Cloud storage data security defense system and method based on cloud terminal

Abstract

The present invention discloses a cloud storage data security defense system and method based on a cloud terminal, and relates to the technical field of data storage. The method discloses the following steps: step one: uploading the data of the cloud terminal to a selected encryption terminal; step two: after the data is uploaded, the selected encryption terminal encrypts the data; step three: patrolling and auditing the cloud storage terminal in the cloud server, and determining whether the cloud storage data in the cloud storage terminal is defense-enhanced data during the patrol and audit process; step four: after the defense-enhanced data appears in the cloud storage terminal, transferring and re-encrypting the corresponding defense-enhanced data. The method of the present invention analyzes the selected encryption terminal of the data through two different upload analysis methods, ensures that the data uploaded by the cloud terminal is reasonably and securely encrypted, and flexibly adjusts and encrypts each cloud storage data on the basis of ensuring the security of the cloud storage data.

Description

Technical Field

[0001] The present invention relates to the field of data storage technology, and more specifically, to a cloud storage data security defense system and method based on a cloud terminal. Background Art

[0002] The cloud server contains multiple cloud terminals and cloud storage terminals. The cloud storage terminals have different encryption capabilities. After the data uploaded from the cloud terminal is stored in the cloud storage terminal, the cloud storage terminal will encrypt it. After the data is encrypted and stored in the cloud storage terminal, unless the user actively adjusts the storage, the data will not be stored again in another cloud storage terminal, which may easily cause potential security issues for the data. How to ensure the reasonable encryption storage and storage transfer of cloud storage data is an urgent problem to be solved. Summary of the invention

[0003] In view of the deficiencies in the prior art, the object of the present invention is to provide a cloud storage data security defense system and method based on a cloud terminal.

[0004] To achieve the above object, the present invention provides the following technical solutions:

[0005] Cloud storage data security defense system based on cloud terminals, including security encryption module, defense audit module, and data transfer module;

[0006] The security encryption module is used to upload the data of the cloud terminal to the selected encryption end, and the selected encryption end encrypts the data after uploading;

[0007] The defense audit module is used to perform patrol audit on the cloud storage end in the cloud server, and determine whether the cloud storage data in the cloud storage end is defense enhancement data during the patrol audit process;

[0008] The data transfer module is used to transfer and re-encrypt the corresponding defense improvement data after the defense improvement data appears in the cloud storage end.

[0009] Furthermore, each time the cloud terminal uploads data, the data is uploaded to the selected encryption end. After uploading, the selected encryption end encrypts the data, and the encrypted cloud storage data is obtained, and a data encryption log of the selected encryption end is generated. The data encryption log includes the encryption start time and encryption duration.

[0010] Furthermore, the selected encryption end is obtained by:

[0011] At every interval of t, the cloud terminal obtains the terminal upload value of the cloud terminal and sets the terminal upload limit value. When the terminal upload value is greater than or equal to the terminal upload limit value, the terminal upload value is calculated to be different from the terminal upload limit value to obtain the upload level value Sk, k=1, 2, ..., k, where S1<S2<...<Sk. The encryption strength level is obtained according to the upload level value and the encryption strength level is marked as the target strength level.

[0012] Each upload level value range corresponds to an encryption strength level. The upload level value range is [0, S1], (S1, S2], …, (Sk-1, Sk], and the encryption strength levels include encryption strength level 1, encryption strength level 2, …, encryption strength level k-1, encryption strength level k. The larger the encryption strength level value, the higher the encryption strength.

[0013] Obtain the current location of the cloud terminal, draw a circle with a preset radius R to obtain the cloud encryption range, obtain the encryption strength level of each cloud storage terminal within the cloud encryption range, mark the cloud storage terminal with the target encryption strength level as the target encryption terminal, obtain the location of the target encryption terminal, calculate the distance difference between the location of the target encryption terminal and the current location of the cloud terminal to obtain the encryption distance, and mark the target encryption terminal with the smallest encryption distance as the selected encryption terminal;

[0014] When the terminal upload value is less than the terminal upload limit value, no corresponding processing is performed. The current position of the cloud terminal is obtained, and a circle with a preset radius r and the current position of the cloud terminal as the center is drawn to obtain the cloud storage range. Each cloud storage terminal within the cloud storage range is marked as a target storage terminal, and the priority storage value of the target storage terminal is obtained. The target storage terminal with the largest priority storage value is marked as the selected encryption terminal.

[0015] Furthermore, the terminal upload value of the cloud terminal is obtained by:

[0016] Get all the access audit logs of the system within the time interval of t, get the cloud terminal number of the access audit log, mark the access audit log of the cloud terminal with this number as the same audit log, sort all the same audit logs in the order of access time, calculate the difference between the access audit values ​​of the two adjacent same audit logs after sorting, get the access audit fluctuation value, set the access audit fluctuation threshold, when the access audit fluctuation value is greater than or equal to the access audit fluctuation threshold, increase the audit fluctuation times by one, sum up all the audit fluctuation times, and get the total audit fluctuation times , sum up the access audit values ​​of the two adjacent audit logs with the same code after sorting, get the same code audit sum value, set the same code audit threshold and value, when the same code audit sum value is greater than or equal to the same code audit threshold and value, increase the number of consecutive anomalies by one, sum up all the consecutive anomalies, and get the total number of consecutive anomalies , using the formula The terminal upload value Sc of the cloud terminal is obtained, where b1 is the total number of audit fluctuations coefficient and b2 is the total number of continuous anomalies coefficient.

[0017] Furthermore, the priority storage value of the target storage end is obtained by the following method: obtain all data encryption logs of the target storage end within the time interval t, sum up the encryption time of all data encryption logs, and obtain the total encryption time , sort the data encryption logs according to the encryption start time, sum the encryption durations of two adjacent data encryption logs after sorting, get the adjacent encryption duration, set the adjacent encryption threshold and duration, when the adjacent encryption duration is greater than or equal to the adjacent encryption threshold and duration, increase the pressure encryption times by one, when the adjacent encryption duration is less than the adjacent encryption threshold and duration, do not do the corresponding processing, sum all the pressure encryption times, get the total pressure encryption times Sm, use the formula Get the priority storage value of the target storage end.

[0018] Furthermore, at intervals of T, patrol audits are performed on the cloud storage terminals in the cloud server. Each time a cloud storage terminal is audited, the security defense value of each cloud storage data in the cloud storage terminal is obtained, and a security defense limit is set. When the security defense value of the cloud storage data is greater than or equal to the security defense limit, the cloud storage data is marked as defense-enhanced data. When the security defense value of the cloud storage data is less than the security defense limit, no corresponding processing is performed.

[0019] Furthermore, the security defense value of the cloud storage data is obtained by the following method: obtaining all access audit logs generated by the cloud storage data within T time, obtaining the access audit value of the access audit log, summing up the access audit values ​​of all access audit logs and taking the average, to obtain the average access audit value , set the access audit threshold, when the access audit value of the access audit log is greater than or equal to the access audit threshold, mark the access audit log as a special audit day log, sort all special audit day logs in the order of access time, calculate the time difference between the access times of two adjacent special audit day logs after sorting, and get the special audit time difference, sum up all special audit time differences and take the average to get the average special audit time difference , using the formula The security defense value Lp of cloud storage data is obtained, where a1 is the average access audit value coefficient and a2 is the average special audit time difference coefficient.

[0020] Furthermore, the access audit log is obtained in the following manner: when the cloud storage data on the cloud storage terminal is accessed, an access audit log of the cloud storage data is generated, the access audit log includes the cloud terminal number, access time, and access audit value, and the access audit value of the access audit log is obtained in the following manner: when the cloud storage data is accessed, a preset period interval is set, and at each period node, the access behavior data generated during the access process in the current period is obtained, and features are extracted from the access behavior data to obtain access behavior feature data, and the access behavior feature data is input into the access behavior model to obtain the access behavior value, and a rectangular coordinate system is constructed with the access duration of the cloud storage data as the X-axis and the access behavior value as the Y-axis, and an access behavior polyline is drawn in the rectangular coordinate system through the access behavior value corresponding to the period node, and two vertical line segments are obtained by drawing perpendicular lines from the two end points of the access behavior polyline to the X-axis, and a graph is formed by the access behavior polyline, the two vertical line segments, and the X-axis, and the total area of ​​the graph is marked as the access audit value.

[0021] Furthermore, when defense enhancement data appears in the cloud storage terminal, the cloud storage terminal is marked as a security output terminal, and a circle with a preset radius d and the security output terminal as the center is drawn to obtain the security output range. The remaining cloud storage terminals within the security output range are marked as pre-selected input terminals, and the encryption strength level of the pre-selected input terminal is calculated to differ from the encryption strength level of the security output terminal to obtain the strength level difference. A strength level threshold difference is set. When the strength level difference is greater than or equal to the strength level threshold difference, the pre-selected input terminal is marked as a sub-selected input terminal, and the distance difference between the position of the sub-selected input terminal and the position of the security output terminal is calculated to obtain the transfer distance. The sub-selected input terminal with the smallest transfer distance is marked as the final selected input terminal, and the security output terminal transfers the defense enhancement data to the final selected input terminal, and the final selected input terminal re-encrypts the defense enhancement data.

[0022] Furthermore, the cloud storage data security defense method based on the cloud terminal includes the following steps:

[0023] Step 1: Upload the data of the cloud terminal to the selected encryption terminal;

[0024] Step 2: After the data is uploaded, the encryption end is selected to encrypt the data;

[0025] Step 3: Perform patrol audit on the cloud storage end in the cloud server, and determine whether the cloud storage data in the cloud storage end is defense enhancement data during the patrol audit process;

[0026] Step 4: After the defense enhancement data appears in the cloud storage end, the corresponding defense enhancement data is transferred and re-encrypted.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] 1. The method of the present invention analyzes the selected encryption end of the data through two different upload analysis methods, ensures that the data uploaded by the cloud terminal is reasonably and securely encrypted, and flexibly adjusts and encrypts each cloud storage data on the basis of ensuring the security of cloud storage data;

[0029] 2. Set up a security encryption module to conduct an in-depth analysis of the cloud terminal before uploading data. Consider the cloud terminal and cloud storage end. Set up a defense audit module and a data transfer module to patrol and audit the cloud storage end in the cloud server. Perform intelligent analysis on each cloud storage data in the cloud storage end to determine whether there may be potential security issues in the cloud storage data and transfer the corresponding cloud storage data in a reasonable manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A flowchart of a cloud storage data security defense method based on a cloud terminal;

[0031] Figure 2 A flowchart for selecting an encryption end;

[0032] Figure 3 A flow chart of the process of transferring and re-encrypting data for defense enhancement. DETAILED DESCRIPTION Example 1

[0033] Reference Figure 1 , a cloud storage data security defense method based on a cloud terminal includes the following steps:

[0034] Step 1: Upload the data of the cloud terminal to the selected encryption terminal;

[0035] Step 2: After the data is uploaded, the encryption end is selected to encrypt the data;

[0036] Step 3: Perform patrol audit on the cloud storage end in the cloud server, and determine whether the cloud storage data in the cloud storage end is defense enhancement data during the patrol audit process;

[0037] Step 4: After the defense enhancement data appears in the cloud storage end, the corresponding defense enhancement data is transferred and re-encrypted.

[0038] Through the above method, the selected encryption end of the data is analyzed through two different upload analysis methods to ensure reasonable and secure encryption of the data uploaded by the cloud terminal. On the basis of ensuring the security of cloud storage data, the cloud storage data can be flexibly adjusted and encrypted. Example 2

[0039] Reference Figures 2 to 3, a cloud storage data security defense system based on cloud terminals, including a security encryption module, a defense audit module, and a data transfer module.

[0040] Security encryption module: Each time the cloud terminal uploads data, the data is uploaded to the selected encryption end. After uploading, the selected encryption end encrypts the data, obtains cloud storage data after encryption, and generates a data encryption log for the selected encryption end. The data encryption log includes the encryption start time and encryption duration.

[0041] The selected encryption end is obtained in the following manner: at each interval of t, the terminal upload value of the cloud terminal is obtained, and the terminal upload boundary value is set. The terminal upload boundary value is a system setting threshold and can be modified according to actual needs; a plurality of cloud storage ends are set in the cloud server, each of which is set in a different location, and each cloud storage end will encrypt the data to the same or different degrees when storing data. For example, the cloud server has cloud storage end a, cloud storage end b and cloud storage end c, cloud storage end a is encryption strength level 1, cloud storage end b is encryption strength level 2, and cloud storage end c is encryption strength level 2, then the data encryption strength of cloud storage end a is less than the data encryption strength of cloud storage end b and equal to the data encryption strength of cloud storage end c, then cloud storage ends b and c will encrypt the data with higher intensity relative to cloud storage end a, that is, the data in cloud storage ends b and c is more secure than the data in cloud storage end a.

[0042] The terminal upload value of the cloud terminal is obtained in the following way: obtain all access audit logs of the system within the time interval of t, obtain the cloud terminal number of the access audit log, mark the access audit log of the cloud terminal with this number as the same-code audit log, sort all the same-code audit logs in the order of access time, calculate the difference between the access audit values ​​of the two adjacent same-code audit logs after sorting, obtain the access audit fluctuation value, set the access audit fluctuation threshold, the access audit fluctuation threshold is the system setting threshold, which can be modified according to actual needs, when the access audit fluctuation value is greater than or equal to the access audit fluctuation threshold, increase the audit fluctuation times by one, when the access audit fluctuation value is greater than or equal to the access audit fluctuation threshold, do not do corresponding processing, sum up all audit fluctuation times, and obtain the total audit fluctuation times. , sum up the access audit values ​​of the two adjacent audit logs with the same editor after sorting, get the audit and value of the same editor, set the audit threshold and value of the same editor, the audit threshold and value of the same editor is the threshold set by the system, which can be modified according to actual needs. When the audit and value of the same editor is greater than or equal to the audit threshold and value of the same editor, the number of consecutive exceptions will be increased once. When the audit and value of the same editor is less than the audit threshold and value of the same editor, no corresponding processing will be performed. All consecutive exception times are summed up to get the total number of consecutive exceptions. , using the formula Get the terminal upload value Sc of the cloud terminal, where b1 is the total number of audit fluctuations coefficient, b2 is the total number of continuous anomalies coefficient, b1 is 0.97, and b2 is 0.99;

[0043] When the terminal upload value is greater than or equal to the terminal upload limit value, the terminal upload value and the terminal upload limit value are subtracted to obtain the upload level value Sk, k=1, 2, ..., k, where S1<S2<...<Sk, and the encryption strength level is obtained according to the upload level value, and the encryption strength level is marked as the target strength level;

[0044] Each upload level value range corresponds to an encryption strength level. The upload level value range is [0, S1], (S1, S2], …, (Sk-1, Sk], and the encryption strength levels include encryption strength level 1, encryption strength level 2, …, encryption strength level k-1, and encryption strength level k. The larger the encryption strength level value (the encryption strength level value is 1, 2, …, k-1, k), the higher the encryption strength. The current position of the cloud terminal is obtained, and a circle is drawn with a preset radius R (R is the length of the preset radius) to obtain the cloud encryption range. The encryption strength level of each cloud storage terminal within the cloud encryption range is obtained, and the cloud storage terminal with the encryption strength level of the target strength level is marked as the target encryption terminal. The position of the target encryption terminal is obtained, and the distance difference between the position of the target encryption terminal and the current position of the cloud terminal is calculated to obtain the encryption distance. The target encryption terminal with the smallest encryption distance is marked as the selected encryption terminal.

[0045] When the terminal upload value is less than the terminal upload limit value, no corresponding processing is performed. The current position of the cloud terminal is obtained, and a circle is drawn with the current position of the cloud terminal as the center and a preset radius r (r is the length of the preset radius) to obtain the cloud storage range. Each cloud storage terminal within the cloud storage range is marked as a target storage terminal, and the priority storage value of the target storage terminal is obtained. The target storage terminal with the largest priority storage value is marked as the selected encryption terminal.

[0046] The priority storage value of the target storage end is obtained by the following method: obtain all data encryption logs of the target storage end within the time interval t, sum up the encryption time of all data encryption logs, and obtain the total encryption time , sort the data encryption logs according to the encryption start time, sum the encryption durations of two adjacent data encryption logs after sorting, get the adjacent encryption duration, set the adjacent encryption threshold and duration, when the adjacent encryption duration is greater than or equal to the adjacent encryption threshold and duration, increase the pressure encryption times by one, when the adjacent encryption duration is less than the adjacent encryption threshold and duration, do not do the corresponding processing, sum all the pressure encryption times, get the total pressure encryption times Sm, use the formula Get the priority storage value of the target storage end.

[0047] By setting up a security encryption module, you can conduct an in-depth analysis of the cloud terminal before uploading data, considering both the cloud terminal and cloud storage ends.

[0048] Defense audit module: patrol audits are performed on the cloud storage terminals in the cloud server at intervals of T. Each time a cloud storage terminal is audited, the security defense value of each cloud storage data in the cloud storage terminal is obtained, and a security defense limit is set. The security defense limit is a system-set threshold and can be modified according to actual needs. When the security defense value of the cloud storage data is greater than or equal to the security defense limit, the cloud storage data is marked as defense-enhanced data. When the security defense value of the cloud storage data is less than the security defense limit, no corresponding processing is performed.

[0049] Data transfer module: When defense enhancement data appears in the cloud storage terminal, the cloud storage terminal is marked as a security output terminal. With the security output terminal as the center, a circle with a preset radius d (d is the length of the preset radius) is drawn to obtain the security output range. The remaining cloud storage terminals within the security output range are marked as pre-selected input terminals. The encryption strength level of the pre-selected input terminal is calculated to differ from that of the security output terminal to obtain a strength level difference. A strength level threshold difference is set. When the strength level difference is greater than or equal to the strength level threshold difference, the pre-selected input terminal is marked as a secondary input terminal. When the strength level difference is less than the strength level threshold difference, no corresponding processing is performed. The distance difference between the position of the secondary input terminal and the position of the security output terminal is calculated to obtain a transfer distance. The secondary input terminal with the smallest transfer distance is marked as a final input terminal. The security output terminal transfers the defense enhancement data to the final input terminal, and the final input terminal re-encrypts the defense enhancement data (also generates a data encryption log).

[0050] The security defense value of cloud storage data is obtained by the following method: obtain all access audit logs generated by cloud storage data within T time, obtain the access audit value of the access audit log, sum up the access audit values ​​of all access audit logs and take the average, to obtain the average access audit value , set the access audit threshold. The access audit threshold is the system-set threshold and can be modified according to actual needs. When the access audit value of the access audit log is greater than or equal to the access audit threshold, the access audit log is marked as a special audit day log. When the access audit value of the access audit log is less than the access audit threshold, no corresponding processing is performed. All special audit day logs are sorted in order of access time. The access time difference between the two adjacent special audit day logs after sorting is calculated to obtain the special audit time difference. All special audit time differences are summed and averaged to obtain the average special audit time difference. , using the formula The security defense value Lp of cloud storage data is obtained, where a1 is the average access audit value coefficient, a2 is the average special audit time difference coefficient, the value of a1 is 0.87, and the value of a2 is 0.62.

[0051] The access audit log is obtained in the following way: when the cloud storage data on the cloud storage end is accessed, an access audit log of the cloud storage data is generated. The access audit log includes the cloud terminal number (that is, the terminal number of the cloud terminal to which the cloud storage data belongs. Each cloud terminal in the system corresponds to a unique terminal number), the access time (that is, the Beijing time corresponding to the beginning of the cloud storage data being accessed), and the access audit value.

[0052] The access audit value of the access audit log is obtained in the following way: when the cloud storage data is accessed, a preset period interval is set, and at each period node, the access behavior data generated during the access process in the current period is obtained, and features are extracted from the access behavior data to obtain access behavior feature data, and the access behavior feature data is input into the access behavior model to obtain the access behavior value, and a rectangular coordinate system is constructed with the access duration of the cloud storage data as the X-axis and the access behavior value as the Y-axis. An access behavior polyline is drawn in the rectangular coordinate system through the access behavior value corresponding to the period node, and two vertical line segments are obtained by drawing perpendicular lines from the two endpoints of the access behavior polyline to the X-axis. A graph is formed by the access behavior polyline, the two vertical line segments and the X-axis, and the total area of ​​the graph is marked as the access audit value.

[0053] The access behavior model is trained in the following way: collect k groups of access behavior feature data, which can be real data or virtually set data, build a neural network model, use the access behavior feature data as training data for the neural network model, assign access behavior values ​​to the training data, divide the k groups of access behavior feature data into training set and validation set in a ratio of 1:3, perform iterative neural network training on the training set and validation set, and obtain the access behavior model.

[0054] The access behavior value ranges from 1 to 5. The larger the access behavior value, the more abnormal the access behavior characteristics are (the more abnormal, the more potential security issues may exist). The smaller the access behavior value, the more normal the access behavior characteristics are.

[0055] By setting up a defense audit module and a data transfer module, patrol audits can be performed on the cloud storage end in the cloud server, and intelligent analysis can be performed on each cloud storage data in the cloud storage end to determine whether there may be potential security issues in the cloud storage data, and the corresponding cloud storage data can be transferred rationally.

[0056] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0057] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0058] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0059] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0060] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0061] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0062] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0063] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A cloud storage data security defense system based on cloud terminals, characterized in that: Including security encryption module, defense audit module, and data transfer module; The security encryption module is used to upload the data of the cloud terminal to the selected encryption end, and the selected encryption end encrypts the data after uploading; The defense audit module is used to perform patrol audit on the cloud storage end in the cloud server, and determine whether the cloud storage data in the cloud storage end is defense enhancement data during the patrol audit process; The data transfer module is used to transfer and re-encrypt the corresponding defense improvement data after the defense improvement data appears in the cloud storage end; At intervals of T, patrol audits are conducted on the cloud storage terminals in the cloud server. When auditing each cloud storage terminal, the security defense value of each cloud storage data in the cloud storage terminal is obtained, and a security defense limit is set. When the security defense value of the cloud storage data is greater than or equal to the security defense limit, the cloud storage data is marked as defense-enhanced data. When the security defense value of the cloud storage data is less than the security defense limit, no corresponding processing is performed. The security defense value of cloud storage data is obtained by the following method: obtain all access audit logs generated by cloud storage data within T time, obtain the access audit value of the access audit log, sum up the access audit values ​​of all access audit logs and take the average, to obtain the average access audit value , set the access audit threshold, when the access audit value of the access audit log is greater than or equal to the access audit threshold, mark the access audit log as a special audit day log, sort all special audit day logs in the order of access time, calculate the time difference between the access times of two adjacent special audit day logs after sorting, and get the special audit time difference, sum up all special audit time differences and take the average to get the average special audit time difference , using the formula The security defense value Lp of cloud storage data is obtained, where a1 is the average access audit value coefficient and a2 is the average special audit time difference coefficient; The access audit log is obtained in the following manner: when the cloud storage data of the cloud storage terminal is accessed, an access audit log of the cloud storage data is generated, the access audit log includes the cloud terminal number, access time, and access audit value, and the access audit value of the access audit log is obtained in the following manner: when the cloud storage data is accessed, a preset period interval is set, and at each period node, the access behavior data generated during the access process in the current period is obtained, and features are extracted from the access behavior data to obtain access behavior feature data, and the access behavior feature data is input into the access behavior model to obtain the access behavior value, and a rectangular coordinate system is constructed with the access duration of the cloud storage data as the X-axis and the access behavior value as the Y-axis, and an access behavior polyline is drawn in the rectangular coordinate system through the access behavior value corresponding to the period node, and two vertical line segments are obtained by drawing perpendicular lines from the two end points of the access behavior polyline to the X-axis, and a graph is formed by the access behavior polyline, the two vertical line segments, and the X-axis, and the total area of ​​the graph is marked as the access audit value.

2. The cloud storage data security defense system based on cloud terminal according to claim 1 is characterized in that: Each time the cloud terminal uploads data, the data is uploaded to the selected encryption end. After uploading, the selected encryption end encrypts the data, and the encrypted cloud storage data is obtained. The data encryption log of the selected encryption end is generated. The data encryption log includes the encryption start time and encryption duration.

3. The cloud storage data security defense system based on cloud terminal according to claim 2 is characterized in that: The selected encryption end is obtained in the following way: At every interval of t, the cloud terminal obtains the terminal upload value of the cloud terminal and sets the terminal upload limit value. When the terminal upload value is greater than or equal to the terminal upload limit value, the terminal upload value is calculated to be different from the terminal upload limit value to obtain the upload level value Sk, k=1, 2, ..., k, where S1<S2<...<Sk. The encryption strength level is obtained according to the upload level value and the encryption strength level is marked as the target strength level. Each upload level value range corresponds to an encryption strength level. The upload level value range is [0, S1], (S1, S2], …, (Sk-1, Sk], and the encryption strength levels include encryption strength level 1, encryption strength level 2, …, encryption strength level k-1, encryption strength level k. The larger the encryption strength level value, the higher the encryption strength. Obtain the current location of the cloud terminal, draw a circle with a preset radius R to obtain the cloud encryption range, obtain the encryption strength level of each cloud storage terminal within the cloud encryption range, mark the cloud storage terminal with the target encryption strength level as the target encryption terminal, obtain the location of the target encryption terminal, calculate the distance difference between the location of the target encryption terminal and the current location of the cloud terminal to obtain the encryption distance, and mark the target encryption terminal with the smallest encryption distance as the selected encryption terminal; When the terminal upload value is less than the terminal upload limit value, no corresponding processing is performed. The current position of the cloud terminal is obtained. With the current position of the cloud terminal as the center, a circle with a preset radius r is drawn to obtain the cloud storage range. Each cloud storage terminal within the cloud storage range is marked as a target storage terminal. The priority storage value of the target storage terminal is obtained, and the target storage terminal with the largest priority storage value is marked as the selected encryption terminal.

4. The cloud storage data security defense system based on cloud terminal according to claim 3 is characterized in that: The terminal upload value of the cloud terminal is obtained in the following way: Get all the access audit logs of the system within the time interval of t, get the cloud terminal number of the access audit log, mark the access audit log of the cloud terminal with this number as the same audit log, sort all the same audit logs in the order of access time, calculate the difference between the access audit values ​​of the two adjacent same audit logs after sorting, get the access audit fluctuation value, set the access audit fluctuation threshold, when the access audit fluctuation value is greater than or equal to the access audit fluctuation threshold, increase the audit fluctuation times by one, sum up all the audit fluctuation times, and get the total audit fluctuation times , sum up the access audit values ​​of the two adjacent audit logs with the same code after sorting, get the same code audit sum value, set the same code audit threshold and value, when the same code audit sum value is greater than or equal to the same code audit threshold and value, increase the number of consecutive anomalies by one, sum up all the consecutive anomalies, and get the total number of consecutive anomalies , using the formula The terminal upload value Sc of the cloud terminal is obtained, where b1 is the total number of audit fluctuations coefficient and b2 is the total number of continuous anomalies coefficient.

5. The cloud storage data security defense system based on cloud terminal according to claim 3 is characterized in that: The priority storage value of the target storage end is obtained by the following method: obtain all data encryption logs of the target storage end within the time interval t, sum up the encryption time of all data encryption logs, and obtain the total encryption time , sort the data encryption logs according to the encryption start time, sum the encryption durations of two adjacent data encryption logs after sorting, get the adjacent encryption duration, set the adjacent encryption threshold and duration, when the adjacent encryption duration is greater than or equal to the adjacent encryption threshold and duration, increase the pressure encryption times by one, when the adjacent encryption duration is less than the adjacent encryption threshold and duration, do not do the corresponding processing, sum all the pressure encryption times, get the total pressure encryption times Sm, use the formula Get the priority storage value of the target storage end.

6. The cloud storage data security defense system based on cloud terminal according to claim 1 is characterized in that: When defense enhancement data appears in the cloud storage terminal, the cloud storage terminal is marked as a security output terminal. With the security output terminal as the center, a circle with a preset radius d is drawn to obtain the security output range. The remaining cloud storage terminals within the security output range are marked as pre-selected input terminals. The encryption strength level of the pre-selected input terminal is calculated to differ from the encryption strength level of the security output terminal to obtain the strength level difference. A strength level threshold difference is set. When the strength level difference is greater than or equal to the strength level threshold difference, the pre-selected input terminal is marked as a secondary input terminal. The distance difference between the position of the secondary input terminal and the position of the security output terminal is calculated to obtain the transfer distance. The secondary input terminal with the smallest transfer distance is marked as the final input terminal. The security output terminal transfers the defense enhancement data to the final input terminal, and the final input terminal re-encrypts the defense enhancement data.

7. A cloud storage data security defense method based on a cloud terminal, applied to the cloud storage data security defense system based on a cloud terminal according to claim 1, characterized in that: The steps include: Step 1: Upload the data of the cloud terminal to the selected encryption terminal; Step 2: After the data is uploaded, the encryption end is selected to encrypt the data; Step 3: Perform patrol audit on the cloud storage end in the cloud server, and determine whether the cloud storage data in the cloud storage end is defense enhancement data during the patrol audit process; Step 4: After the defense enhancement data appears in the cloud storage end, the corresponding defense enhancement data is transferred and re-encrypted.

Images