A data encryption backup storage system and method based on information security

Abstract

The present invention discloses a data encryption backup storage system and method based on information security. The system includes: a data input module for receiving data input by a user; an encryption module; a key management module connected to the encryption module; a backup storage module for storing encrypted data; an access control module connected to the backup storage module for controlling the reading, writing and deletion of data according to user authority; a security audit module for monitoring and recording the operating behavior of the system and detecting potential security threats; and a communication interface for transmitting data with an external device or network. The present invention adopts advanced encryption technology to ensure the security of data during transmission and storage, and uses distributed storage and redundancy mechanisms to improve the reliability and availability of data. In addition, the present invention also provides a complete key management and access control mechanism to ensure that only authorized users can access backup data.

Description

Technical Field

[0001] The present invention belongs to the field of data processing, and more specifically, it particularly relates to a data encryption backup storage system based on information security. At the same time, the present invention also relates to a data encryption backup storage method based on information security. Background Art

[0002] With the rapid development of information technology, data security and reliability have become one of the most concerned issues for enterprises and organizations. As an important means to ensure that data is not lost, data backup is particularly important. Traditional data backup methods usually involve copying data to physical storage media, such as hard drives, tapes, or optical disks, and then storing these backups in a safe location.

[0003] Although this approach can prevent data loss to a certain extent, it has several problems:

[0004] There is a risk of loss or theft during the transmission and storage of physical storage media. Once this happens, it may lead to the leakage of sensitive data. Traditional backup methods usually lack effective encryption measures. Even if the data is backed up, it is easy to be accessed by unauthorized personnel.

[0005] To solve the above problems, some network-based data backup solutions have appeared on the market, which allow users to back up data to remote servers or cloud storage services. However, these solutions still have security risks:

[0006] Data may be intercepted during transmission, and if it is not encrypted, the data content may be stolen;

[0007] Inadequate security measures by cloud storage service providers may lead to data leakage or illegal access;

[0008] Users have trust issues in cloud storage service providers and are concerned that their data may be misused or monitored. Summary of the invention

[0009] The purpose of the present invention is to solve the shortcomings existing in the prior art, and to propose a data encryption backup storage system and method based on information security, which adopts advanced encryption technology to ensure the security of data during transmission and storage, and uses distributed storage and redundancy mechanisms to improve data reliability and availability. In addition, the present invention also provides a complete key management and access control mechanism to ensure that only authorized users can access the backup data.

[0010] To achieve the above object, the present invention provides the following technical solutions:

[0011] A data encryption backup storage system based on information security, comprising:

[0012] A data input module, used for receiving data input by a user;

[0013] The encryption module is connected to the data input module and is used to encrypt the input data to generate encrypted data;

[0014] The key management module is connected to the encryption module and is used to generate, distribute and manage encryption keys to ensure the security and integrity of the keys;

[0015] A backup storage module, connected to the encryption module, for storing encrypted data and providing a data recovery function;

[0016] An access control module, connected to the backup storage module, is used to control the reading, writing and deletion operations of data according to user permissions;

[0017] Security audit module, used to monitor and record system operation behavior and detect potential security threats;

[0018] Communication interface, used for data transmission with external devices or networks.

[0019] Preferably, the data input module receives files or data streams uploaded by users and uses a checksum to ensure that the integrity of the data remains consistent before and after transmission;

[0020] The security audit module records logs of all key operations, including login attempts, file accesses, and system changes, and uses anomaly detection algorithms to analyze the logs to identify unusual behavior patterns.

[0021] Preferably, when the encryption module encrypts the input data, a symmetric encryption algorithm and an asymmetric encryption algorithm are combined to implement encryption processing. The specific encryption process is:

[0022] A pair of public and private keys are generated through an asymmetric encryption algorithm. The public key is made public, while only the private key administrator can access it.

[0023] Create a symmetric key using a pseudo-random number generator;

[0024] The sender obtains the receiver's public key and uses the receiver's public key to encrypt the newly generated symmetric key;

[0025] The sender uses the symmetric key to encrypt the data to be transmitted, and sends the encrypted data to the receiver through an insecure network.

[0026] After receiving the symmetric key ciphertext transmitted through asymmetric encryption, the receiver uses its own private key to decrypt it and restore the symmetric key. The receiver uses the restored symmetric key to decrypt the received ciphertext data and finally obtains the original data.

[0027] A data encryption backup storage method based on information security, using the above system, includes the following steps:

[0028] S1, receiving data input by the user through the data input module;

[0029] S2. Encrypt the data using the encryption module, and generate, distribute and manage encryption keys through the key management module;

[0030] S3, storing the encrypted data in a backup storage module;

[0031] S4. Control user access to data through an access control module;

[0032] S5. Use the security audit module to monitor and record system operations;

[0033] S6. Perform secure data transmission with external devices or networks through the communication interface.

[0034] Preferably, in step S1, the specific process is:

[0035] S11, the data input module receives the data input by the user and converts it into an internal format suitable for system processing;

[0036] S12. Use a checksum algorithm to check the data to ensure that the data has not been tampered with during transmission. The checksum algorithm formula can be expressed as:

[0037] ;

[0038] in, Indicates that a certain checksum algorithm is applied to the data; after the data is received, the checksum of the received data is calculated and compared with the checksum before sending. If they are consistent, it means that the data is complete; if they are inconsistent, it means that the data may have been tampered with or damaged during transmission;

[0039] S13. Clean the data input by the user to remove invalid, erroneous or incomplete data input to ensure the accuracy of subsequent processing;

[0040] S14. The received data is first placed in the cache before subsequent processing to prevent data loss caused by network fluctuations or excessive instantaneous system load. At the same time, the flow control algorithm is used to smooth the data flow and avoid system overload.

[0041] Preferably, in step S14, the flow control algorithm adopts a leaky bucket algorithm, which is expressed as:

[0042] ;

[0043] in, represents the water level of the leaky bucket at time t, represents the capacity of the leaky bucket, represents the input rate at time t;

[0044] Preferably, the specific process of step S14 is:

[0045] S141, setting a bucket of fixed capacity to store data packets or requests, and removing data from the bucket at a fixed rate;

[0046] S142, receiving a data packet or request from an external network, and determining whether there is enough space in the bucket to accommodate the newly arrived data; if the bucket is full, directly discarding the newly arrived data, otherwise, putting the data into the bucket;

[0047] S143, setting a timer to periodically remove data from the bucket according to a preset leakage rate. Each time an event occurs, a data packet is removed from the bucket, regardless of how much data is actually in the bucket. If the bucket is empty, no operation is performed.

[0048] S144, taking a data packet from the bucket, performing subsequent processing, and sending the processed data packet to a target address or another part of the system;

[0049] S145, monitor the status of the leaky bucket in real time, and dynamically adjust the bucket size and leakage rate according to the real-time monitoring results and system requirements to adapt to different network load conditions;

[0050] S146. For data discarded due to bucket fullness, a certain strategy is used to record or notify the source end to reduce data loss. The performance of the leaky bucket algorithm is improved by improving the structural design of the bucket, optimizing the accuracy of the timer, and other measures.

[0051] Preferably, step S2 also includes key update, key revocation and cancellation, and key recovery;

[0052] Key update: regularly update key pairs to reduce the risk of key cracking. At the same time, ensure that there is an overlap between the expiration of the old key and the effectiveness of the new key to avoid communication interruption caused by key update;

[0053] Key revocation and revocation refers to the establishment of a clear key revocation mechanism, which can promptly revoke and activate backup keys when keys are leaked or no longer used, as well as the maintenance of a key revocation list to record all revoked keys and regularly update the system to ensure its validity;

[0054] Key recovery: Establish a strict key recovery process to ensure that encryption operations can be quickly restored in the event of key loss or damage. At the same time, set up multiple verification and authorization mechanisms to ensure that only authorized personnel can perform key recovery operations.

[0055] Preferably, the specific process of step S5 is:

[0056] S51, determine the event type to be recorded and set the log record format;

[0057] S52. Real-time monitoring of events is performed through real-time monitoring tools. At the same time, a statistical analysis algorithm is used to identify abnormal behaviors. The calculation formula of the statistical analysis algorithm is:

[0058] ;

[0059] Where μ is the mean, σ is the standard deviation, xi is a single data point, and N is the total number of data points;

[0060] S53, when a potential security threat is detected, a security alert is generated, the collected logs are stored in a secure log management system, the security and integrity of the log data are ensured, and the log data is backed up regularly to prevent data loss or damage;

[0061] S54. Generate a detailed audit report based on the log data, outlining the security issues and vulnerabilities found, and providing corresponding repair suggestions.

[0062] The present invention provides a data encryption backup storage system and method based on information security. Compared with the prior art, the present invention has the following effects:

[0063] Enhanced data security: By combining symmetric encryption and asymmetric encryption algorithms, the present invention ensures the security of data during transmission; even if the data is transmitted in an insecure network, unauthorized users cannot decipher the data content;

[0064] Efficient key management: The design of the key management module makes the key generation, distribution and management process safe and efficient; the key update, revocation and cancellation mechanism further reduces the risk of key cracking and improves the overall security of the system;

[0065] Reliable data recovery: The backup storage module not only provides storage for encrypted data, but also supports data recovery functions; ensuring that users can quickly restore their data even in the event of data loss or damage;

[0066] Flexible access control: The access control module allows data reading, writing, and deletion operations to be controlled based on user permissions; fine-grained access control improves data security and prevents unauthorized access;

[0067] Comprehensive security audit: The security audit module provides system administrators with a powerful monitoring tool by monitoring and recording system operations and detecting potential security threats. It helps to detect and respond to security incidents in a timely manner and reduce the risk of data leakage.

[0068] Optimized data transmission: By adopting the leaky bucket algorithm, the present invention can smooth the data flow and avoid system overload; ensuring that the system can run stably even under high load conditions and reducing data loss caused by network fluctuations. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 This is a diagram of the data encryption backup storage system architecture based on information security of the present invention;

[0070] Figure 2 This is a flow chart of the data encryption backup storage method based on information security of the present invention:

[0071] Figure 3 A data flow chart of a data input module receiving user input in an embodiment of the present invention;

[0072] Figure 4 The figure is a flow chart of the steps of smoothing data flow in an embodiment of the present invention. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0074] The present invention provides a data encryption backup storage system and method based on information security, which not only improves the security and reliability of data, but also improves the operating efficiency and user experience of the system. These beneficial effects make the present invention have significant application value in the fields of data storage and information security.

[0075] like Figure 1 , the system part includes:

[0076] The data input module is used to receive data input by the user. The data input module receives files or data streams uploaded by the user and uses checksums to ensure that the integrity of the data is consistent before and after transmission.

[0077] The security audit module records logs of all critical operations, including login attempts, file access, and system changes, and uses anomaly detection algorithms to analyze logs and identify unusual behavior patterns.

[0078] The encryption module is connected to the data input module and is used to encrypt the input data to generate encrypted data;

[0079] Furthermore, when the encryption module encrypts the input data, it uses a combination of symmetric encryption algorithm and asymmetric encryption algorithm to implement encryption processing. The specific encryption process is:

[0080] A pair of public and private keys are generated through an asymmetric encryption algorithm. The public key is made public, while only the private key administrator can access it.

[0081] Create a symmetric key using a pseudo-random number generator;

[0082] The sender obtains the receiver's public key and uses the receiver's public key to encrypt the newly generated symmetric key;

[0083] The sender uses the symmetric key to encrypt the data to be transmitted, and sends the encrypted data to the receiver through an insecure network.

[0084] After receiving the symmetric key ciphertext transmitted through asymmetric encryption, the receiver uses its own private key to decrypt it and restore the symmetric key. The receiver uses the restored symmetric key to decrypt the received ciphertext data and finally obtains the original data.

[0085] The key management module is connected to the encryption module and is used to generate, distribute and manage encryption keys to ensure the security and integrity of the keys. The key management module is responsible for generating, distributing and managing encryption keys. It is also responsible for regularly updating keys to reduce the risk of key cracking. In addition, the module also has a key revocation and revocation mechanism to ensure that leaked or no longer used keys can be replaced in a timely manner.

[0086] The backup storage module is connected to the encryption module and is used to store the encrypted data and provide data recovery function; the encrypted data is sent to the backup storage module. This module is responsible for storing the data in a secure storage medium and supports data recovery function. The backup storage module can use distributed storage technology to improve data reliability and availability.

[0087] The access control module is connected to the backup storage module and is used to control the reading, writing and deletion of data according to user permissions. It uses a set of fine-grained access control policies to ensure that only authorized users can access the backup data.

[0088] The security audit module is used to monitor and record the system's operational behavior and detect potential security threats. The security audit module monitors and records the system's operational behavior, including login attempts, file access, and system changes. It uses anomaly detection algorithms to analyze logs and identify unusual behavior patterns, thereby promptly detecting potential security threats.

[0089] Communication interface is used for data transmission with external devices or networks; the communication interface allows the system to transmit data with external devices or networks. It ensures the security of data transmission and prevents data from being intercepted or tampered with during the transmission process.

[0090] This embodiment also provides a data encryption backup storage method based on information security, such as Figure 2 As shown, the method adopts the above system and includes the following steps:

[0091] S1, receiving data input by the user through the data input module;

[0092] Further, if Figure 3 As shown, in step S1, the specific process is:

[0093] S11, the data input module receives the data input by the user and converts it into an internal format suitable for system processing;

[0094] S12. Use a checksum algorithm to check the data to ensure that the data has not been tampered with during transmission. The checksum algorithm formula can be expressed as:

[0095] ;

[0096] in, Indicates that a certain checksum algorithm is applied to the data; after the data is received, the checksum of the received data is calculated and compared with the checksum before sending. If they are consistent, it means that the data is complete; if they are inconsistent, it means that the data may have been tampered with or damaged during transmission;

[0097] S13. Clean the data input by the user to remove invalid, erroneous or incomplete data input to ensure the accuracy of subsequent processing;

[0098] S14, putting the received data into the cache before subsequent processing to prevent data loss caused by network fluctuations or excessive instantaneous system load. At the same time, through the flow control algorithm, smooth the data flow and avoid system overload;

[0099] In step S14, the flow control algorithm adopts the leaky bucket algorithm, and the expression is:

[0100] ;

[0101] in, represents the water level of the leaky bucket at time t, represents the capacity of the leaky bucket, represents the input rate at time t;

[0102] It should be noted that if Figure 4 As shown, the specific process of step S14 is:

[0103] S141, setting a bucket of fixed capacity to store data packets or requests, and removing data from the bucket at a fixed rate;

[0104] S142, receiving a data packet or request from an external network, and determining whether there is enough space in the bucket to accommodate the newly arrived data; if the bucket is full, directly discarding the newly arrived data, otherwise, putting the data into the bucket;

[0105] S143, setting a timer to periodically remove data from the bucket according to a preset leakage rate. Each time an event occurs, a data packet is removed from the bucket, regardless of how much data is actually in the bucket. If the bucket is empty, no operation is performed.

[0106] S144, taking a data packet from the bucket, performing subsequent processing, and sending the processed data packet to a target address or another part of the system;

[0107] S145, monitor the status of the leaky bucket in real time, and dynamically adjust the bucket size and leakage rate according to the real-time monitoring results and system requirements to adapt to different network load conditions;

[0108] S146. For data discarded due to bucket fullness, a certain strategy is used to record or notify the source end to reduce data loss. The performance of the leaky bucket algorithm is improved by improving the structural design of the bucket, optimizing the accuracy of the timer, and other measures.

[0109] S2, encrypting data using an encryption module, and generating, distributing and managing encryption keys through a key management module; step S2 also includes key update, key revocation and revocation, and key recovery;

[0110] Key update: regularly update key pairs to reduce the risk of key cracking. At the same time, ensure that there is an overlap between the expiration of the old key and the effectiveness of the new key to avoid communication interruption caused by key update;

[0111] Key revocation and revocation refers to the establishment of a clear key revocation mechanism, which can promptly revoke and activate backup keys when keys are leaked or no longer used, as well as the maintenance of a key revocation list to record all revoked keys and regularly update the system to ensure its validity;

[0112] Key recovery: Establish a strict key recovery process to ensure that encryption operations can be quickly restored in the event of key loss or damage. At the same time, set up multiple verification and authorization mechanisms to ensure that only authorized personnel can perform key recovery operations.

[0113] S3, storing the encrypted data in a backup storage module;

[0114] Among them, in the data encryption backup storage system, storing the encrypted data in the backup storage module is a key step to ensure the persistent security of the data. The following is a detailed expanded description of this step:

[0115] Generation of encrypted data, before the data reaches the backup storage module, it first needs to be encrypted, which involves the use of one or more encryption algorithms to convert the original data into an unreadable form. The encryption process is completed in the encryption module and is intended to protect the confidentiality and integrity of the data during transmission and storage.

[0116] Data segmentation and compression: In order to optimize storage efficiency, encrypted data is usually segmented and processed. Data can be divided into small blocks, which helps to improve data processing flexibility and storage efficiency.

[0117] Optionally, the data may also be compressed using a compression algorithm to reduce storage space requirements and improve data transmission efficiency. Commonly used compression algorithms include GZIP, ZIP, and 7-Zip.

[0118] Generate a checksum,To ensure the integrity of the data, a checksum is calculated for each data block, which is then stored with the data and used in the future to verify whether the data block has been tampered with during storage or transmission.

[0119] Metadata management, the system will generate metadata related to encrypted data, including the size of the data block, checksum, version information and timestamp. This information is used for data management and retrieval, and to ensure the verification process of data integrity.

[0120] Data storage, encrypted and compressed data blocks will be sent to the backup storage module. This module is a distributed file system. Data blocks are written to the storage medium, and redundant storage strategies are usually used to improve data reliability and availability.

[0121] S4. Control user access to data through an access control module;

[0122] Furthermore, in the data encryption backup storage system, controlling user access to data through the access control module is a key step in ensuring data security. The following is a detailed expanded description of this step:

[0123] User Authentication,The access control module first requires the user to authenticate. This usually involves entering a username and password; during the verification process, the system will check whether the credentials provided by the user match the encrypted credentials stored in the user database. If they match, the user is allowed to enter the next step of the authorization stage.

[0124] Permission authorization: Based on the user's role and responsibilities, the system assigns specific permissions to each user, including reading, writing, modifying or deleting data in a specific data set; using advanced authorization models such as role-based access control or more dynamic access control policies to achieve fine-grained permission management.

[0125] Role definition, the system defines a series of roles, each role represents a specific set of permissions, and the role design should meet the principle of least privilege, that is, users can only obtain the minimum set of permissions required to complete their work.

[0126] Access request processing,When a user tries to access data, the access control module receives an access request, including user information, the requested operation, and the target data; the module will check the user's role and permissions to determine whether the operation is allowed. If the user has the authority to perform the requested operation, access is allowed; otherwise, access is denied.

[0127] S5. Use the security audit module to monitor and record system operations; the specific process of step S5 is as follows:

[0128] S51, determine the event type to be recorded and set the log record format;

[0129] S52. Real-time monitoring of events is performed through real-time monitoring tools. At the same time, a statistical analysis algorithm is used to identify abnormal behaviors. The calculation formula of the statistical analysis algorithm is:

[0130] ;

[0131] Where μ is the mean, σ is the standard deviation, xi is a single data point, and N is the total number of data points;

[0132] S53, when a potential security threat is detected, a security alert is generated, the collected logs are stored in a secure log management system, the security and integrity of the log data are ensured, and the log data is backed up regularly to prevent data loss or damage;

[0133] S54. Generate a detailed audit report based on the log data, outlining the security issues and vulnerabilities found, and providing corresponding repair suggestions.

[0134] S6. Perform secure data transmission with external devices or networks through the communication interface.

[0135] In summary, the present invention has the following effects:

[0136] Enhanced data security: By combining symmetric encryption and asymmetric encryption algorithms, the present invention ensures the security of data during transmission; even if the data is transmitted in an insecure network, unauthorized users cannot decipher the data content;

[0137] Efficient key management: The design of the key management module makes the key generation, distribution and management process safe and efficient; the key update, revocation and cancellation mechanism further reduces the risk of key cracking and improves the overall security of the system;

[0138] Reliable data recovery: The backup storage module not only provides storage for encrypted data, but also supports data recovery functions; ensuring that users can quickly restore their data even in the event of data loss or damage;

[0139] Flexible access control: The access control module allows data reading, writing, and deletion operations to be controlled based on user permissions; fine-grained access control improves data security and prevents unauthorized access;

[0140] Comprehensive security audit: The security audit module provides system administrators with a powerful monitoring tool by monitoring and recording system operations and detecting potential security threats. It helps to detect and respond to security incidents in a timely manner and reduce the risk of data leakage.

[0141] Optimized data transmission: By adopting the leaky bucket algorithm, the present invention can smooth the data flow and avoid system overload; ensuring that the system can run stably even under high load conditions and reducing data loss caused by network fluctuations.

[0142] Finally, it should be noted that the above are only preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A data encryption backup storage method based on information security, characterized in that: The specific steps of the method are: S1. Receive data input by the user through the data input module; specifically: S11, the data input module receives the data input by the user and converts it into an internal format suitable for system processing; S12. Use a checksum algorithm to check the data to ensure that the data has not been tampered with during transmission. The checksum algorithm formula can be expressed as: Checksum = f(Data); Among them, f(Data) indicates the application of a checksum algorithm to the data. After the data is received, the checksum of the received data is calculated and compared with the checksum before sending. If they are consistent, it means that the data is complete; if they are inconsistent, it means that the data may have been tampered with or damaged during transmission. S13. Clean the data input by the user to remove invalid, erroneous or incomplete data input to ensure the accuracy of subsequent processing; S14, the received data is first placed in the cache before subsequent processing to prevent data loss caused by network fluctuations or excessive instantaneous system load. At the same time, the flow control algorithm is used to smooth the data flow and avoid system overload; in step S14, the flow control algorithm adopts the leaky bucket algorithm, and the expression is: Bucket(t)=min(Capacity-Bucket(t-1), InputRate(t)); Among them, Bucket(t) represents the water level of the leaky bucket at time t, Capacity represents the capacity of the leaky bucket, and InputRate(t) represents the input rate at time t; S2. Encrypt the data using the encryption module, and generate, distribute and manage encryption keys through the key management module; S3, storing the encrypted data in a backup storage module; S4. Control user access to data through an access control module; S5. Use the security audit module to monitor and record system operations; S6. Perform secure data transmission with external devices or networks through the communication interface.

2. The data encryption backup storage method based on information security according to claim 1 is characterized in that: The specific process of step S14 is as follows: S141, setting a bucket of fixed capacity to store data packets or requests, and removing data from the bucket at a fixed rate; S142, receiving a data packet or request from an external network, and determining whether there is enough space in the bucket to accommodate the newly arrived data; if the bucket is full, directly discarding the newly arrived data, otherwise, putting the data into the bucket; S143, setting a timer to periodically remove data from the bucket according to a preset leakage rate. Each time an event occurs, a data packet is removed from the bucket, regardless of how much data is actually in the bucket. If the bucket is empty, no operation is performed. S144, taking a data packet from the bucket, performing subsequent processing, and sending the processed data packet to a target address or another part of the system; S145, monitor the status of the leaky bucket in real time, and dynamically adjust the bucket size and leakage rate according to the real-time monitoring results and system requirements to adapt to different network load conditions; S146. For data discarded due to bucket fullness, a certain strategy is used to record or notify the source end to reduce data loss. The performance of the leaky bucket algorithm is improved by improving the structural design of the bucket, optimizing the accuracy of the timer, and other measures.

3. The data encryption backup storage method based on information security according to claim 1 is characterized in that: Step S2 uses the encryption module to encrypt the data, and generates, distributes and manages the encryption key through the key management module, which also includes key update, key revocation and revocation, and key recovery; Key update: regularly update key pairs to reduce the risk of key cracking. At the same time, ensure that there is an overlap between the expiration of the old key and the effectiveness of the new key to avoid communication interruption caused by key update; Key revocation and suspension: Establish a clear key revocation mechanism to promptly revoke and activate backup keys when keys are leaked or no longer in use, maintain a key revocation list to record all revoked keys, and regularly update the system to ensure its validity; Key recovery: Establish a strict key recovery process to ensure that encryption operations can be quickly restored in the event of key loss or damage. At the same time, set up multiple verification and authorization mechanisms to ensure that only authorized personnel can perform key recovery operations.

4. The data encryption backup storage method based on information security according to claim 1 is characterized in that: Step S5 uses the security audit module to monitor and record system operations. The specific process is as follows: S51, determine the event type to be recorded and set the log record format; S52. Real-time monitoring of events is performed through real-time monitoring tools. At the same time, a statistical analysis algorithm is used to identify abnormal behaviors. The calculation formula of the statistical analysis algorithm is: Where μ is the mean, σ is the standard deviation, xi is a single data point, and N is the total number of data points; S53, when a potential security threat is detected, a security alert is generated, the collected logs are stored in a secure log management system, the security and integrity of the log data are ensured, and the log data is backed up regularly to prevent data loss or damage; S54. Generate a detailed audit report based on the log data, outlining the security issues and vulnerabilities found, and providing corresponding repair suggestions.

5. A data encryption backup storage system based on information security, the system is used to implement any method of claims 1-4, characterized in that: include: A data input module, used for receiving data input by a user; The encryption module is connected to the data input module and is used to encrypt the input data to generate encrypted data; The key management module is connected to the encryption module and is used to generate, distribute and manage encryption keys to ensure the security and integrity of the keys; A backup storage module, connected to the encryption module, for storing encrypted data and providing a data recovery function; An access control module, connected to the backup storage module, is used to control the reading, writing and deletion operations of data according to user permissions; Security audit module, used to monitor and record system operation behavior and detect potential security threats; Communication interface, used for data transmission with external devices or networks.

6. The data encryption backup storage system based on information security according to claim 5, characterized in that: The data input module receives files or data streams uploaded by users and uses checksums to ensure that the integrity of the data remains consistent before and after transmission; The security audit module records logs of all key operations, including login attempts, file accesses, and system changes, and uses anomaly detection algorithms to analyze the logs to identify unusual behavior patterns.

7. The data encryption backup storage system based on information security according to claim 5, characterized in that: When the encryption module encrypts the input data, it uses a combination of a symmetric encryption algorithm and an asymmetric encryption algorithm to implement encryption processing. The specific encryption process is as follows: A pair of public and private keys are generated through an asymmetric encryption algorithm. The public key is made public, while only the private key administrator can access it. Create a symmetric key using a pseudo-random number generator; The sender obtains the receiver's public key and uses the receiver's public key to encrypt the newly generated symmetric key; The sender uses the symmetric key to encrypt the data to be transmitted, and sends the encrypted data to the receiver through an insecure network. After receiving the symmetric key ciphertext transmitted through asymmetric encryption, the receiver uses its own private key to decrypt it and restore the symmetric key. The receiver uses the restored symmetric key to decrypt the received ciphertext data and finally obtains the original data.

Images