Confidential data secure collaborative storage system and method based on multi-party secure computing

Abstract

The present invention discloses a confidential data secure collaborative storage system and method based on multi-party secure computing, the method comprising: slicing confidential data to obtain i slice data, encrypting the i slice data to form i first encrypted data, and storing the i first encrypted data on i different storage nodes respectively; collecting environmental data of each storage node; analyzing the environmental data to generate a node evaluation coefficient; judging whether to generate an encryption conversion instruction according to the node evaluation coefficient; inputting the node evaluation coefficient into a node evaluation coefficient-encryption algorithm and a mapping table according to the encryption conversion instruction to obtain a changed encryption algorithm; inputting the changed encryption algorithm name and node performance characteristic data into a pre-trained storage strategy model to obtain an evaluation result of the storage node; the system can adapt to changes in the node environment, thereby ensuring a balance between data security and system performance.

Description

Technical Field

[0001] The present invention relates to the technical field of secure data storage, and in particular to a system and method for secure collaborative storage of confidential data based on multi-party secure computing. Background Art

[0002] With the rapid development of the Internet and cloud computing technology, data storage and transmission have become more common and important. However, data security issues have become increasingly prominent, especially for enterprises and institutions, the protection of confidential data is particularly important. Traditional storage systems and encryption methods are unable to cope with complex and changing network environments and increasingly rampant network attacks; existing technologies have the following problems:

[0003] Most existing encryption schemes are static and cannot be dynamically adjusted according to environmental changes of storage nodes, making it difficult to balance system performance and data security.

[0004] The selection of encryption algorithms and the management of storage nodes usually require manual intervention, which increases the complexity of operations and the risk of errors.

[0005] Therefore, it is an urgent problem for those skilled in the art to propose a secure collaborative storage system and method for confidential data based on multi-party secure computing to solve the difficulties existing in the prior art. Summary of the invention

[0006] The purpose of the present invention is to provide a confidential data secure collaborative storage system and method based on multi-party secure computing to address the deficiencies in the background technology.

[0007] In order to achieve the above object, the present invention provides the following technical solutions: a confidential data secure collaborative storage system and method based on multi-party secure computing, comprising: slicing confidential data to obtain i slice data, encrypting the i slice data to form i first encrypted data, and storing the i first encrypted data on i different storage nodes respectively;

[0008] Collect environmental data of each storage node;

[0009] Analyze environmental data to generate node evaluation coefficients;

[0010] According to the node evaluation coefficient, determine whether to generate an encryption conversion instruction;

[0011] According to the encryption conversion instruction, the node evaluation coefficient is input into the node evaluation coefficient-encryption algorithm and mapping table to obtain the changed encryption algorithm;

[0012] The changed encryption algorithm name and node performance characteristic data are input into the pre-trained storage policy model to obtain the evaluation results of the storage node, including execution and replacement;

[0013] If the evaluation result is replacement, the name of the changed encryption algorithm will be sent to the judgment model deployed on i-1 storage nodes to obtain the judgment result. When the judgment result is executable, the corresponding first encrypted data will be selected to be migrated to any storage node corresponding to the judgment result that is executable, the first encrypted data will be decrypted, and then encrypted using the changed encryption algorithm; when the judgment result is not executable, it will be reported.

[0014] Furthermore, the node performance characteristic data includes CPU usage, number of CPU cores, CPU main frequency, hardware acceleration support, memory usage, disk I / O rate and node average load.

[0015] Furthermore, the training method of the storage strategy model includes:

[0016] Collect k groups of evaluation data in advance, the evaluation data including evaluation feature data and evaluation results, the evaluation feature data including the name of the changed encryption algorithm and node performance feature data; convert the evaluation data into a set of first feature vectors;

[0017] Each group of first feature vectors is used as the input of the storage policy model. The storage policy model takes a group of predicted evaluation results corresponding to each group of evaluation feature data as output, and takes the actual evaluation results corresponding to each group of evaluation feature data as the prediction target; minimizing the sum of prediction errors of all evaluation feature data is used as the training target; the storage policy model is trained until the sum of prediction errors reaches convergence, and the training is stopped; the storage policy model is a deep neural network model.

[0018] Furthermore, the training method of the judgment model includes:

[0019] Collect multiple groups of judgment data in advance, the judgment data includes judgment feature data and judgment results, the judgment feature data includes the name of the changed encryption algorithm, the current node performance feature data of the storage node where the judgment model is located, and the judgment results.

[0020] The judgment data is converted into a set of second feature vectors, the second feature vectors are divided into a training set and a test set, the judgment feature data in the second feature vectors are used as the input of the judgment model, the judgment results in the training set are used as the output of the judgment model, the judgment model is trained to obtain an initial judgment model, the initial judgment model is tested using the test set, and a judgment model that meets the preset accuracy is output, the judgment model is a decision tree, random forest or support vector machine, etc.

[0021] Furthermore, it is characterized in that the calculation formula of the prediction error is Z K =(α K -μ K ) 2, where Z K is the prediction error, K is the group number of the evaluation feature data, α K is the prediction evaluation result corresponding to the Kth group of evaluation feature data, μ K is the actual evaluation result corresponding to the Kth group of evaluation feature data.

[0022] Furthermore, the environmental data includes CPU usage, memory usage, disk I / O rate, network traffic, security score and system log score.

[0023] Furthermore, it is characterized in that the node evaluation coefficient is obtained by weighted summing up the CPU utilization, memory utilization, disk I / O rate, network traffic, security score and system log score.

[0024] Furthermore, the node evaluation coefficient is compared with a preset node evaluation coefficient threshold. If the node evaluation coefficient is greater than or equal to the node evaluation coefficient threshold, an encryption conversion instruction is generated; if the node evaluation coefficient is less than the node evaluation coefficient threshold, no encryption conversion instruction is generated.

[0025] Furthermore, in the node evaluation coefficient-encryption algorithm and mapping table, every two node evaluation coefficients form an interval, one interval corresponds to one encryption algorithm, and one interval has a maximum node evaluation coefficient and a minimum node evaluation coefficient.

[0026] A confidential data secure collaborative storage system based on multi-party secure computing, used to execute the confidential data secure collaborative storage method based on multi-party secure computing, the system comprising:

[0027] A first processing module is used to slice the confidential data to obtain i slice data, encrypt the i slice data to form i first encrypted data, and store the i first encrypted data on i different storage nodes respectively;

[0028] Monitoring module, used to collect environmental data of each storage node;

[0029] The first analysis module is used to analyze environmental data and generate node evaluation coefficients;

[0030] The second processing module determines whether to generate an encryption conversion instruction according to the node evaluation coefficient;

[0031] An encryption conversion module, used for inputting the node evaluation coefficient into the node evaluation coefficient-encryption algorithm and mapping table according to the encryption conversion instruction, to obtain a changed encryption algorithm;

[0032] The storage policy module inputs the changed encryption algorithm name and node performance characteristic data into the pre-trained storage policy model to obtain the evaluation results of the storage node, including execution and replacement;

[0033] The storage node selection module, if the evaluation result is replacement, will send the name of the changed encryption algorithm to the judgment model deployed on i-1 storage nodes to obtain the judgment result. If the judgment result is executable, the corresponding first encrypted data will be selected to migrate to any storage node corresponding to the judgment result that is executable, decrypt the first encrypted data, and then encrypt it using the changed encryption algorithm. If the judgment result is not executable, it will be reported.

[0034] The present invention provides a system and method for secure collaborative storage of confidential data based on multi-party secure computing. The technical effects and advantages are as follows:

[0035] By generating a node evaluation coefficient based on the node's environmental data and deciding whether the encryption algorithm needs to be replaced based on the evaluation coefficient, dynamic encryption adjustment is achieved to adapt to changes in the node environment and ensure a balance between data security and system performance. The encryption algorithm is adjusted according to the computing power and load of the storage node to effectively reduce node latency and resource consumption and improve the overall performance of the system. Through pre-trained storage strategy models and judgment models, the evaluation and selection of storage nodes are automatically realized, reducing manual intervention and improving the intelligence level of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0037] Figure 1 A schematic diagram of a confidential data secure collaborative storage system based on multi-party secure computing of the present invention;

[0038] Figure 2 This is a flow chart of the method for secure collaborative storage of confidential data based on multi-party secure computing of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] It should be noted that when an element is referred to as being "fixed to" another element, it may be directly on the other element or there may be an intermediate element. When an element is considered to be "connected to" another element, it may be directly connected to the other element or there may be an intermediate element at the same time.

[0041] Example 1

[0042] like Figure 1 As shown, this embodiment is a confidential data secure collaborative storage system based on multi-party secure computing, including a first processing module, a monitoring module, a first analysis module, a second processing module, an encryption conversion module, a storage policy module and a storage node selection module, which are connected by wire and / or wirelessly.

[0043] The first processing module is used to slice the confidential data to obtain i slice data, encrypt the i slice data to form i first encrypted data, and store the i first encrypted data on i different storage nodes respectively.

[0044] The monitoring module is used to collect environmental data of each storage node; the environmental data includes CPU usage, memory usage, disk I / O rate, network traffic, security score and system log score; among them, CPU usage, memory usage, disk I / O rate and network traffic are all obtained through monitoring tools such as Node Exporter.

[0045] The security score uses security monitoring tools such as OSSEC / Wazuh to detect abnormal logins, unauthorized access, malware and other events, and calculates the security score. Each abnormal event adds 1 point. Abnormal events include abnormal logins, unauthorized access, and malware.

[0046] System log scoring queries log data through the Elasticsearch API and calculates log scores based on error events; for example, you can define each error event to add 1 point.

[0047] When the environment of a storage node changes, including increased security threats, changes in performance requirements, updates to regulatory requirements, etc., real-time adjustment of the encryption algorithm can dynamically adapt to these changes to ensure data security and system efficiency: When the storage node environment becomes unreliable, immediately changing the encryption method can prevent data leakage or theft; Optimize performance: According to the computing power and load of the storage node, adjust the encryption algorithm to optimize system performance and reduce latency and resource consumption.

[0048] The first analysis module is used to analyze environmental data and generate node evaluation coefficients.

[0049] The node evaluation coefficient is obtained by weighted summing up the CPU usage, memory usage, disk I / O rate, network traffic, security score and system log score.

[0050] The specific method for generating node evaluation coefficients is as follows:

[0051]

[0052] EF in the formula i is the node evaluation coefficient of the i-th storage node; is the CPU usage of the i-th storage node; is the memory usage of the i-th storage node; is the disk I / O rate of the i-th storage node; is the network traffic of the i-th storage node; Security scorei Give the security score of the i-th storage node; The system log score of the i-th storage node; the CPU usage, memory usage, disk I / O rate, network traffic, security score, and system log score are standardized to a range between 0 and 1. CPU 、w Memory 、w DiskIO 、w Network 、w Security 、w Log , are the weights of each indicator; the weights should be adjusted according to actual needs and importance.

[0053] w CPU =0.2, w Memory =0.2, w DiskIO =0.2, w Network =0.2, w Security =0.1, w Log Taking 0.1 as an example; high CPU usage (close to 1) means that the node load is high, the EF value increases, and a lighter encryption algorithm is needed; high memory usage (close to 1) means that memory resources are tight, the EF value increases, and a more efficient encryption algorithm is needed; high disk I / O rate (close to 1) indicates that the disk load is heavy, the EF value increases, and I / O intensive operations need to be reduced; high network traffic (close to 1) indicates that the network load is high, the EF value increases, and encrypted communication needs to be optimized; low security score (close to 1) indicates high security risk, the EF value increases, and a stronger encryption algorithm is needed; low log score (close to 1) indicates poor system stability, the EF value increases, and the encryption strategy needs to be adjusted to reduce the system burden.

[0054] The second processing module determines whether to generate an encryption conversion instruction according to the node evaluation coefficient; if an encryption conversion instruction is generated, the encryption conversion instruction is sent to the storage strategy module.

[0055] The node evaluation coefficient is compared with the preset node evaluation coefficient threshold. If the node evaluation coefficient is greater than or equal to the node evaluation coefficient threshold, an encryption conversion instruction is generated; if the node evaluation coefficient is less than the node evaluation coefficient threshold, no encryption conversion instruction is generated.

[0056] The encryption conversion module is used to input the node evaluation coefficient into the node evaluation coefficient-encryption algorithm and mapping table according to the encryption conversion instruction to obtain the changed encryption algorithm.

[0057] In the node evaluation coefficient-encryption algorithm and mapping table, every two node evaluation coefficients form an interval, one interval corresponds to an encryption algorithm, and one interval has a maximum node evaluation coefficient and a minimum node evaluation coefficient.

[0058] The storage policy module inputs the name of the changed encryption algorithm and the node performance characteristic data into the pre-trained storage policy model to obtain the evaluation results of the storage node, which include execution and replacement. The node performance characteristic data includes CPU usage, number of CPU cores, CPU main frequency, hardware acceleration support, memory usage, disk I / O rate and node average load. When the evaluation result is execution, it means that the storage node can meet the requirements for the operation of the changed encryption algorithm; when it is replacement, it means that the storage node does not meet the requirements for the operation of the changed encryption algorithm and the storage node needs to be replaced.

[0059] For example, the ChaCha20 encryption algorithm is suitable for storage nodes with low computing power and high average node load. The AES encryption algorithm is suitable for nodes with strong computing power and low average node load. Hardware acceleration (such as Intel AES-NI) is used to reduce CPU load. The RSA encryption algorithm is suitable for data encryption with a high data security level.

[0060] By monitoring and analyzing the above indicators, we can fully understand the computing power and load of the storage nodes, so as to select the appropriate encryption algorithm to ensure that the system maintains security while running efficiently.

[0061] The training methods for the storage policy model include:

[0062] Collect k groups of evaluation data in advance, the evaluation data including evaluation feature data and evaluation results, the evaluation feature data including the name of the changed encryption algorithm (ie, the encryption algorithm name) and node performance feature data; convert the evaluation data into a set of first feature vectors.

[0063] Each group of first feature vectors is used as the input of the storage policy model. The storage policy model takes a group of predicted evaluation results corresponding to each group of evaluation feature data as output, and takes the actual evaluation results corresponding to each group of evaluation feature data as the prediction target; minimizing the sum of prediction errors of all evaluation feature data is used as the training target; the storage policy model is trained until the sum of prediction errors reaches convergence, and the training is stopped; the storage policy model is a deep neural network model.

[0064] The storage node selection module, if the evaluation result is replacement, will send the name of the changed encryption algorithm to the judgment model deployed on the i-1 storage nodes to obtain the judgment result. If the judgment result is executable, the corresponding first encrypted data will be selected to migrate to any storage node corresponding to the judgment result of executable, decrypt the first encrypted data, and then encrypt it with the changed encryption algorithm; if the judgment result is not executable, it will be reported. Notify the staff to solve it.

[0065] The training methods of the judgment model include:

[0066] Collect multiple groups of judgment data in advance, the judgment data includes judgment feature data and judgment results, the judgment feature data includes the name of the changed encryption algorithm, the current node performance feature data of the storage node where the judgment model is located, and the judgment results.

[0067] The judgment data is converted into a set of second feature vectors, the second feature vectors are divided into a training set and a test set, the judgment feature data in the second feature vectors are used as the input of the judgment model, the judgment results in the training set are used as the output of the judgment model, the judgment model is trained to obtain an initial judgment model, the initial judgment model is tested using the test set, and a judgment model that meets the preset accuracy is output, the judgment model is a decision tree, random forest or support vector machine, etc.

[0068] The environmental data of each storage node is analyzed to generate a node evaluation coefficient. According to the node evaluation coefficient, it is determined whether to generate an encryption conversion instruction. According to the encryption conversion instruction, the node evaluation coefficient is input into the node evaluation coefficient-encryption algorithm and mapping table to obtain the changed encryption algorithm. The name of the changed encryption algorithm and the node performance characteristic data are used to determine whether the current storage node meets the operation requirements of the changed encryption algorithm. If not, the judgment model is deployed on i-1 storage nodes according to the changed encryption algorithm name to obtain a suitable storage node. Through this method, it is possible to dynamically adapt to different environmental changes and achieve efficient operation while maintaining security.

[0069] Example 2

[0070] See also Figure 2 As shown, this embodiment provides a method for secure collaborative storage of confidential data based on multi-party secure computing, including:

[0071] Slice the confidential data to obtain i slice data, encrypt the i slice data to form i first encrypted data, and store the i first encrypted data on i different storage nodes respectively;

[0072] Collect environmental data of each storage node;

[0073] Analyze environmental data to generate node evaluation coefficients;

[0074] According to the node evaluation coefficient, determine whether to generate an encryption conversion instruction;

[0075] According to the encryption conversion instruction, the node evaluation coefficient is input into the node evaluation coefficient-encryption algorithm and mapping table to obtain the changed encryption algorithm;

[0076] The changed encryption algorithm name and node performance characteristic data are input into the pre-trained storage policy model to obtain the evaluation results of the storage node, including execution and replacement;

[0077] If the evaluation result is replacement, the name of the changed encryption algorithm will be sent to the judgment model deployed on i-1 storage nodes to obtain the judgment result. When the judgment result is executable, the corresponding first encrypted data will be selected to be migrated to any storage node corresponding to the judgment result that is executable, the first encrypted data will be decrypted, and then encrypted using the changed encryption algorithm; when the judgment result is not executable, it will be reported.

[0078] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for secure collaborative storage of confidential data based on multi-party secure computing, characterized in that: include: Slice the confidential data to obtain i slice data, encrypt the i slice data to form i first encrypted data, and store the i first encrypted data on i different storage nodes respectively; Collect environmental data of each storage node; Analyze environmental data to generate node evaluation coefficients; According to the node evaluation coefficient, determine whether to generate an encryption conversion instruction; According to the encryption conversion instruction, the node evaluation coefficient is input into the node evaluation coefficient-encryption algorithm and mapping table to obtain the changed encryption algorithm; The changed encryption algorithm name and node performance characteristic data are input into the pre-trained storage policy model to obtain the evaluation results of the storage node, including execution and replacement; If the evaluation result is replacement, the name of the changed encryption algorithm is sent to the judgment model deployed on the i-1 storage nodes to obtain the judgment result. If the judgment result is executable, the corresponding first encrypted data is selected to be migrated to any storage node corresponding to the judgment result being executable, the first encrypted data is decrypted, and then encrypted using the changed encryption algorithm; If the result is judged to be unexecutable, it will be reported.

2. The method for secure collaborative storage of confidential data based on multi-party secure computing according to claim 1 is characterized in that: The node performance characteristic data includes CPU usage, number of CPU cores, CPU main frequency, hardware acceleration support, memory usage, disk I / O rate and node average load.

3. The method for secure collaborative storage of confidential data based on multi-party secure computing according to claim 2 is characterized in that: The training method of the storage strategy model includes: Collect k groups of evaluation data in advance, the evaluation data including evaluation feature data and evaluation results, the evaluation feature data including the name of the changed encryption algorithm and node performance feature data; convert the evaluation data into a set of first feature vectors; Each group of first feature vectors is used as the input of the storage policy model. The storage policy model takes a group of predicted evaluation results corresponding to each group of evaluation feature data as output, and takes the actual evaluation results corresponding to each group of evaluation feature data as the prediction target; minimizing the sum of prediction errors of all evaluation feature data is used as the training target; the storage policy model is trained until the sum of prediction errors reaches convergence, and the training is stopped; the storage policy model is a deep neural network model.

4. The method for secure collaborative storage of confidential data based on multi-party secure computing according to claim 3 is characterized in that: The calculation formula of the prediction error is Z K =(α K -μ K ) 2 , where Z K is the prediction error, K is the group number of the evaluation feature data, α K is the prediction evaluation result corresponding to the Kth group of evaluation feature data, μ K is the actual evaluation result corresponding to the Kth group of evaluation feature data.

5. The method for secure collaborative storage of confidential data based on multi-party secure computing according to claim 1, characterized in that: The training method of the judgment model includes: Collect multiple sets of judgment data in advance, the judgment data includes judgment feature data and judgment results, the judgment feature data includes the name of the changed encryption algorithm, the current node performance feature data of the storage node where the judgment model is located, and the judgment results; The judgment data is converted into a set of second feature vectors, the second feature vectors are divided into a training set and a test set, the judgment feature data in the second feature vectors are used as the input of the judgment model, the judgment results in the training set are used as the output of the judgment model, the judgment model is trained to obtain an initial judgment model, the initial judgment model is tested using the test set, and a judgment model that meets the preset accuracy is output, the judgment model is a decision tree, random forest or support vector machine.

6. The method for secure collaborative storage of confidential data based on multi-party secure computing according to claim 1, characterized in that: The environmental data includes CPU usage, memory usage, disk I / O rate, network traffic, security score and system log score.

7. The method for secure collaborative storage of confidential data based on multi-party secure computing according to claim 1, characterized in that: The node evaluation coefficient is obtained by weighted summing of CPU usage, memory usage, disk I / O rate, network traffic, security score and system log score.

8. The method for secure collaborative storage of confidential data based on multi-party secure computing according to claim 1, characterized in that: The node evaluation coefficient is compared with the preset node evaluation coefficient threshold. If the node evaluation coefficient is greater than or equal to the node evaluation coefficient threshold, an encryption conversion instruction is generated; if the node evaluation coefficient is less than the node evaluation coefficient threshold, no encryption conversion instruction is generated.

9. The method for secure collaborative storage of confidential data based on multi-party secure computing according to claim 8, characterized in that: In the node evaluation coefficient-encryption algorithm and mapping table, every two node evaluation coefficients form an interval, one interval corresponds to one encryption algorithm, and one interval has a maximum node evaluation coefficient and a minimum node evaluation coefficient.

10. A secure collaborative storage system for confidential data based on multi-party secure computing, characterized in that: A method for secure collaborative storage of confidential data based on multi-party secure computing according to any one of claims 1 to 9, the system comprising: A first processing module is used to slice the confidential data to obtain i slice data, encrypt the i slice data to form i first encrypted data, and store the i first encrypted data on i different storage nodes respectively; Monitoring module, used to collect environmental data of each storage node; The first analysis module is used to analyze environmental data and generate node evaluation coefficients; The second processing module determines whether to generate an encryption conversion instruction according to the node evaluation coefficient; An encryption conversion module, used for inputting the node evaluation coefficient into the node evaluation coefficient-encryption algorithm and mapping table according to the encryption conversion instruction, to obtain a changed encryption algorithm; The storage policy module inputs the changed encryption algorithm name and node performance characteristic data into the pre-trained storage policy model to obtain the evaluation results of the storage node, including execution and replacement; The storage node selection module, if the evaluation result is replacement, will send the name of the changed encryption algorithm to the judgment model deployed on i-1 storage nodes to obtain the judgment result. If the judgment result is executable, the corresponding first encrypted data will be selected to migrate to any storage node corresponding to the judgment result that is executable, decrypt the first encrypted data, and then encrypt it using the changed encryption algorithm. If the judgment result is not executable, it will be reported.

Images