is established to ensure the privacy and integrity of the data, and provide additional protection for higher-level data inside. Combined with the design of dynamically generated session keys between channels, mutual interference between channels is avoided. Even if an attacker cracks the encryption of the outer channel, it cannot be directly applied to other channels. The overall design increases the difficulty for attackers to infiltrate and steal. Combined with the use of security channel sub-units, data transmission can be protected from both software and hardware directions.

[0067] It should be noted that multi-layered security channels can not only transmit data in a targeted manner, but also increase the difficulty for attackers to attack and steal data. Even if the outermost encryption channel is cracked, the attacker needs to overcome additional security obstacles to enter the next inner channel, thereby protecting the security of sensitive data.

[0068] In an environment without a network, it is necessary to switch to a stand-alone state and use the secure channel subunit 10 through wired transmission. The secure channel subunit 10 includes a plurality of ring channel lines 101 wrapped in layers and an alarm line 102 buried between adjacent ring channel lines 101. Similar to the virtual channel subunit, the ring channel lines 101 correspond to sensitive data levels from low to high from the outside to the inside. When any alarm line 102 is disconnected, an alarm operation is performed within a response time of 0.05s. Since each alarm line 102 is connected to a disconnection alarm, when the alarm line 102 is manually disconnected, the disconnection alarm is triggered to alert the staff, thereby playing an encryption protection role from the hardware direction.

[0069] Specifically, from the attached Figure 4 It can be seen that the various alarm lines 102 are also distributed in a staggered manner, which can prevent eavesdroppers from completing data theft operations by simply digging a hole to connect to the internal lines. The entire security channel subunit 10 is actually a cable, and the multi-layer wrapping can also play a protective role.

[0070] The analysis and detection module includes a timing unit, a collection setting unit, and a processing unit which are executed in sequence;

[0071] The timing unit sets the periodic detection time, and uses the collection setting unit within the predetermined periodic time to extract any n groups of data from the sensitive data collected by the data collection module, where n≥10, and obtain the integrity rate wz, the access time T of the corresponding data, and the transmission rate Vr of the corresponding data corresponding to each group of data;

[0072] Among them, the completeness rate wz corresponding to each set of data is obtained as follows:

[0073] Hash verification method: A unique value (hash value) of a fixed length can be generated by the hash algorithm to represent the data. After the corresponding data is transmitted, the hash value of the transmitted data can be recalculated and compared with the hash value provided during collection. The obtained ratio is the completeness rate wz;

[0074] The access time T of the data is obtained by setting an access log function in the access permission management unit to record the access request and response time, thereby obtaining the access time of the data;

[0075] The transmission rate Vr of the corresponding data can be obtained by observing the data flow using a network monitoring tool, and the transmission rate Vr of the corresponding data can be directly obtained. Commonly used network monitoring tools include Wireshark or NetFlow.

[0076] Finally, by building a prediction model in the processing unit, taking the completeness rate wz corresponding to each set of data, the access time T of the corresponding data, and the transmission rate Vr of the corresponding data as parameters, the effective coefficient XYzs of the predicted encrypted and stored computer office data information is obtained;

[0077] The steps to obtain the effective coefficients XYzs are as follows:

[0078] S101, normalize the completeness rate wz, the access time T and the transmission rate Vr of each group of data, and associate them to obtain the effective index Yzs;

[0079] Here is how:

[0080]

[0081] Wherein, α1, α2, and α3 are preset proportional coefficients of the completeness rate wz, the access time T, and the transmission rate Vr, respectively, and α1, α2, and α3 are all greater than 0, and G1 is a constant correction coefficient.

[0082] S102, obtaining n groups of effective indexes Yzs to establish a data set, marking the data set as P, then P = Yzs} = {Yzs1, Yzs2, ..., Yzsn}, n is a positive integer, calculating the average value of the n groups of effective indexes Yzs, which is the effective coefficient XYzs of the computer office data information after encryption and storage;

[0083] Here is how:

[0084]

[0085] In the formula, n≥10, if the effective coefficient XYzs is larger, the effectiveness of the computer office data information after encrypted storage is higher;

[0086] S103, comparing the effective coefficient XYzs with the effective coefficient threshold;

[0087] If the effective coefficient XYzs is greater than or equal to the effective coefficient threshold, it means that the computer office data information is highly effective after encrypted storage, and subsequent data storage can be directly performed; if the effective coefficient XYzs is less than the effective coefficient threshold, it means that the computer office data information is poorly effective after encrypted storage, and data collection needs to be performed again to achieve a one-cycle processing;

[0088] The above-mentioned additionally designed analysis and detection module can complete the verification operation before data storage. By building a prediction model, it can determine the validity of computer office data information, thereby indirectly verifying the practicality of the entire encrypted storage system. If the validity of the computer office data information is determined to be strong, then it can be determined that the entire encrypted storage system is practical, and the data is collected and transmitted within the error range, which has promotion value. If the validity of the computer office data information is determined to be poor, the cycle operation can be performed again to avoid prediction errors.

[0089] If the effective coefficient XYzs is still less than the effective coefficient threshold after at least three cycles of processing, an alarm operation is performed, and relevant repair strategies are executed after an overall inspection of the system;

[0090] Specifically, the corresponding problems are usually discovered through network security scanning and analysis of data storage logs. For example: if incorrect configuration of the encryption algorithm or key management problems are detected, system inspection, log analysis and error troubleshooting are required to repair them; if key leakage or loss occurs, it is necessary to generate new keys, update the key distribution mechanism or adopt a more secure key management solution to repair it; if the data in the encrypted storage system is lost or damaged, it is necessary to use the backup data in the data storage module or use data recovery tools to repair it.

[0091] The data storage module encrypts and stores the analyzed data using hardware encryption technology. Specifically, the data on the hard disk is encrypted through a hardware encryption chip, such as the TCG Opal standard and Self-Encrypting Drive (SED) technology. Since hardware encryption uses a dedicated encryption chip to handle data encryption and decryption, it is more secure than software encryption.

[0092] To summarize, corresponding data encryption methods are used when collecting, transmitting and storing data. During collection, the data encryption unit is used to adopt different degrees of encryption methods according to the level of sensitive data. During transmission, the multi-layer security channel or actual transmission cable is automatically selected according to whether there is a network or not. Hardware encryption technology is used during storage, which is safer than software encryption. Encryption protection is performed at each link, further improving the security of the data.

[0093] Embodiment 2:

[0094] See also Figure 6 The present invention provides an Internet-based office encryption storage method, comprising the following steps:

[0095] Step 1: After collecting computer office data, pre-process and classify the collected data to obtain sensitive data and its level in the data, and use fingerprints for identity recognition to access sensitive data of corresponding levels based on the differential access rights granted by the user identity;

[0096] Step 2: Before transmitting the collected data, it is necessary to determine whether there is a network environment, and automatically switch to select a virtual data transmission channel or an actual secure transmission channel according to the result;

[0097] If in a network environment, data encryption is performed through wireless transmission, and a multi-layer security channel is established during data encryption transmission. The outermost channel performs data encryption transmission under the secure socket layer protocol, and the security channels correspond to the sensitive data levels from low to high from the outside to the inside. The innermost channel is established using a virtual private network, and a key negotiation protocol is also set between the internal security channels to dynamically generate session keys between adjacent channels;

[0098] If it is in an environment without a network, it switches to a stand-alone state, and uses each ring channel line 101 in the security channel subunit 10 to perform data encryption transmission through wired transmission. Since an alarm line 102 is set between adjacent ring channel lines 101, when any alarm line 102 is broken, the disconnection alarm is triggered;

[0099] Step 3: extract n groups of collected sensitive data within a given period, obtain and derive the predicted validity coefficient XYzs of the computer office data information after encryption and storage based on the integrity rate wz, access time T and transmission rate Vr corresponding to each group of data;

[0100] Step 4. By comparing the effective coefficient XYzs with the effective coefficient threshold, if the effective coefficient XYzs is greater than or equal to the effective coefficient threshold, it means that the computer office data information is highly effective after encrypted storage, and subsequent data storage operations can be performed directly; if the effective coefficient XYzs is less than the effective coefficient threshold, it means that the computer office data information is poor in effectiveness after encrypted storage, and the data collection work in step 1 needs to be repeated.

[0101] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product. A person of ordinary skill in the art may appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein may be implemented in electronic hardware, or in a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution.

[0102] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, and may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0103] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. An office data encryption storage system based on the Internet of Things, characterized in that: The system includes: The data collection module collects data through the Internet of Things technology, pre-processes and classifies the collected data, obtains sensitive data and its level in the data, and uses fingerprints for identity recognition, and accesses sensitive data of corresponding levels based on the differential access rights granted by the user identity; The data transmission module determines whether there is a network environment by identifying the switching unit, automatically switches to select the virtual channel subunit or the secure channel subunit according to the result, and completes the transmission of the collected data; The analysis and detection module is used to extract n groups of collected sensitive data within a given cycle time, obtain and derive the predicted validity coefficient XYzs of the computer office data information after encrypted storage based on the integrity rate wz, access time T and transmission rate Vr corresponding to each group of data, and determine the validity of the computer office data information after encrypted storage by comparing the validity coefficient XYzs with the validity coefficient threshold; The analysis and detection module includes a timing unit, a collection setting unit and a processing unit which are executed in sequence; Wherein, the periodic detection time is set by the timing unit at a predetermined periodic time, and the extraction of any n groups of data from the sensitive data collected in the data collection module is realized by the collection setting unit; A prediction model is built in the processing unit, and the completeness rate wz corresponding to each group of data, the access time T of the corresponding data, and the transmission rate Vr of the corresponding data are used as parameters to obtain the predicted effective coefficient XYzs of the encrypted and stored computer office data information; The steps to obtain and process the effective coefficients XYzs are as follows: S101, normalize the completeness rate wz, the access time T and the transmission rate Vr of each group of data, and associate them to obtain the effective index Yzs; Here is how: Wherein, α1, α2, α3 are preset proportional coefficients of the completeness rate wz, access time T and transmission rate Vr respectively, and α1, α2, α3 are all greater than 0, and G1 is a constant correction coefficient; S102, obtaining n groups of effective indexes Yzs to establish a data set, marking the data set as P, then P = {Yzs} = Yzs1, Yzs2, ..., Yzsn}, n is a positive integer, calculating the average value of the n groups of effective indexes Yzs, which is the effective coefficient XYzs of the computer office data information after encryption and storage; Here is how: In the formula, n≥10, if the effective coefficient XYzs is larger, the effectiveness of the computer office data information after encrypted storage is higher; S103, comparing the effective coefficient XYzs with the effective coefficient threshold; If the effective coefficient XYzs is greater than or equal to the effective coefficient threshold, it means that the computer office data information is highly effective after encrypted storage, and subsequent data storage can be directly performed; if the effective coefficient XYzs is less than the effective coefficient threshold, it means that the computer office data information is poorly effective after encrypted storage, and data collection needs to be performed again to achieve a one-cycle processing; The data storage module uses hardware encryption technology to encrypt and store the analyzed data.

2. According to claim 1, an office data encryption storage system based on the Internet of Things is characterized by: The data acquisition module includes a pre-processing unit, a primary classification unit, an identification unit, a secondary classification unit, a data encryption unit, and an access rights management unit which are executed in sequence; Among them, the preprocessing unit cleans the collected data, and the data is initially classified by the primary classification unit according to the data type. Then, the identification unit compares the initially classified data with the pre-marked data in the database to identify and extract sensitive data. The secondary classification unit uses a machine learning algorithm to train the marked sensitive data. Parallel technology is used during training to build a classification model. Predefined rules are simultaneously set in the database. Different sensitive data levels are defined according to the characteristics of the sensitive data. Feature extraction technology is used in the classification model to obtain the sensitive data level. Then, the data encryption unit takes corresponding encryption methods according to the sensitive data level.

3. According to claim 2, an office data encryption storage system based on the Internet of Things is characterized in that: The access permission management unit formulates access control and permission management strategies during the data collection process, uses fingerprints for identity recognition, and accesses sensitive data of corresponding levels based on differential access permissions granted by user identities.

4. According to the Internet of Things-based office data encryption storage system of claim 1, it is characterized by: During the response period of the identification switching unit determining whether there is a network environment, the transition of the transmitted data is completed by the cache subunit provided under the identification switching unit. When it is determined that there is a network environment, the virtual channel subunit is used through wireless transmission to establish a multi-layer security channel during data encryption transmission. The outermost channel performs data encryption transmission under the secure socket layer protocol, and the security channels correspond to sensitive data levels from low to high from the outside to the inside. The innermost channel is established using a virtual private network, and a key negotiation protocol is also provided between the internal security channels, and the key exchange protocol dynamically generates session keys between channels, and different keys are used between adjacent channels.

5. The office data encryption storage system based on the Internet of Things according to claim 4 is characterized in that: In an environment without a network, the system switches to a stand-alone state and uses a secure channel subunit (10) through wired transmission. The secure channel subunit (10) includes a plurality of ring channel lines (101) wrapped in layers and an alarm line (102) buried between adjacent ring channel lines (101). Similar to the virtual channel subunit, the ring channel lines (101) correspond to sensitive data levels from low to high from outside to inside. When any alarm line (102) is disconnected, an alarm operation can be made within a response time of 0.05 seconds.

6. The office data encryption storage system based on the Internet of Things according to claim 1 is characterized in that: In S103, if the effective coefficient XYzs is still less than the effective coefficient threshold after at least three cycles of processing, an alarm operation is performed, and a related repair strategy is executed after an overall inspection of the system.

7. The office data encryption storage system based on the Internet of Things according to claim 1 is characterized in that: The hardware encryption technology used in the data storage module is: encrypting the data on the hard disk through a hardware encryption chip.

8. An office data encryption storage method based on the Internet of Things, using any system described in claims 1 to 7, characterized in that: The steps include: Step 1: After collecting computer office data, pre-process and classify the collected data to obtain sensitive data and its level in the data, and use fingerprints for identity recognition to access sensitive data of corresponding levels based on the differential access rights granted by the user identity; Step 2: Before transmitting the collected data, it is necessary to determine whether there is a network environment, and automatically switch to select a virtual data transmission channel or an actual secure transmission channel according to the result; If in a network environment, data encryption is performed through wireless transmission, and a multi-layer security channel is established during data encryption transmission. The outermost channel performs data encryption transmission under the secure socket layer protocol, and the security channels correspond to the sensitive data levels from low to high from the outside to the inside. The innermost channel is established using a virtual private network, and a key negotiation protocol is also set between the internal security channels to dynamically generate session keys between adjacent channels; If it is in an environment without a network, it switches to a stand-alone state and uses each annular channel line (101) in the safety channel subunit (10) to perform data encryption transmission through wired transmission. Since an alarm line (102) is set between adjacent annular channel lines (101), when any alarm line (102) is disconnected, a disconnection alarm is triggered; Step 3: extract n groups of collected sensitive data within a given period, obtain and derive the predicted validity coefficient XYzs of the computer office data information after encryption and storage based on the integrity rate wz, access time T and transmission rate Vr corresponding to each group of data; Step three includes a timing unit, a collection setting unit, and a processing unit that are executed in sequence; Wherein, the periodic detection time is set by the timing unit at a predetermined periodic time, and the extraction of any n groups of data from the sensitive data collected in step 1 is realized by the collection setting unit; A prediction model is built in the processing unit, and the completeness rate wz corresponding to each group of data, the access time T of the corresponding data, and the transmission rate Vr of the corresponding data are used as parameters to obtain the predicted effective coefficient XYzs of the encrypted and stored computer office data information; The steps to obtain and process the effective coefficients XYzs are as follows: S101, normalize the completeness rate wz, the access time T and the transmission rate Vr of each group of data, and associate them to obtain the effective index Yzs; Here is how: Wherein, α1, α2, α3 are preset proportional coefficients of the completeness rate wz, access time T and transmission rate Vr respectively, and α1, α2, α3 are all greater than 0, and G1 is a constant correction coefficient; S102, obtaining n groups of effective indexes Yzs to establish a data set, marking the data set as P, then P = {Yzs} = Yzs1, Yzs2, ..., Yzsn}, n is a positive integer, calculating the average value of the n groups of effective indexes Yzs, which is the effective coefficient XYzs of the computer office data information after encryption and storage; Here is how: In the formula, n≥10, if the effective coefficient XYzs is larger, the effectiveness of the computer office data information after encrypted storage is higher; S103, comparing the effective coefficient XYzs with the effective coefficient threshold; If the effective coefficient XYzs is greater than or equal to the effective coefficient threshold, it means that the computer office data information is highly effective after encrypted storage, and subsequent data storage can be directly performed; if the effective coefficient XYzs is less than the effective coefficient threshold, it means that the computer office data information is poorly effective after encrypted storage, and data collection needs to be performed again to achieve a one-cycle processing; Step 4. By comparing the effective coefficient XYzs with the effective coefficient threshold, if the effective coefficient XYzs is greater than or equal to the effective coefficient threshold, it means that the computer office data information is highly effective after encrypted storage, and subsequent data storage operations can be performed directly; if the effective coefficient XYzs is less than the effective coefficient threshold, it means that the computer office data information is poor in effectiveness after encrypted storage, and the data collection work in step 1 needs to be repeated.

Images