Data security storage method, system and memory card

Abstract

The present invention relates to the technical field of data security storage, and discloses a data security storage method, system and storage card, wherein the method comprises: performing security partitioning on a storage card to obtain a plurality of security areas, each of which has a unique partition identifier and an initial encryption key; performing security level identification and classification on data to be written to obtain classified data with security level labels and corresponding metadata packages; implementing multiple encryption strategies to obtain differentially encrypted data and encryption context information thereof; performing physical isolation and access control processing and storing them in a physical storage unit; performing dynamic management and update processing to obtain an updated key set and a key version mapping table; performing integrity verification and recovery processing on the differentially encrypted data stored in the physical storage unit to obtain verification results and recovered data, wherein the method realizes partitioned storage and verification of data, thereby improving data security.

Description

Technical Field

[0001] The present invention relates to the technical field of data security storage, and in particular to a data security storage method, system and memory card. Background Art

[0002] With the rapid development of information technology and the deepening of digital transformation, data has become a core asset of modern society. However, data security issues are becoming increasingly prominent, and traditional data storage methods face many challenges. Security incidents such as data leaks, malicious attacks, and privacy violations occur frequently, causing huge losses and risks to individuals, enterprises, and countries.

[0003] Existing data storage technologies often use a single encryption method or a simple access control mechanism, which cannot effectively deal with complex and changing security threats. Especially in the context of the widespread use of mobile storage devices, the security of memory cards has become an urgent issue to be addressed. Traditional methods are difficult to achieve differentiated protection for data of different security levels, and lack a dynamic management and update mechanism for encryption keys. In addition, current data storage solutions generally ignore the importance of data integrity verification and recovery. Once data is damaged or tampered with, it is often difficult to detect and repair it in time. Summary of the invention

[0004] The present invention provides a data security storage method, system and storage card, which are used to realize partition storage and verification of data, thereby improving the security of data.

[0005] In a first aspect, the present invention provides a data security storage method, the data security storage method comprising:

[0006] Performing security partitioning on the memory card to obtain a plurality of security areas, each of the security areas having a unique partition identifier and an initial encryption key;

[0007] Identify and classify the security level of the data to be written, and obtain classified data with security level labels and corresponding metadata packages;

[0008] Implementing multiple encryption strategies on the classified data according to the security level label and the initial encryption key to obtain differentially encrypted data and encryption context information thereof;

[0009] Implementing physical isolation and access control processing on the differentially encrypted data, and storing the differentially encrypted data in a physical storage unit corresponding to the security area;

[0010] Dynamically manage and update the initial encryption key and the encryption context information to obtain an updated key set and a corresponding key version mapping table;

[0011] Based on the updated key set, integrity verification and recovery processing are performed on the differentially encrypted data stored in the physical storage unit to obtain a verification result and recovered data.

[0012] In a second aspect, the present invention provides a data security storage system, the data security storage system comprising:

[0013] A partitioning module, used for performing security partitioning on the memory card to obtain a plurality of security areas, each of the security areas having a unique partition identifier and an initial encryption key;

[0014] A classification module is used to identify and classify the security level of the data to be written, and obtain the classified data with security level labels and the corresponding metadata package;

[0015] An encryption module, used for implementing multiple encryption strategies on the classified data according to the security level label and the initial encryption key to obtain differentially encrypted data and encryption context information thereof;

[0016] A storage module, used to implement physical isolation and access control processing on the differentially encrypted data, and store the differentially encrypted data in a physical storage unit corresponding to the security area;

[0017] An update module, used to dynamically manage and update the initial encryption key and the encryption context information to obtain an updated key set and a corresponding key version mapping table;

[0018] The verification module is used to perform integrity verification and recovery processing on the differentially encrypted data stored in the physical storage unit based on the updated key set to obtain a verification result and recovered data.

[0019] A third aspect of the present invention provides a data security storage device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the data security storage device executes the above-mentioned data security storage method.

[0020] A fourth aspect of the present invention provides a memory card, in which instructions are stored, and when the memory card is run on a computer, the computer is enabled to execute the above-mentioned data security storage method.

[0021] In the technical solution provided by the present invention, by performing security partitioning on the memory card and assigning a unique identifier and an initial encryption key to each area, physical isolation and differentiated protection of data are achieved, greatly improving the security of data storage. Feature extraction and extreme learning machine models are used to identify and classify the security level of the data to be written, ensuring that data of different types and sensitivities are protected at corresponding levels. Differentiated multiple encryption strategies are implemented according to the security level of the data, such as data sharding, obfuscation and multi-layer encryption of high-level security data, effectively improving the security of the data. Through hardware isolation and access control strategies, the security of the data is further enhanced, effectively preventing unauthorized access and data leakage. The initial encryption key and encryption context information are dynamically managed and updated, improving the system's anti-attack capability and reducing the risk of key leakage. Through a variety of hash algorithms and error correction coding technologies, integrity verification and recovery processing of stored data are achieved, ensuring the reliability and availability of data. The method comprehensively considers multiple security levels, has good flexibility and scalability, and can be adjusted and optimized according to actual needs. Through extreme learning machines, threshold password schemes, and rolling update strategies, comprehensive protection of the entire life cycle of data is achieved.

[0022] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0023] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram of an embodiment of a method for secure data storage in an embodiment of the present invention;

[0025] Figure 2 A schematic diagram of an embodiment of a data security storage system in an embodiment of the present invention;

[0026] Figure 3 FIG. 1 is a schematic diagram of an embodiment of a data security storage device in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] The terms "including" and "having" and any variations thereof mentioned in the embodiments of the present invention are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device end including a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or device ends.

[0029] To facilitate understanding of this embodiment, a data security storage method disclosed in an embodiment of the present invention is first described in detail. Figure 1 As shown, the method comprises the following steps:

[0030] 101. Perform security partitioning on the memory card to obtain multiple security areas, each of which has a unique partition identifier and an initial encryption key;

[0031] It is understandable that the execution subject of the present invention may be a data security storage system, or a terminal or a server, which is not limited here. The embodiment of the present invention is described by taking a server as the execution subject as an example.

[0032] Specifically, the total capacity of the memory card is detected to determine the size of the available storage space. According to the preset security level ratio, the available storage space is divided and calculated, and a capacity allocation plan for the high security level area, the medium security level area, the low security level area and the public area is formulated. The design of this plan needs to consider the degree of data protection requirements of each security level area, so as to provide appropriate storage space for data of different security levels. The physical structure of the memory card is analyzed, the sector distribution map of the memory card is obtained, and the physical layout of the memory card is understood, so that the position of each area can be accurately located during actual partitioning. Based on the sector distribution map and the previously determined capacity allocation plan, the memory card is physically partitioned to form multiple security areas. The creation of security areas requires precise control to ensure that the boundaries and sizes of each area meet the design requirements. After the security area division is completed, a unique partition identifier is generated for each security area, and the identifier is used to identify and manage each security area. The generation of the partition identifier is performed through a unique algorithm within the system to ensure that each area has a unique identifier. According to the security level of each security area, key generation algorithms of different strengths are called to generate an initial encryption key set for each area. The strength and complexity of the encryption key vary according to the security level to ensure that data protection in high-security level areas is more stringent. The generated partition identifier set and the initial encryption key set are associated and bound to form a partition-key mapping table. The mapping table records the encryption key corresponding to each security area to ensure the security of data storage and access. Based on the physical location information of the security area and the partition-key mapping table, the partition table information of the memory card is generated to structure the information of the security partition. The partition table information is encrypted to generate encrypted partition table information. The encrypted partition table information is written to the boot sector of the memory card to complete the initialization of the security partition of the memory card.

[0033] 102. Identify and classify the security level of the data to be written, and obtain classified data with security level labels and corresponding metadata packets;

[0034] Specifically, feature extraction is performed on the data to be written. Key features such as data type, data source, and data structure information are extracted from the data. These features are converted into feature vectors. According to the preset data feature library, the feature vectors are matched and analyzed to preliminarily determine the data category and obtain the initial data category. The initial data category is deeply analyzed based on the pre-trained extreme learning machine model. The model effectively identifies and distinguishes different types of data through training on large-scale data, and obtains a more accurate target data category. According to the target data category and the preset security level mapping rules, the security level of the data to be written is preliminarily evaluated to obtain the initial security level label. The frequency of use and importance of the data are quantitatively calculated to obtain the data value score. The importance and usage of the data are measured to provide a reference for the final determination of the security level. Combined with the initial security level label and the data value score, the data to be written is comprehensively evaluated to determine the security level label. In the process of data classification, the data to be written is summarized and data summary information is generated. This information includes the core features of the data and can quickly identify and verify the data content. The security level label, data summary information, and the current timestamp are combined to generate a metadata package. The metadata package records the basic information of the data, including key information such as the data's security level and generation time. The classified data with security level labels are associated and bound with the generated metadata package to ensure that each piece of data has a corresponding security level label and metadata package, so that data with different security levels can be quickly identified and processed during data storage and management.

[0035] The initial data categories are processed by one-hot encoding through the pre-trained extreme learning machine model. One-hot encoding converts the initial data categories into activation values ​​of the input layer neurons, which are used as the feature representation of the input layer. Based on the randomly generated weight matrix, the activation values ​​of the input layer neurons are linearly transformed to obtain the input values ​​of the hidden layer. The input values ​​of the hidden layer are processed by the nonlinear activation function to generate the output values ​​of the hidden layer. This process gives the model the ability to capture complex features of the data. The optimal weight between the output value of the hidden layer and the target output is calculated through the generalized inverse matrix algorithm to determine the output layer weight matrix. The output layer weight matrix is ​​used to linearly combine the output values ​​of the hidden layer to generate the original output value of the output layer. The original output value represents the model's preliminary judgment on different data categories. In order to convert the original output value of the output layer into a probability distribution, a softmax function operation is performed on it. The softmax function standardizes the original output value into a set of probability values, which represent the probability distribution of each target data category. According to the probability distribution, the category with the highest probability is selected as the final prediction result to determine the target data category. According to the pre-established data category and security level mapping rules, the target data category is searched and matched to obtain the corresponding security level value. The security level value and the sensitivity index of the data to be written are weighted averaged to calculate the comprehensive security score. Based on the preset security score threshold, the comprehensive security score is discretized to generate an initial security level label. The initial security level label provides a clear level indication for the secure storage and access control of data, allowing the system to take corresponding protection measures according to different security requirements.

[0036] 103. Implement multiple encryption strategies on the classified data according to the security level label and the initial encryption key to obtain differentially encrypted data and its encryption context information;

[0037] Specifically, the classified data is processed in a hierarchical manner according to the security level label. The classified data is divided into a first high-level security data set, a first intermediate-level security data set, and a first low-level security data set. According to the sensitivity and security requirements of the data, the data is encrypted and protected at different levels. The first high-level security data set is subjected to data sharding processing to split the data into multiple data fragments. Random mask data is generated, and each data fragment is obfuscated by performing an XOR operation with the data fragments. The obfuscated data fragments increase the security of the data, making it difficult for unauthorized decryptors to understand the true content of the data. Based on a high-intensity symmetric encryption algorithm, such as AES, the obfuscated data fragments are first-layer encrypted to ensure high-intensity protection of high-level security data. In order to protect the symmetric key used for the first-layer encryption, an asymmetric encryption algorithm, such as RSA, is used to encrypt the symmetric key to obtain the encrypted symmetric key. Asymmetric encryption provides an additional security layer to prevent the key from being stolen during transmission and storage. For the first intermediate-level security data set, a single-layer high-intensity symmetric encryption algorithm is used for encryption processing. For the first low-level security data set, a lightweight encryption algorithm is used for encryption processing. Generate corresponding encryption context information for the encrypted high-level security data, the encrypted intermediate-level security data, and the encrypted low-level security data. The encryption context information includes key details such as the encryption algorithm used, the key version, and the initialization vector. The encrypted high-level security data, the intermediate-level security data, the low-level security data, and their corresponding encryption context information are combined to form differentiated encrypted data.

[0038] 104. Implement physical isolation and access control processing on the differentially encrypted data, and store the differentially encrypted data in a physical storage unit corresponding to the security area;

[0039] Specifically, the physical structure of the memory card is scanned to generate a mapping table of physical storage unit addresses corresponding to each security area, and the physical storage location of each security area is clarified. The differentially encrypted data is classified and sorted according to the security level to form a second high-level security data set, a second intermediate-level security data set, and a second low-level security data set. After completing the data classification, the microcontroller of the memory card is initialized and the secure operating system is loaded. The operating system has an access control function and is the core of the security management of the memory card. According to the preset access control policy, the secure operating system is configured to establish a set of access control rules. These rules will ensure strict access control of data at different security levels to prevent unauthorized access. In order to enhance the physical security of the data, a hardware switch is used to isolate each physical storage unit to form a mutually independent storage space. The storage address is allocated for the second high-level security data set, and the data is written into the physical storage unit corresponding to the high security level to realize physically isolated high-level security data storage. Similarly, the storage address is allocated for the second intermediate-level security data set, and it is stored in the physical storage unit of the medium security level to realize physically isolated intermediate-level security data storage. For the second low-level security data set, similar processing is performed and it is stored in a physical storage unit with a low security level to ensure that the data is properly physically isolated. A physical isolation data structure is generated based on the physically isolated high-level, medium-level and low-level security data. This data structure records the distribution and isolation status of the data in the physical storage unit to ensure the physical isolation of data at different security levels. At the same time, each data access operation is recorded and an access log is generated. The log records the detailed information of each access operation, including time, data type and access result. After each data access operation, the preset operation instructions are executed to form an operation sequence. The operation instructions may include data backup, log update and access permission check. The physical isolation data structure, access control rule set, access log and operation sequence are integrated to form a complete physical isolation and access control system. By combining physical isolation and access control, unauthorized access and data leakage are effectively prevented. At the same time, through log records and operation sequences, the system has good traceability and management capabilities, making data management more transparent and reliable.

[0040] 105. Dynamically manage and update the initial encryption key and encryption context information to obtain an updated key set and a corresponding key version mapping table;

[0041] Specifically, the system clock of the physical isolation and access control system is compared with the preset update cycle to determine the timing of key update. Once the comparison result reaches the preset condition, the system generates a key update trigger signal. After receiving the trigger signal, the system starts the secure random number generator to generate a random seed for key update. The random seed is the core of the key update process, ensuring that the generated new key has high randomness and unpredictability. The existing key set is permuted and reorganized using the random seed to form a preliminary updated key set. The security of the key is improved by randomizing the structure of the existing key. On the basis of the preliminary updated key set, key extension processing is performed to generate a strengthened new key set. The key extension process usually involves increasing the key length or complexity to improve its ability to resist attacks. According to the predefined key sharding strategy, the high security level key in the strengthened new key set is sharded to divide a complete key into several fragments. The separate storage of these fragments can increase the security of the key. Based on the threshold cryptographic scheme, the reconstruction rules of the key fragments are set to form a key reconstruction protocol. The threshold cryptographic scheme is an encryption technology that can only reconstruct the complete key when a certain number of key fragments are obtained. Through key distribution technology, key fragments are distributed to the designated secure storage location and target keys are generated. The target key is a new and complete key that is merged with the enhanced new key set to form an updated key set. After the updated key set is generated, each key is assigned a unique version number to track and manage different versions of keys and generate a corresponding key version mapping table. The key version mapping table records the version number, creation time and other related information of each key. Based on the rolling update strategy, the stored encrypted data is re-encrypted. The rolling update strategy allows the system to gradually update keys without affecting service availability, ensuring continuous accessibility of data. By re-encrypting the data with the new key, the encryption layer of the data is updated to ensure its security. A key update log containing the update time, impact range and hash values ​​of the old and new keys is generated and stored encrypted. The encrypted key update log records the detailed information of the key update and provides traceability of the key update process.

[0042] 106. Based on the updated key set, integrity verification and recovery processing are performed on the differentially encrypted data stored in the physical storage unit to obtain a verification result and recovered data.

[0043] Specifically, the differentially encrypted data stored in the physical storage unit is scanned, and all data blocks to be verified are identified and collected to form a set of data blocks to be verified. Based on multiple hash algorithms, the set of data blocks to be verified is hashed in parallel to generate a current hash value set. The diversity of hash algorithms improves the accuracy and security of integrity verification. The first data block hash value that is pre-saved is extracted from the secure storage area. These hash values ​​are calculated and saved when the data is initially stored. The extracted first data block hash value is compared with the current hash value set to detect whether the data block is tampered with or damaged during the storage process. The comparison result forms a preliminary integrity verification result. If the result is consistent, it indicates that the integrity of the data block has been verified. The preliminary integrity verification result is further analyzed to identify a list of suspicious data blocks that may have problems. The hash value of the suspicious data block may not match the expectation due to storage damage, data tampering or other reasons. According to the list of suspicious data blocks, the corresponding backup data is extracted from the local backup or remote secure storage to generate a candidate recovery data set. The backup data set provides a copy of the original data for data recovery and repair. Based on the error correction coding technology, error detection and correction are performed on the candidate recovery data set to identify and correct errors in the data and generate a preliminary recovered data block. The pre-stored hash value of the second data block is obtained, and these hash values ​​are verified twice with the preliminary recovered data block to ensure the integrity and accuracy of the recovered data. The result of the secondary verification generates the final verification result and confirms the integrity of the final recovered data block. Based on the corresponding key in the updated key set, the final recovered data block is decrypted and the encrypted data is restored to the original data. The key used is the latest version of the updated key set. After decryption, the recovered data is obtained, which is consistent with the original data.

[0044] In the embodiment of the present invention, by performing security partitioning on the memory card and assigning a unique identifier and an initial encryption key to each area, physical isolation and differentiated protection of data are achieved, greatly improving the security of data storage. Feature extraction and extreme learning machine models are used to identify and classify the security level of the data to be written, ensuring that data of different types and sensitivities are protected at corresponding levels. Differentiated multiple encryption strategies are implemented according to the security level of the data, such as data sharding, obfuscation and multi-layer encryption for high-level security data, effectively improving the security of the data. Through hardware isolation and access control strategies, the security of the data is further enhanced, effectively preventing unauthorized access and data leakage. The initial encryption key and encryption context information are dynamically managed and updated, improving the system's anti-attack capability and reducing the risk of key leakage. Through a variety of hash algorithms and error correction coding technologies, integrity verification and recovery processing of stored data are achieved, ensuring the reliability and availability of data. The method comprehensively considers multiple security levels, has good flexibility and scalability, and can be adjusted and optimized according to actual needs. Through extreme learning machines, threshold password schemes, and rolling update strategies, comprehensive protection of the entire life cycle of data is achieved.

[0045] In a specific embodiment, the process of executing step 101 may specifically include the following steps:

[0046] The total capacity of the memory card is detected to obtain the size of the available storage space, and the available storage space is divided and calculated according to the preset security level ratio to obtain a capacity allocation plan for the high security level area, the medium security level area, the low security level area and the public area;

[0047] Analyze the physical structure of the memory card to obtain a sector distribution map of the memory card, and perform physical partition processing on the memory card according to the capacity allocation scheme and the sector distribution map to obtain multiple security areas;

[0048] Generate a unique partition identifier for each security zone to obtain a set of partition identifiers corresponding to the security zones one by one, and call key generation algorithms of different strengths according to the security level of each security zone to obtain an initial encryption key set corresponding to the security zone;

[0049] The partition identifier set and the initial encryption key set are associated and bound to obtain a partition-key mapping table, and the partition table information of the storage card is generated according to the physical location information of the security area and the partition-key mapping table;

[0050] The partition table information is encrypted to obtain the encrypted partition table information, and the encrypted partition table information is written into the boot sector of the memory card to complete the initialization of the secure partition of the memory card.

[0051] Specifically, the total capacity of the memory card is detected. The total capacity of the memory card is obtained by reading the system information of the memory card or using a special software tool. The size of the available storage space is calculated, and the size of the available storage space is obtained after excluding the necessary overhead and reserved space used by the system. According to the preset security level ratio, the available storage space is divided and calculated to form a capacity allocation plan for different security level areas, and the capacity allocation plan for the high security level area, the medium security level area, the low security level area and the public area is obtained. The physical structure of the memory card is analyzed, including reading the sector distribution map of the memory card. The sector distribution map provides a detailed layout of each physical sector of the memory card and is the basis for physical partitioning. According to the capacity allocation plan and the sector distribution map, the memory card is physically partitioned. A certain number of continuous sectors are allocated to each partition to form multiple security areas. These areas are physically independent of each other to prevent data of different security levels from interfering with each other. After the partition is completed, a unique partition identifier is generated for each security area. The identifier can be a simple number, such as 1, 2, 3, etc., or a more complex string used to uniquely identify each partition. These identifiers constitute a partition identifier set. According to the security level of each security zone, call a key generation algorithm of different strengths to generate an initial encryption key set corresponding to each security zone. For example, a high-security zone may use AES-256-bit encryption, a medium-level zone may use AES-128-bit encryption, and a low-security zone and a public zone may use a relatively simple encryption method. The partition identifier set and the initial encryption key set are associated and bound, and each partition identifier is bound to one or more keys to form a partition-key mapping table. The mapping table records the partition identifier and the corresponding encryption key of each security zone. According to the physical location information of the security zone and the partition-key mapping table, the partition table information of the memory card is generated to describe the layout, size, identifier and related encryption key of each partition of the memory card. In order to protect the security of the partition table information, it is encrypted. Using a high-strength symmetric encryption algorithm, such as AES-256 bit, the partition table information is encrypted to generate encrypted partition table information. The encrypted partition table information is written to the boot sector of the memory card. The boot sector is usually the first sector on the memory card and is used to store system boot information and other key data. By storing the encrypted partition table information in the boot sector, it is ensured that the partition information can be verified and loaded first when starting and accessing the storage card.

[0052] In a specific embodiment, the process of executing step 102 may specifically include the following steps:

[0053] Perform feature extraction on the data to be written to obtain a feature vector containing data type, data source, and data structure information, and perform matching analysis on the feature vector according to the preset data feature library to obtain the initial data category;

[0054] Based on the pre-trained extreme learning machine model, the initial data category is deeply analyzed to obtain the target data category. According to the target data category and the preset security level mapping rules, the security level of the data to be written is evaluated to obtain the initial security level label.

[0055] Quantify the usage frequency and importance of the data to be written to obtain the data value score, and conduct a comprehensive assessment of the data to be written based on the initial security level label and the data value score to obtain the security level label;

[0056] Perform summary calculation on the data to be written to obtain data summary information, and combine the security level label, data summary information and current timestamp to obtain a metadata package;

[0057] The data to be written and the metadata package are associated and bound to obtain classified data with security level labels.

[0058] Specifically, identify and extract key features of the data. These features usually include data type, data source, and data structure information. For example, the data type may be text, image, audio, or video, and the data source may be a sensor, user input, web crawling, etc. Data structure information involves the format and organization of the data, such as flat files, relational databases, JSON, etc. By analyzing these features, a feature vector containing the above information is generated. . The feature vector can be expressed as: .in, Indicates the data type, Indicates the source of data. Represents data structure information. Use the preset data feature library to identify the feature vector Perform matching analysis. The data feature library contains multiple data features and their corresponding classification labels. By comparing the feature vector with the entries in the feature library, the initial data category is obtained. Assuming that there is an entry in the feature library "Image-Sensor-RAW Format" and the corresponding classification label is "Image Data", then when the feature vector When matched with it, the initial data category is "image data". After the data category is preliminarily determined, the pre-trained extreme learning machine model is used for in-depth analysis. The extreme learning machine is a neural network model that is suitable for rapid classification due to its fast training speed and strong generalization ability. The initial data category is input into the extreme learning machine model. The model classifies the data in a more detailed manner based on the feature patterns learned during training to obtain the target data category. After determining the target data category, the security level of the data to be written is evaluated according to the preset security level mapping rules. The mapping rules usually map different data categories to corresponding security level labels based on the sensitivity and confidentiality requirements of the data. According to these rules, the corresponding data will be marked with the initial security level label. The frequency of use and importance of the data to be written are quantified and calculated to obtain the data value score. The frequency of data use can be obtained through access log analysis, while the importance is evaluated based on the criticality of the data in the system. For example, data that is frequently accessed in a key business process will have a higher value score. The data value score can be expressed as: ;

[0059] in, is the data value score, is the frequency of data usage, For the importance of data, and is a weight coefficient used to adjust the impact of usage frequency and importance on the value score. Combined with the initial security level label and data value score, the data to be written is comprehensively evaluated to determine the final security level label. This label will indicate the level of protection that the data should receive, such as encryption strength, access control policy, etc. After the classification is completed, the data to be written is summarized and the data summary information is generated. The summary information usually uses a hash function, such as SHA-256, to generate a unique fingerprint of the data to ensure the integrity and tamper-proofness of the data. The security level label, data summary information, and current timestamp are combined to generate a metadata package. The metadata package is a collection of descriptions and management information of the data, containing information about the security, integrity, and generation time of the data. The data to be written and the metadata package are associated and bound to form classified data with security level labels, ensuring that each piece of data has a clear security level and metadata description.

[0060] In a specific embodiment, the execution step performs a deep analysis on the initial data category based on the pre-trained extreme learning machine model to obtain the target data category, and performs a security level assessment on the data to be written according to the target data category and the preset security level mapping rule. The process of obtaining the initial security level label may specifically include the following steps:

[0061] The initial data category is processed by one-hot encoding through the pre-trained extreme learning machine model to obtain the activation value of the input layer neuron;

[0062] Based on the randomly generated weight matrix, the activation values ​​of the neurons in the input layer are linearly transformed to obtain the input values ​​of the hidden layer, and the input values ​​of the hidden layer are nonlinearly activated to obtain the output values ​​of the hidden layer;

[0063] Based on the generalized inverse matrix algorithm, the optimal weight between the output value of the hidden layer and the target output is calculated to obtain the output layer weight matrix. Based on the output layer weight matrix, the output value of the hidden layer is linearly combined to obtain the original output value of the output layer.

[0064] The softmax function is performed on the original output value of the output layer to obtain the probability distribution of each target data category, and based on the probability distribution, the category with the highest probability is selected as the prediction result to obtain the target data category;

[0065] According to the pre-established data category and security level mapping rules, the target data category is searched and matched to obtain the corresponding security level value;

[0066] The security level value and the sensitivity index of the data to be written are weighted averaged to obtain a comprehensive security score, and the comprehensive security score is discretized based on the preset security score threshold to obtain an initial security level label.

[0067] Specifically, the initial data categories are one-hot encoded through the pre-trained extreme learning machine model. One-hot encoding is a technique for converting categorical variables into binary vectors, where each category corresponds to a unique position in a vector that is 1, and the remaining positions are 0. For example, if there are three initial data categories A, B, and C, their one-hot encodings are [1, 0, 0], [0, 1, 0], and [0, 0, 1], respectively. These one-hot encoding vectors will be used as the activation values ​​of the input layer neurons. Based on the randomly generated weight matrix , linearly transform the activation value of the input layer neurons. Suppose the activation value of the input layer neurons is the vector , then the input value of the hidden layer It can be calculated by the following formula: ;

[0068] in, is a randomly generated weight matrix, is the input value of the hidden layer. Perform nonlinear activation operations on the input value of the hidden layer, such as using the Sigmoid function or the ReLU function, to obtain the output value of the hidden layer Assuming the Sigmoid activation function is used, the output value of the hidden layer is calculated as follows: ;

[0069] Based on the generalized inverse matrix algorithm, the optimal weight between the output value of the hidden layer and the target output is calculated to obtain the output layer weight matrix . Let the output value matrix of the hidden layer be , the target output matrix is , then the calculation formula of the output layer weight matrix is: ;

[0070] in, Represents the generalized inverse matrix of the hidden layer output matrix. Based on the output layer weight matrix , linearly combine the output values ​​of the hidden layer to obtain the original output value of the output layer : ;

[0071] The softmax function is performed on the original output value of the output layer to convert it into the probability distribution of each target data category. The calculation formula of the softmax function is: ;

[0072] in, Indicates category According to the probability distribution, the category with the highest probability is selected as the prediction result to obtain the target data category. According to the pre-established data category and security level mapping rules, the target data category is searched and matched to obtain the corresponding security level value. The security level value and the sensitivity index of the data to be written are weighted averaged to obtain a comprehensive security score. Let the security level value be , the sensitivity index is The weight coefficients are and , then the comprehensive safety score The calculation formula is: ; and It is used to adjust the impact of security level value and sensitivity index on the comprehensive score. Based on the preset security score threshold, the comprehensive security score is discretized to obtain the initial security level label. Assuming that the preset security score threshold is 0.5, when the comprehensive security score is greater than 0.5, the data label is "high security level", otherwise it is "low security level".

[0073] In a specific embodiment, the process of executing step 103 may specifically include the following steps:

[0074] According to the security level labels, the classified data is processed in a hierarchical manner to obtain a first high-level security data set, a first intermediate-level security data set, and a first low-level security data set;

[0075] Performing data sharding processing on the first advanced security data set to obtain multiple data fragments, generating random mask data, and performing an XOR operation on the data fragments to obtain obfuscated data fragments;

[0076] Based on a high-intensity symmetric encryption algorithm, the obfuscated data fragments are first encrypted to obtain encrypted high-level security data, and the symmetric key used for the first-layer encryption is encrypted using an asymmetric encryption algorithm to obtain an encrypted symmetric key;

[0077] Encrypting the first intermediate security data set based on a single-layer high-intensity symmetric encryption algorithm to obtain encrypted intermediate security data, and encrypting the first low-level security data set using a lightweight encryption algorithm to obtain encrypted low-level security data;

[0078] Generate corresponding encryption context information for the encrypted high-level security data, the encrypted medium-level security data, and the encrypted low-level security data, respectively, the encryption context information including the encryption algorithm used, the key version, and the initialization vector;

[0079] The encrypted high-level security data, the encrypted intermediate-level security data, the encrypted low-level security data and their corresponding encryption context information are combined to obtain differentially encrypted data.

[0080] Specifically, the classified data is processed in a graded manner according to the security level label. The classified data is divided into three security levels: the first high-level security data set, the first intermediate-level security data set, and the first low-level security data set. Each data set corresponds to different security protection requirements. After determining the boundaries and contents of each data set, different encryption strategies are selected in a targeted manner. For the first high-level security data set, data sharding is performed to divide the data set into multiple data fragments. The data set is divided into blocks of fixed size, for example, a large file is divided into multiple small blocks of 1MB. The sharded data fragments help improve data security and processing efficiency. Generate random mask data for obfuscating each data fragment. Random mask data is a random byte sequence of the same length as the data fragment, usually generated by a secure random number generator. Perform an XOR operation on each data fragment and the corresponding random mask data to obtain the obfuscated data fragment. The formula for the XOR operation is as follows: ;

[0081] in, For the Obfuscated data fragments, For the data fragments, is the corresponding random mask data. Based on a high-strength symmetric encryption algorithm, such as AES-256, the first layer of encryption is performed on the obfuscated data fragments. The encrypted high-level security data has extremely high security and is suitable for scenarios with the highest requirements for data integrity and confidentiality. In order to protect the symmetric key used for the first layer of encryption, an asymmetric encryption algorithm, such as RSA, is used to encrypt the key to obtain the encrypted symmetric key. Asymmetric encryption provides an additional security layer to prevent the symmetric key from being stolen during storage or transmission. For the first intermediate security data set, a single layer of high-strength symmetric encryption algorithm is used to encrypt it. For example, AES-128 can be selected for encryption. This encryption method has relatively low computational overhead while providing sufficient security. For the first low-level security data set, a lightweight encryption algorithm, such as RC4 or ChaCha20, is used for encryption, which is suitable for data with low security requirements. After the encryption is completed, in order to ensure the correctness and security of the data during the decryption process, the corresponding encryption context information is generated for the encrypted high-level security data, intermediate security data, and low-level security data. The encryption context information usually includes the encryption algorithm used, the key version, and the initialization vector (IV). For example, assume that the high-level security data set is encrypted using the AES-256 algorithm, the intermediate-level security data set is encrypted using the AES-128 algorithm, and the low-level security data set is encrypted using the RC4 algorithm. For each data set, its encryption context information is generated separately, such as "encryption algorithm: AES-256, key version: v1, initialization vector: IV1". This information is stored in a secure metadata area to ensure the integrity and decryptability of the encrypted data. The encrypted high-level security data, intermediate-level security data, low-level security data and their corresponding encryption context information are combined to obtain differentiated encrypted data. The structure of the differentiated encrypted data enables data of different security levels to be effectively separated and protected physically and logically. In a specific embodiment, the process of executing step 104 may specifically include the following steps:

[0082] Scanning the physical structure of the memory card to obtain a physical storage unit address mapping table corresponding to each security area, and classifying and sorting the differentially encrypted data according to the security level to obtain a second high-level security data set, a second intermediate-level security data set, and a second low-level security data set;

[0083] Initialize the microcontroller of the memory card, load the secure operating system, obtain a memory card control environment with access control function, and configure the secure operating system according to a preset access control policy to obtain an access control rule set;

[0084] Based on the hardware switch, each physical storage unit is isolated to obtain independent storage space, and a storage address is allocated to the second high-level security data set, and the second high-level security data set is written into the physical storage unit corresponding to the high security level to obtain physically isolated high-level security data;

[0085] Allocating storage addresses for the second intermediate security data set, and writing the second intermediate security data set into a physical storage unit corresponding to the intermediate security level to obtain physically isolated intermediate security data;

[0086] Allocating storage addresses for the second low-level security data set, and writing the second low-level security data set into a physical storage unit corresponding to a low security level to obtain physically isolated low-level security data;

[0087] Generate a physically isolated data structure according to the physically isolated high-level security data, the physically isolated intermediate-level security data, and the physically isolated low-level security data, and record each data access operation on the physically isolated data structure to obtain an access log;

[0088] After each data access operation, the preset operation instruction is executed to obtain the operation sequence, and the physical isolation data structure, access control rule set, access log and operation sequence are integrated to obtain the physical isolation and access control system.

[0089] Specifically, the physical structure of the memory card is scanned. By reading the sector and block information on the memory card, a mapping table of physical storage unit addresses corresponding to each security area is obtained. The mapping table lists the location and size of each physical storage unit in the memory card. The data is classified and sorted according to the security level of the differentially encrypted data, and the data is divided into a second high-level security data set, a second intermediate-level security data set, and a second low-level security data set. The data set is divided based on the sensitivity and protection requirements of the data so as to provide corresponding storage and security protection measures for data of different levels. The microcontroller of the memory card is initialized and a secure operating system is loaded. The secure operating system provides access control functions for the memory card and is the core of data security management. After the operating system is initialized, the system is configured according to a preset access control policy to obtain an access control rule set. These rules include permission management, data access records, and auditing to ensure the legality and security of data access. Use a hardware switch to isolate each physical storage unit. The use of a hardware switch can ensure that data of different security levels are stored in independent storage spaces to prevent confusion and cross-access of data of different levels. The second high-level security data set is allocated storage addresses, and the data is written into the corresponding high-security level physical storage units to form physically isolated high-level security data. These storage units are usually located in the core area of ​​the memory card and are subject to the most stringent access control. Similarly, the second intermediate-level security data set is allocated storage addresses, and the data is stored in the medium-level physical storage units. These units provide higher security protection, but their access control measures may be slightly looser than those of the high-level security units. For the second low-level security data set, it is written into the low-level physical storage units. These units are used to store data with lower security requirements and provide basic protection measures. After the data is stored, a physically isolated data structure is generated based on the physically isolated high-level security data, the physically isolated intermediate-level security data, and the physically isolated low-level security data. The data structure describes the storage location, size, and encryption status of each security level data, ensuring that data of different security levels can be clearly identified and distinguished during data access and management. Each data access operation is recorded in the access log, which includes detailed information such as the time of access, data type, operation type, and results. Access logs are the basis of system auditing and security monitoring, helping to detect and prevent unauthorized access and potential security threats. After each data access operation, the system will execute preset operation instructions, which may include data backup, log update, access permission adjustment, etc. By executing these operation instructions, data consistency and security are maintained, while providing support for possible recovery operations. Integrate the physical isolation data structure, access control rule set, access log and operation sequence to form a complete physical isolation and access control system.

[0090] In a specific embodiment, the process of executing step 105 may specifically include the following steps:

[0091] Compare the system clock of the physical isolation and access control system with the preset update cycle to obtain a key update trigger signal, and start the secure random number generator according to the key update trigger signal to obtain a random seed for key update;

[0092] Based on the random seed, the existing key set is replaced and reorganized to obtain a preliminary updated key set, and the preliminary updated key set is extended to obtain a strengthened new key set;

[0093] According to the predefined key sharding strategy, the high security level key in the enhanced new key set is sharded to obtain multiple key fragments;

[0094] Based on the threshold cryptographic scheme, the reconstruction rules of key fragments are set to obtain the key reconstruction protocol, and based on the key distribution technology, the target key is generated, and the target key is merged with the enhanced new key set to obtain the updated key set;

[0095] A unique version number is assigned to each key in the updated key set, and a corresponding key version mapping table is generated. At the same time, based on the rolling update strategy, the stored encrypted data is re-encrypted to obtain a data set encrypted with the new key, and a key update log containing the update time, impact scope, and hash values ​​of the old and new keys is generated and encrypted for storage to obtain a traceable key update record.

[0096] Specifically, the system clock of the physical isolation and access control system is monitored and compared with the preset key update cycle. When the system clock reaches or exceeds the preset update cycle, a key update trigger signal is generated. After this signal is triggered, the system starts the secure random number generator to generate a random seed for key update. Based on the generated random seed, the existing key set is permuted and reorganized to form a preliminary updated key set. By randomly permuting or combining the existing keys, the structure and content of the original keys are changed to prevent the keys from being predicted or deciphered. The preliminary updated key set is key stretched to enhance its security by extending the key length or complexity. Use key stretching technology such as PBKDF2, bcrypt or scrypt to extend the original key into a longer and more complex new key set. According to the predefined key sharding strategy, high security level keys are sharded. A complete key is divided into multiple independent parts, namely key fragments. These fragments are stored independently, so that even if some fragments are stolen, the attacker cannot restore the complete key. Assuming that a key is divided into n fragments, each fragment can be expressed as . Based on the threshold cryptographic scheme, reconstruction rules are set for these key fragments to form a key reconstruction protocol. The threshold cryptographic scheme stipulates that the complete key can only be reconstructed when at least k key fragments are available at the same time. This scheme greatly improves the security and reliability of the key and prevents unauthorized key reconstruction. Using key distribution technology, the key fragments are securely distributed and stored in different security areas or devices. The protection of the key is enhanced through decentralized storage. Based on the distributed fragments, the system generates the target key and merges it with the enhanced new key set to obtain the final updated key set. For each key in the updated key set, a unique version number is assigned. The version number is used to identify the update history and version control of the key, which is convenient for future auditing and management. A key version mapping table is generated, which records the version number, generation time, encryption algorithm used, and other detailed information of each key. Based on the rolling update strategy, the stored encrypted data is re-encrypted. The rolling update strategy allows the encrypted data to be gradually updated without affecting the normal operation of the system, ensuring the availability and consistency of the data during the update process. During the re-encryption process, the data is encrypted using the new key set to generate a new data set. Generate a key update log containing the update time, impact scope, and hash values ​​of the old and new keys. The log records each key update and provides a basis for future audits and security analysis. To prevent the log from being tampered with, it is encrypted and stored to ensure the integrity and security of the log, forming a traceable key update record to ensure the transparency and security of key management.

[0097] In a specific embodiment, the process of executing step 106 may specifically include the following steps:

[0098] Scan the differentially encrypted data stored in the physical storage unit to obtain a set of data blocks to be verified, and perform parallel hash calculations on the set of data blocks to be verified based on multiple hash algorithms to obtain a current hash value set;

[0099] Extracting a pre-saved hash value of a first data block from a secure storage area, and comparing the hash value of the first data block with a current hash value set to obtain a preliminary integrity verification result;

[0100] Analyze the preliminary integrity verification results, identify a list of suspicious data blocks, and extract corresponding backup data from local backup or remote secure storage based on the list of suspicious data blocks to obtain a candidate recovery data set;

[0101] Based on the error correction coding technology, the candidate recovery data set is error detected and corrected to obtain a preliminary recovered data block, and the pre-stored second data block hash value is obtained. The second data block hash value and the preliminary recovered data block are double-verified to obtain the verification result and the final recovered data block; based on the corresponding key in the updated key set, the final recovered data block is decrypted to obtain the recovered data.

[0102] Specifically, the differentially encrypted data stored in the physical storage unit is scanned to obtain a set of data blocks to be verified. The data in the memory card usually exists in the form of blocks, and each data block needs to be checked for integrity. In order to improve the accuracy and efficiency of verification, parallel hash calculations are performed on the set of data blocks to be verified based on multiple hash algorithms to reduce the collision risk that may exist in a single hash algorithm. The diversity of hash algorithms enhances the verification effect of data integrity. The calculated hash value set is the current hash value set, which is expressed as Extract the pre-saved first data block hash value from the secure storage area. These hash values ​​are calculated and saved when the data is first stored or last verified, and are expressed as The pre-saved hash value is compared with the current hash value set to check whether the data block has been tampered with or damaged during the storage process. The result of the comparison process forms a preliminary integrity verification result, which is expressed as .if and If the data block matches, the data block is considered complete; otherwise, the data block may have been modified or damaged. Based on the preliminary integrity verification results, a list of suspicious data blocks is analyzed and identified. Suspicious data blocks are those data blocks whose hash values ​​do not match expectations, and the data integrity may be damaged due to hardware failure, data tampering or other reasons. According to the list of suspicious data blocks, the corresponding backup data is extracted from the local backup or remote secure storage to form a candidate recovery data set. The backup data is a redundant copy of the original data, which is used for recovery when the data is damaged. Error detection and correction are performed on the candidate recovery data set based on error correction coding technology. Commonly used error correction coding technologies include Hamming code, Reed-Solomon code, etc., which can detect and repair errors within a certain range and generate preliminary recovered data blocks. The preliminary recovered data block then obtains the pre-stored second data block hash value, which is the correct hash value of the data before recovery. The hash value is double-verified with the preliminary recovered data block to obtain the final verification result and the recovered data block. The final verification result ensures the integrity and consistency of the recovered data. The corresponding key in the updated key set is used to decrypt the final recovered data block. The updated key set is generated by the system during the key update cycle, ensuring the high strength and security of the key. Through the decryption process, the recovered data can be read and used.

[0103] The above describes the data security storage method in the embodiment of the present invention. The following describes the data security storage system in the embodiment of the present invention. Figure 2 , an embodiment of the data security storage system in the embodiment of the present invention includes:

[0104] A partition module 201 is used to partition the memory card securely to obtain multiple security areas, each of which has a unique partition identifier and an initial encryption key;

[0105] A classification module 202, used to identify and classify the security level of the data to be written, and obtain classified data with security level labels and corresponding metadata packets;

[0106] The encryption module 203 is used to implement multiple encryption strategies on the classified data according to the security level label and the initial encryption key to obtain differentially encrypted data and encryption context information thereof;

[0107] Storage module 204, used to implement physical isolation and access control processing on the differentially encrypted data, and store the differentially encrypted data in a physical storage unit corresponding to the security area;

[0108] An update module 205 is used to dynamically manage and update the initial encryption key and encryption context information to obtain an updated key set and a corresponding key version mapping table;

[0109] The verification module 206 is used to perform integrity verification and recovery processing on the differentially encrypted data stored in the physical storage unit based on the updated key set, and obtain a verification result and recovered data.

[0110] Through the collaboration of the above components, the physical isolation and differentiated protection of data are achieved by securely partitioning the memory card and assigning a unique identifier and initial encryption key to each area, greatly improving the security of data storage. Feature extraction and extreme learning machine models are used to identify and classify the security level of the data to be written, ensuring that data of different types and sensitivities are protected at the corresponding level. Differentiated multiple encryption strategies are implemented according to the security level of the data, such as data sharding, obfuscation and multi-layer encryption for high-security data, which effectively improves the security of the data. Hardware isolation and access control strategies are used to further enhance the security of the data, effectively preventing unauthorized access and data leakage. The initial encryption key and encryption context information are dynamically managed and updated, which improves the system's anti-attack capability and reduces the risk of key leakage. Through a variety of hash algorithms and error correction coding technologies, the integrity verification and recovery processing of the stored data are achieved, ensuring the reliability and availability of the data. This method comprehensively considers multiple security levels, has good flexibility and scalability, and can be adjusted and optimized according to actual needs. Through extreme learning machines, threshold password schemes, and rolling update strategies, comprehensive protection of the entire life cycle of data is achieved.

[0111] above Figure 2 The data security storage system in the embodiment of the present invention is described in detail from the perspective of modular functional entities. The data security storage device in the embodiment of the present invention is described in detail from the perspective of hardware processing.

[0112] Figure 3 3 is a schematic diagram of the structure of a data security storage device provided by an embodiment of the present invention. The data security storage device 300 may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 310 (for example, one or more processors) and a memory 320, and one or more storage media 330 (for example, one or more mass storage device terminals) storing application programs 333 or data 332. Among them, the memory 320 and the storage medium 330 can be short-term storage or permanent storage. The program stored in the storage medium 330 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the data security storage device 300. Furthermore, the processor 310 may be configured to communicate with the storage medium 330, and execute a series of instruction operations in the storage medium 330 on the data security storage device 300 to implement the steps of the above-mentioned data security storage method.

[0113] The data security storage device 300 may also include one or more power supplies 340, one or more wired or wireless network interfaces 350, one or more input and output interfaces 360, and / or one or more operating systems 331, such as Windows Serve, Mac OS X, Unix, Linux, FreeBSD, etc. It will be appreciated by those skilled in the art that Figure 3 The illustrated data security storage device structure does not constitute a limitation on the data security storage device provided by the present invention, and may include more or fewer components than illustrated, or a combination of certain components, or a different arrangement of components.

[0114] The present invention also provides a memory card, which may be a non-volatile memory card or a volatile memory card. Instructions are stored in the memory card, and when the instructions are executed on a computer, the computer executes the steps of the data security storage method.

[0115] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, systems and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0116] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the whole or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0117] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data security storage method, characterized in that: The method comprises: The method comprises the following steps: performing security partitioning on a memory card to obtain a plurality of security areas, each of which has a unique partition identifier and an initial encryption key; specifically comprising: detecting the total capacity of the memory card to obtain the size of available storage space, and dividing and calculating the size of the available storage space according to a preset security level ratio to obtain a capacity allocation scheme for a high security level area, a medium security level area, a low security level area, and a public area; analyzing the physical structure of the memory card to obtain a sector distribution map of the memory card, and performing physical partitioning processing on the memory card according to the capacity allocation scheme and the sector distribution map to obtain a plurality of security areas; generating a unique partition identifier for each of the security areas; The method comprises the steps of: obtaining a partition identifier of the storage card, obtaining a partition identifier set corresponding to each security area, and calling a key generation algorithm of different strengths according to the security level of each security area to obtain an initial encryption key set corresponding to the security area; performing association and binding processing on the partition identifier set and the initial encryption key set to obtain a partition-key mapping table, and generating partition table information of the storage card according to the physical location information of the security area and the partition-key mapping table; encrypting the partition table information to obtain encrypted partition table information, and writing the encrypted partition table information into the boot sector of the storage card to complete the initialization of the security partition of the storage card; Identify and classify the security level of the data to be written, and obtain classified data with security level labels and corresponding metadata packages; According to the security level label and the initial encryption key, multiple encryption strategies are implemented on the classified data to obtain differentiated encrypted data and its encryption context information; specifically including: according to the security level label, the classified data is hierarchically processed to obtain a first high-level security data set, a first intermediate-level security data set and a first low-level security data set; data slicing is performed on the first high-level security data set to obtain multiple data fragments, random mask data is generated, and an XOR operation is performed on the data fragments to obtain obfuscated data fragments; based on a high-intensity symmetric encryption algorithm, the obfuscated data fragments are first-layer encrypted to obtain encrypted high-level security data, and the symmetric key used for the first-layer encryption is encrypted using an asymmetric encryption algorithm. The encrypted data is encrypted to obtain an encrypted symmetric key; the first intermediate security data set is encrypted based on a single-layer high-intensity symmetric encryption algorithm to obtain encrypted intermediate security data, and the first low-level security data set is encrypted using a lightweight encryption algorithm to obtain encrypted low-level security data; corresponding encryption context information is generated for the encrypted high-level security data, the encrypted intermediate security data and the encrypted low-level security data, respectively, and the encryption context information includes the encryption algorithm used, the key version and the initialization vector; the encrypted high-level security data, the encrypted intermediate security data, the encrypted low-level security data and their corresponding encryption context information are combined to obtain differential encrypted data; Implementing physical isolation and access control processing on the differentially encrypted data, and storing the differentially encrypted data in a physical storage unit of a corresponding security area; specifically comprising: scanning the physical structure of the memory card to obtain a physical storage unit address mapping table corresponding to each security area, and classifying and arranging the differentially encrypted data according to the security level to obtain a second high-level security data set, a second intermediate-level security data set, and a second low-level security data set; initializing the microcontroller of the memory card, loading a security operating system, obtaining a memory card control environment with an access control function, and configuring the security operating system according to a preset access control policy to obtain an access control rule set; isolating each physical storage unit based on a hardware switch to obtain independent storage spaces, and allocating storage addresses for the second high-level security data set, and writing the second high-level security data set into a physical storage unit corresponding to a high security level; a storage unit to obtain physically isolated high-level security data; allocate storage addresses for the second intermediate-level security data set, write the second intermediate-level security data set into a physical storage unit corresponding to the medium security level, and obtain physically isolated intermediate-level security data; allocate storage addresses for the second low-level security data set, write the second low-level security data set into a physical storage unit corresponding to the low security level, and obtain physically isolated low-level security data; generate a physically isolated data structure according to the physically isolated high-level security data, the physically isolated intermediate-level security data, and the physically isolated low-level security data, and record each data access operation on the physically isolated data structure to obtain an access log; execute a preset operation instruction after each data access operation to obtain an operation sequence, and integrate the physically isolated data structure, the access control rule set, the access log, and the operation sequence to obtain a physical isolation and access control system; Dynamically manage and update the initial encryption key and the encryption context information to obtain an updated key set and a corresponding key version mapping table; Based on the updated key set, integrity verification and recovery processing are performed on the differentially encrypted data stored in the physical storage unit to obtain a verification result and recovered data.

2. The data security storage method according to claim 1, characterized in that: The security level identification and classification of the data to be written are performed to obtain classified data with security level labels and corresponding metadata packets, including: Perform feature extraction processing on the data to be written to obtain a feature vector containing data type, data source, and data structure information, and perform matching analysis on the feature vector according to a preset data feature library to obtain an initial data category; Based on the pre-trained extreme learning machine model, the initial data category is deeply analyzed to obtain the target data category, and according to the target data category and the preset security level mapping rule, the security level of the data to be written is evaluated to obtain the initial security level label; Quantitatively calculate the usage frequency and importance of the data to be written to obtain a data value score, and comprehensively evaluate the data to be written based on the initial security level label and the data value score to obtain a security level label; Performing summary calculation on the data to be written to obtain data summary information, and combining the security level label, the data summary information and a current timestamp to obtain a metadata package; The data to be written and the metadata package are associated and bound to obtain classified data with a security level label.

3. The data security storage method according to claim 2, characterized in that: The pre-trained extreme learning machine model performs a deep analysis on the initial data category to obtain a target data category, and performs a security level assessment on the data to be written according to the target data category and a preset security level mapping rule to obtain an initial security level label, including: One-hot encoding is performed on the initial data category through a pre-trained extreme learning machine model to obtain an input layer neuron activation value; Based on the randomly generated weight matrix, a linear transformation is performed on the neuron activation values ​​of the input layer to obtain the input values ​​of the hidden layer, and a nonlinear activation operation is performed on the input values ​​of the hidden layer to obtain the output values ​​of the hidden layer; Based on the generalized inverse matrix algorithm, the optimal weight between the output value of the hidden layer and the target output is calculated to obtain an output layer weight matrix, and based on the output layer weight matrix, the output value of the hidden layer is linearly combined to obtain the original output value of the output layer; Performing a softmax function operation on the original output value of the output layer to obtain the probability distribution of each target data category, and based on the probability distribution, selecting the category with the highest probability as the prediction result to obtain the target data category; According to the pre-established data category and security level mapping rules, the target data category is searched and matched to obtain the corresponding security level value; The security level value and the sensitivity index of the data to be written are weighted averaged to obtain a comprehensive security score, and based on a preset security score threshold, the comprehensive security score is discretized to obtain an initial security level label.

4. The data security storage method according to claim 1, characterized in that: The dynamically managing and updating the initial encryption key and the encryption context information to obtain an updated key set and a corresponding key version mapping table includes: Comparing the system clock of the physical isolation and access control system with a preset update period to obtain a key update trigger signal, and starting a secure random number generator according to the key update trigger signal to obtain a random seed for key update; Based on the random seed, the existing key set is replaced and reorganized to obtain a preliminary updated key set, and the preliminary updated key set is key extended to obtain a strengthened new key set; According to a predefined key sharding strategy, the high security level key in the enhanced new key set is sharded to obtain a plurality of key fragments; Based on the threshold cryptographic scheme, a reconstruction rule is set for the key fragments to obtain a key reconstruction protocol, and based on the key distribution technology, a target key is generated, and the target key is merged with the enhanced new key set to obtain an updated key set; A unique version number is assigned to each key in the updated key set, and a corresponding key version mapping table is generated. At the same time, based on the rolling update strategy, the stored encrypted data is re-encrypted to obtain a data set encrypted with the new key, and a key update log containing the update time, impact scope, and hash values ​​of the old and new keys is generated and encrypted for storage to obtain a traceable key update record.

5. The data security storage method according to claim 4, characterized in that: The step of performing integrity verification and recovery processing on the differentially encrypted data stored in the physical storage unit based on the updated key set to obtain a verification result and recovered data includes: Scanning the differentially encrypted data stored in the physical storage unit to obtain a set of data blocks to be verified, and performing parallel hash calculations on the set of data blocks to be verified based on multiple hash algorithms to obtain a current hash value set; Extracting a pre-saved first data block hash value from the secure storage area, and comparing the first data block hash value with the current hash value set to obtain a preliminary integrity verification result; Analyzing the preliminary integrity verification result, identifying a list of suspicious data blocks, and extracting corresponding backup data from a local backup or a remote secure storage according to the list of suspicious data blocks to obtain a candidate recovery data set; Based on the error correction coding technology, error detection and correction are performed on the candidate recovery data set to obtain a preliminary recovered data block, and a pre-stored hash value of a second data block is obtained, and the second data block hash value is secondary verified with the preliminary recovered data block to obtain a verification result and a final recovered data block; Based on the corresponding key in the updated key set, the finally restored data block is decrypted to obtain restored data.

6. A data security storage system, characterized in that: The system is used to execute the data security storage method according to any one of claims 1 to 5, comprising: The partition module is used to partition the memory card securely to obtain multiple security areas, each of which has a unique partition identifier and an initial encryption key; specifically comprising: detecting the total capacity of the memory card to obtain the size of the available storage space, and dividing and calculating the size of the available storage space according to a preset security level ratio to obtain a capacity allocation scheme for a high security level area, a medium security level area, a low security level area and a public area; analyzing the physical structure of the memory card to obtain a sector distribution map of the memory card, and physically partitioning the memory card according to the capacity allocation scheme and the sector distribution map to obtain multiple security areas; and partitioning each of the security areas. Generate a unique partition identifier to obtain a partition identifier set corresponding to the security area one by one, and call a key generation algorithm of different strengths according to the security level of each security area to obtain an initial encryption key set corresponding to the security area; associate and bind the partition identifier set and the initial encryption key set to obtain a partition-key mapping table, and generate partition table information of the memory card according to the physical location information of the security area and the partition-key mapping table; encrypt the partition table information to obtain encrypted partition table information, and write the encrypted partition table information into the boot sector of the memory card to complete the initialization of the security partition of the memory card; A classification module is used to identify and classify the security level of the data to be written, and obtain the classified data with security level labels and the corresponding metadata package; The encryption module is used to implement multiple encryption strategies on the classified data according to the security level label and the initial encryption key to obtain differentiated encrypted data and its encryption context information; specifically including: hierarchically processing the classified data according to the security level label to obtain a first high-level security data set, a first intermediate-level security data set and a first low-level security data set; performing data slicing processing on the first high-level security data set to obtain multiple data fragments, generating random mask data, and performing XOR operations on the data fragments to obtain obfuscated data fragments; based on a high-intensity symmetric encryption algorithm, performing first-layer encryption on the obfuscated data fragments to obtain encrypted high-level security data, and using an asymmetric encryption algorithm to encrypt the symmetric key used for the first-layer encryption The first intermediate security data set is encrypted with a single-layer high-intensity symmetric encryption algorithm to obtain encrypted intermediate security data, and the first low-level security data set is encrypted with a lightweight encryption algorithm to obtain encrypted low-level security data; corresponding encryption context information is generated for the encrypted high-level security data, the encrypted intermediate security data and the encrypted low-level security data, respectively, and the encryption context information includes the encryption algorithm used, the key version and the initialization vector; the encrypted high-level security data, the encrypted intermediate security data, the encrypted low-level security data and their corresponding encryption context information are combined to obtain differential encrypted data; A storage module is used to implement physical isolation and access control processing on the differentially encrypted data, and store the differentially encrypted data in a physical storage unit of a corresponding security area; specifically comprising: scanning the physical structure of the storage card to obtain a physical storage unit address mapping table corresponding to each security area, and classifying and arranging the differentially encrypted data according to the security level to obtain a second high-level security data set, a second intermediate-level security data set, and a second low-level security data set; initializing the microcontroller of the storage card, loading a security operating system, obtaining a storage card control environment with an access control function, and configuring the security operating system according to a preset access control policy to obtain an access control rule set; isolating each physical storage unit based on a hardware switch to obtain independent storage space, and allocating storage addresses to the second high-level security data set, and writing the second high-level security data set into the corresponding high-security level to obtain physically isolated high-level security data; to allocate storage addresses for the second intermediate-level security data set, and to write the second intermediate-level security data set into a physical storage unit corresponding to the medium security level, and to obtain physically isolated intermediate-level security data; to allocate storage addresses for the second low-level security data set, and to write the second low-level security data set into a physical storage unit corresponding to the low security level, and to obtain physically isolated low-level security data; to generate a physically isolated data structure according to the physically isolated high-level security data, the physically isolated intermediate-level security data, and the physically isolated low-level security data, and to record each data access operation on the physically isolated data structure to obtain an access log; to execute a preset operation instruction after each data access operation to obtain an operation sequence, and to integrate the physically isolated data structure, the access control rule set, the access log, and the operation sequence to obtain a physical isolation and access control system; An update module, used to dynamically manage and update the initial encryption key and the encryption context information to obtain an updated key set and a corresponding key version mapping table; The verification module is used to perform integrity verification and recovery processing on the differentially encrypted data stored in the physical storage unit based on the updated key set to obtain a verification result and recovered data.

7. A memory card having instructions stored thereon, characterized in that: When the instructions are executed by the processor, the data security storage method according to any one of claims 1 to 5 is implemented.

Images