A method, system, device and medium for isolating and encrypting game data

Abstract

The present invention is applicable to the field of game security, and discloses a method for isolated storage and encryption of game data, including: classifying the game data according to the sensitivity of the game data; encrypting the game data with high sensitivity and selectively encrypting the remaining game data; storing the encrypted game data in partitions; controlling access to the encrypted game data through a rights management module; when a user accesses the encrypted game data, decrypting it using a corresponding decryption algorithm; wherein, when encrypting, the game data is encrypted according to the correlation between the game data. Using the correlation between data to generate an encryption key can make the encryption process more complicated and difficult to crack. Attackers not only need to crack a single encryption key, but also need to understand and simulate the association logic between data, which greatly increases the difficulty and cost of the attack.

Description

Technical Field

[0001] The present invention relates to the field of game security, and in particular to a method, system, device and medium for isolated storage and encryption of game data. Background Art

[0002] With the booming development of the gaming industry, secure storage and access control of gaming data have become crucial aspects of gaming operations. Gaming data not only includes users’ personal privacy information, such as ID numbers, mobile phone numbers, bank card numbers and other sensitive data, but also involves real-time data of the gaming process and a large amount of general data. How to ensure the smoothness of the game operation and the efficiency of data access while protecting the security of these sensitive data is the main challenge facing the field of gaming data security.

[0003] Traditional game data encryption methods often use a single encryption strategy to indiscriminately encrypt all data. Although this can ensure data security to a certain extent, it will increase computing overhead, thereby affecting game performance and user experience. In addition, simple encryption methods are difficult to resist advanced attacks, which puts game data at risk of being cracked. Summary of the invention

[0004] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, the present invention proposes a method and system for isolated storage and encryption of game data.

[0005] In a first aspect, the present application proposes a method for isolated storage and encryption of game data, comprising: classifying the game data according to the sensitivity of the game data;

[0006] Encrypting the game data with high sensitivity and selectively encrypting the remaining game data;

[0007] storing the encrypted game data in partitions;

[0008] Controlling access to the encrypted game data through a rights management module;

[0009] When a user accesses the encrypted game data, the corresponding decryption algorithm is used to decrypt the data;

[0010] Wherein, during encryption, the game data is encrypted according to the correlation between the game data.

[0011] More specifically, in the above technical solution, encrypting the game data according to the correlation between the game data specifically includes:

[0012] Acquire game data with time series characteristics, and determine historical relevant data of the game data according to a preset time window;

[0013] For the game data and the history-related data, a preset first encryption algorithm is used to generate a first encryption key associated with the game data;

[0014] The game data is encrypted using the first encryption key to obtain time series encrypted data.

[0015] More specifically, in the above technical solution, encrypting the game data according to the correlation between the game data further includes:

[0016] Acquire target map data with spatial correlation, and determine adjacent associated areas of the target map data according to a preset spatial range;

[0017] Based on the target map data and the map data of the adjacent associated area, a preset second encryption algorithm is used to generate a second encryption key related to the spatial position of the target map data;

[0018] The target map data is encrypted using the second encryption key to obtain spatially relevant encrypted data.

[0019] More specifically, in the above technical solution, encrypting the game data according to the correlation between the game data further includes:

[0020] The time series encrypted data and the space-related encrypted data are spliced ​​together, and encrypted game data is generated through a preset data operation method;

[0021] The first encryption key and the second encryption key are combined to generate a master key for decrypting the game data.

[0022] More specifically, the above technical solution includes:

[0023] Mapping the encrypted game data to a backup node, wherein the backup node includes at least three storage nodes;

[0024] Writing the encrypted game data into the backup node;

[0025] Monitor the running status of the backup nodes, and if any backup node is detected to have a failure, pull the corresponding backup data from other healthy backup nodes;

[0026] Restoring the pulled backup data to the failed backup node;

[0027] The consistency between the restored data and the original data is verified through a data integrity check algorithm.

[0028] More specifically, in the above technical solution, the encrypted game data is stored in partitions, specifically including:

[0029] Storing the encrypted game data with high sensitivity in a preset sensitive data storage area;

[0030] Storing the remaining encrypted game data in a preset common data storage area;

[0031] Data isolation measures are set between the sensitive data storage area and the common data storage area, and the data isolation measures include at least one of using different physical storage devices, network isolation and virtualization isolation.

[0032] More specifically, in the above technical solution, controlling access to the encrypted game data through the rights management module specifically includes:

[0033] Obtaining identity information input by a user, the identity information including a user name and a password;

[0034] Compare the user's identity information with pre-stored user identity data to determine whether the user's identity is correct;

[0035] If the user identity verification is passed, the corresponding access permission level is determined according to the user's preset permission level;

[0036] According to the access authority level, the scope of access of the user to different encrypted data is limited.

[0037] In a second aspect, the present application proposes an isolated storage and encryption system for game data, comprising:

[0038] A first processing module: classifying the game data according to the sensitivity of the game data;

[0039] The second processing module is used to encrypt the game data with high sensitivity and selectively encrypt the remaining game data;

[0040] The third processing module is used to partition and store the encrypted game data;

[0041] Fourth processing module: controlling access to the encrypted game data through the rights management module

[0042] The fifth processing module: when a user accesses the encrypted game data, decrypts it using a corresponding decryption algorithm;

[0043] Wherein, during encryption, the game data is encrypted according to the correlation between the game data.

[0044] In a third aspect, the present application further proposes a terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the methods described above when executing the computer program.

[0045] In a fourth aspect, the present application further proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method as described in any one of the above items is implemented.

[0046] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0047] 1. The present invention generates more complex and unpredictable encryption keys by utilizing the time series and spatial correlation between game data, thereby significantly improving the security of the encryption process. This correlation encryption method not only enhances the encryption strength, but also greatly increases the difficulty of cracking, effectively preventing data leakage and illegal access.

[0048] 2. The encrypted sensitive data and ordinary data are stored in the preset sensitive data storage area and ordinary data storage area respectively, and multiple isolation measures such as physical, network and virtualization are set between the two to effectively avoid mutual interference between data and potential security risks.

[0049] 3. Through the distributed backup solution of at least three storage nodes, the present invention not only realizes redundant storage of game data, but also significantly improves the security and fault tolerance of data. When any backup node fails, the system can quickly pull backup data from other healthy nodes and automatically restore to the failed node. This process does not require human intervention, which greatly shortens the data recovery time. At the same time, the application of the data integrity verification algorithm ensures that the restored data is completely consistent with the original data, further ensuring the integrity and accuracy of the data. The powerful advantage of the present invention in protecting game data provides a solid guarantee for game operations and user data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 It is a flowchart of a method for isolating, storing and encrypting game data provided by an embodiment of the present invention;

[0052] Figure 2It is a structural diagram of a system for isolated storage and encryption of game data provided by an embodiment of the present invention;

[0053] Figure 3 It is a schematic diagram of the structure of the terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0055] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0056] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0057] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0058] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0059] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0060] See also Figure 1 The present application proposes a method for isolated storage and encryption of game data, comprising: S101, classifying the game data according to the sensitivity of the game data; S102, encrypting the game data with high sensitivity and selectively encrypting the remaining game data; S103, storing the encrypted game data in partitions; S104, controlling access to the encrypted game data through a permission management module; S105, when a user accesses the encrypted game data, decrypting it using a corresponding decryption algorithm; wherein, during encryption, the game data is encrypted according to the correlation between the game data.

[0061] Obtain game data, classify the game data according to the sensitivity level according to the preset sensitive data judgment rules, and obtain a sensitive data set and a general data set; for the sensitive data set, use the preset AES encryption algorithm to encrypt the data to obtain encrypted sensitive data; for the general data set, use the preset DES encryption algorithm to selectively encrypt the data according to the access frequency and importance of the data to obtain encrypted general data; in the encryption process, by analyzing the correlation between different data, construct a data association matrix, optimize the encryption result according to the association matrix, and obtain optimized encrypted data; store the encrypted sensitive data in a preset security database, and set a preset strict access right; store the encrypted general data in a preset general database and set preset loose access permissions; when receiving a request to access encrypted data, obtain the role and permission information of the requesting user to determine whether the user has the corresponding access permissions; if the user has access permissions, call the corresponding decryption algorithm to decrypt the data according to the encryption algorithm type of the encrypted data, and return the decrypted data; if the user does not have access permissions, deny the access request and record the access log; optionally, continuously collect data access logs and system performance indicators, analyze the data usage patterns and association rules through preset data mining algorithms, dynamically adjust the encryption algorithm and data storage strategy, and take into account system performance while ensuring data security; regularly conduct security assessments on encryption algorithms, and update and upgrade encryption algorithms based on the assessment results to prevent the encryption algorithms from being cracked.

[0062] Specifically, according to the preset sensitive data judgment rules, data including user privacy information (such as ID card number, mobile phone number, etc.), payment information (such as bank card number), account password, etc. are divided into sensitive data sets, and the rest of the data are divided into ordinary data sets. The AES-256 encryption algorithm is used for sensitive data, with a key length of 256 bits, a packet length of 128 bits, and 14 iterations to ensure high-intensity security. Among ordinary data, important data such as user name, game equipment, and game level progress are encrypted using the DES algorithm with a key length of 56 bits. Through association rule analysis, it is found that the user ID has a high correlation with the user name and equipment information, which is used as a parameter for association encryption to improve encryption efficiency by 20%. Sensitive data is stored in an independent security server, with strict role-based access control, and only system administrators are allowed to access it. Ordinary data is stored in ordinary servers, with user identity-based access control. When the game is started, the user identity is authenticated by multiple factors such as username, password, mobile phone number verification code, and device MAC address. Only after successful authentication can the data be accessed. When an administrator accesses sensitive data, the system determines their role permissions and uses the AES-256 algorithm to decrypt. Optionally, user behavior logs are continuously collected, and association rules are optimized using machine learning algorithms, which are updated weekly. Differential privacy technology is also used to prevent data from being maliciously inferred while ensuring data availability. System performance is optimized through load balancing, caching, and other means to achieve millisecond-level response for encryption and decryption speeds.

[0063] In some embodiments, the game data is encrypted according to the correlation between the game data, specifically including: for game data with time series characteristics, the time correlation between the data can be used to design an encryption algorithm, and the encryption security can be improved by encrypting the current data in association with the historical data. For another example, for game map data with spatial correlation, the data correlation of adjacent areas can be used to design an encryption algorithm, thereby improving encryption efficiency and data compression rate.

[0064] Acquire game data with time series characteristics, and determine historical related data of the game data according to a preset time window; use a preset first encryption algorithm to generate a first encryption key associated with the game data for the game data and the historical related data; use the first encryption key to encrypt the game data to obtain time series encrypted data.

[0065] Acquire target map data with spatial correlation, and determine adjacent associated areas of the target map data according to a preset spatial range; use a preset second encryption algorithm for the target map data and the map data of the adjacent associated areas to generate a second encryption key associated with the spatial position of the target map data; use the second encryption key to encrypt and compress the target map data to obtain spatially correlated encrypted data.

[0066] The time series encrypted data and the space-related encrypted data are spliced, and encrypted game data is generated through a preset data operation method; the first encryption key and the second encryption key are combined to generate a master key for decrypting the game data.

[0067] During the decryption process of the game data, the master key is used to perform the preset data operation on the encrypted game data to obtain the time series encrypted data and the space-related encrypted data.

[0068] Specifically, when obtaining game data with time series characteristics, the preset time window can be set to 10 minutes. The system will automatically determine the historical related data of the current data, that is, the game data within 10 minutes before the current time point. For these current data and historical related data, the RC4 stream cipher algorithm based on XOR operation is used to generate an encryption key associated with the current data by performing bit-by-bit XOR operation on the current data and a randomly generated key stream. The current game data is encrypted using the generated associated encryption key, and encrypted data with enhanced security is obtained by performing bit-by-bit XOR operation on the game data and the key stream.

[0069] When obtaining game map data with spatial correlation, the adjacent associated areas of the current area can be determined according to the preset spatial range, such as a 3x3 area centered on the current area. For the current area data and the adjacent associated area data, the AES block cipher algorithm based on permutation and replacement is adopted. By performing multiple rounds of permutation and replacement operations on the area data and using the spatial location information as part of the key, an encryption key related to the spatial location is generated. The current map data is encrypted using the generated spatially related encryption key. At the same time, the encrypted data is compressed in combination with the characteristics of the game map data, such as the repeatability of terrain and buildings, and encrypted data with improved encryption efficiency and compression rate is obtained through algorithms such as run-length encoding.

[0070] Finally, the time series encrypted data and the space-related encrypted data are combined, and the final encrypted game data is generated by performing an XOR operation on the two encrypted data. The time series encrypted data can be the operation timestamp of the player in the game, such as the time point of the player's movement, attack and other operations in the game. The space-related encrypted data can be the spatial coordinates of objects in the game, such as the position coordinates of objects such as enemies and props in the game. The system splices the time series encrypted data and the space-related encrypted data according to the preset data splicing rules, such as splicing the timestamps and coordinates in a certain order and format, and obtains the spliced ​​encrypted data. Then, the system performs data operation processing on the spliced ​​encrypted data according to the preset data operation method, such as using XOR operation, shift operation and other methods, and generates encrypted game data through data operation. Then, the system obtains the first encryption key and the second encryption key, which can be randomly generated character strings or digital sequences. According to the preset key combination rules, such as splicing or mixing the two keys in a certain order and method, the first encryption key and the second encryption key are combined and processed to generate a master key for decrypting game data. The system uses the generated master key to decrypt the encrypted game data, and obtains the original game data through a decryption operation opposite to the encryption algorithm, such as using corresponding XOR operations, shift operations, etc.

[0071] This encryption scheme based on data correlation makes full use of the temporal and spatial characteristics of game data. Through targeted encryption algorithms and optimization measures, it achieves a balance between security and efficiency, providing reliable protection for the transmission and storage of game data.

[0072] According to the sensitivity of the game data, the game data is divided into sensitive data and ordinary data.

[0073] According to the preset sensitive data rules, the game data is obtained to determine whether the game data contains personal privacy information; if the game data contains personal privacy information, the game data is classified as sensitive data; otherwise, the game data is classified as ordinary data; for the game data determined to be sensitive data, the RSA asymmetric encryption algorithm is used to encrypt the sensitive data using the public key to obtain the encrypted sensitive data ciphertext; the encrypted sensitive data ciphertext and the ordinary data are stored in the game database to form classified stored game data; when the sensitive data needs to be accessed, the corresponding sensitive data ciphertext is read from the game database, and the paired private key is used to decrypt the sensitive data ciphertext to obtain to the original plaintext of sensitive data; in scenarios involving sensitive data transmission, by establishing an SSL / TLS secure channel, the public key infrastructure is used to realize encrypted transmission of the sensitive data; a role-based access control mechanism is adopted to set different user roles, and corresponding data access rights are assigned to each user role to control access to the sensitive data; data access logs are recorded to monitor access behavior to the sensitive data; the game database is backed up regularly and the backed-up data is encrypted and stored; the sensitive data is desensitized through data masking and data encryption data desensitization technology; regular security audits are conducted on the game database, data access records are checked, and suspicious data access behavior is identified.

[0074] Specifically, in the judgment of the sensitivity of game data, a sensitivity threshold can be set, for example, the sensitivity threshold is set to 8. Through natural language processing technology, the game data is segmented and keyword extracted, and matched with the preset sensitive word library. If the matching degree exceeds 8, the data is classified as sensitive data; otherwise, it is classified as ordinary data. For the encryption of sensitive data, the RSA-2048 algorithm can be used to generate a 2048-bit public-private key pair. The sensitive data is encrypted using the public key to obtain the encrypted sensitive data ciphertext. The encrypted sensitive data ciphertext is stored in the MySQL database with the ordinary data, and a reasonable data table structure is designed, such as storing the sensitive data in a separate sensitive data table and establishing a foreign key association with the ordinary data table. When sensitive data needs to be accessed, the corresponding sensitive data ciphertext is read from the database and decrypted using the private key. In the process of sensitive data transmission, the transmission data is encrypted by establishing an SSL / TLS secure channel and using the AES-256 algorithm to ensure the security of the data in the network. At the same time, a role-based access control (RBAC) mechanism is adopted to control the user's access to sensitive data according to their role and authority. For example, users are divided into roles such as administrators and ordinary users. Administrators have read and write permissions for sensitive data, while ordinary users only have read permissions. The system will also record detailed data access logs, including access time, access users, access content, etc., to facilitate post-audit and tracking. Regular backups of the game database can be made by combining incremental backups with full backups, with incremental backups performed every day and full backups performed once a week. During the data backup process, sensitive data is desensitized, such as using the SHA-256 algorithm to irreversibly encrypt user passwords to ensure the security of backup data. This series of technical means can effectively improve the security of game data, especially sensitive data, and minimize the occurrence of data leaks.

[0075] In some embodiments, sensitive data is encrypted and ordinary data can be selectively encrypted, specifically including:

[0076] The data to be processed is obtained, and according to the preset data classification rules, whether the data is sensitive data is determined; if the data is sensitive data, the sensitive data is encrypted by using a preset high-intensity encryption algorithm to obtain the encrypted sensitive data; the encrypted sensitive data is stored by using a preset sensitive data storage strategy, and managed by using role-based access control and the principle of least authority, and the access and operation of the sensitive data are recorded and audited; if the data is ordinary data, the importance and frequency of use of the ordinary data are evaluated according to the preset ordinary data evaluation rules; according to the importance and frequency of use of the ordinary data, the ordinary data is encrypted by using a preset ordinary data encryption strategy. The data is selectively encrypted to obtain processed ordinary data; the processed ordinary data is stored and managed using a preset ordinary data storage strategy; optionally, the encryption and storage status of the sensitive data and ordinary data is continuously monitored, data access logs are obtained, and the data access logs are analyzed in real time using preset log analysis rules, and alarms are issued for suspicious behaviors obtained from the analysis according to preset security rules; data security audit trigger instructions are regularly obtained, and the encryption processing and storage management of the data are audited and evaluated according to preset data security audit rules to obtain data security audit results; according to the data security audit results, the data classification rules, encryption strategies and storage strategies are dynamically optimized and adjusted.

[0077] Specifically, first, the data to be processed is classified according to the preset data classification rules. For example, data containing personal identity information, financial information, etc. is classified as sensitive data. For sensitive data, the AES256-bit encryption algorithm is used, and a secure key management mechanism, such as a hardware security module (HSM), is used to manage encryption keys. The encrypted sensitive data is stored in a database with strict access control, and the principle of least privilege is adopted to authorize only necessary users to access. For ordinary data, the encryption strategy is dynamically adjusted by analyzing the importance and frequency of use of the data, such as classifying data with a frequency of use less than once a month as low-frequency data. For example, AES128-bit encryption can be used for low-frequency data, while for data with high frequency of use, encryption can be considered to improve access efficiency. At the same time, the index is optimized according to the access pattern of the data, such as using B+ tree index for data with frequent range queries. Through data access log analysis and security auditing, machine learning algorithms such as decision trees are used to model data access behavior, identify abnormal access patterns, and promptly discover potential data security risks. Dynamically adjust data encryption strategies based on risk assessment results, such as re-encrypting data with increased risk levels or adjusting key update frequency to balance data security and system performance.

[0078] Optionally, when classifying game data, a set of scoring rules can be set based on factors such as data type, purpose, and importance. For example, the importance and sensitivity of private data such as user accounts and passwords can be set at the highest level of 5 points, game props, equipment, time, maps and other data can be set at a medium level of 3 points, and less sensitive data such as chat records and game logs can be set at a low level of 1 point.

[0079] By scoring each type of data and setting a score threshold, such as data above 4 points must be encrypted, data between 2-4 points can be selectively encrypted, and data below 2 points are not encrypted, the range of encrypted data is determined, and data above 4 points are highly sensitive game data. When selecting an encryption algorithm, different algorithms can be used according to the characteristics of the data and encryption requirements. For example, for short sensitive data such as account passwords, asymmetric encryption algorithms such as RSA can be used to ensure high-intensity security. For game archives and configuration files with large data volumes, symmetric encryption algorithms such as AES can be used to ensure security while taking into account encryption efficiency.

[0080] In some embodiments, the encrypted sensitive data and ordinary data are stored in different storage areas respectively.

[0081] Obtain the data to be processed, classify the data according to preset rules, and if the data is sensitive data, classify it into a sensitive data class; if the data is non-sensitive data, classify it into a common data class; for the data classified as the sensitive data class, use a preset AES encryption algorithm to encrypt it to obtain encrypted sensitive data; store the encrypted sensitive data in a preset sensitive data storage area, set a role-based access control policy and access control list for the sensitive data storage area, and restrict access to the sensitive data storage area; store the data classified as the common data class in a preset common data storage area, set a preset access control policy for the common data storage area; set data isolation measures between the sensitive data storage area and the common data storage area, and the data isolation measures include using different physical storage devices, network isolation and virtualization isolation; establish a permission management system, and assign corresponding data access rights according to the user's role and responsibilities; use a database audit tool to audit the access and operation records of the sensitive data storage area; regularly conduct data security risk assessment on the sensitive data storage area, identify data security risks and take corresponding security reinforcement measures.

[0082] Specifically, in the data classification stage, the system uses natural language processing technology to perform semantic analysis on the data content based on the preset sensitive data identification rule base, extract keywords and match them with sensitive words in the rule base. Data with a matching degree exceeding the threshold of 8 is judged as sensitive data and classified into the sensitive data class; the rest of the data is classified into the ordinary data class. For sensitive data, the system automatically selects the AES-256 encryption algorithm, generates a 256-bit random key to encrypt the data, and stores the ciphertext in a dedicated sensitive data storage area. This area uses three-layer network isolation, deploys strict role-based access control, and enables the full-process audit log function. Ordinary data is directly stored in the ordinary data area, using relatively loose IP whitelist access control. The two storage intervals use different VLANs for network isolation, and deploy a data leakage prevention system to monitor abnormal access and leakage risks of sensitive data in real time. At the same time, the system will automatically generate a data access permission matrix based on the user's role in the organization using the RBAC model to control the user's access granularity to sensitive data. Every morning, the system automatically performs integrity checks on all sensitive data, uses a cryptographically secure random number generator to generate random seeds, samples encrypted data, verifies ciphertext through a trusted third party, promptly identifies risks of data tampering, and links with the intrusion detection system to block suspicious access, fully ensuring data storage security.

[0083] In some embodiments, authentication is performed when the game is launched, and only authenticated users can access the encrypted data.

[0084] Obtain the identity information input by the user, which includes a user name and password; compare the user identity information with the pre-stored user identity data, and determine whether the user identity is correct through SQL query statements; if the user identity authentication is passed, determine the corresponding access permission level according to the user's preset permission level; according to the access permission level, dynamically generate corresponding data access control policies using access control list (ACL) technology to limit the user's access scope to different encrypted data; perform AES symmetric encryption on the game data, and store the encrypted data in the database; when receiving the user's data access request, determine the user's access permission through the ACL rules. Whether the user has the corresponding access rights; if the user has the access rights, the corresponding encrypted data is read from the database, and the data is decrypted using the AES algorithm, and the decrypted plaintext data is returned to the user; if the user identity authentication fails or does not have the corresponding access rights, the user's access request is rejected and a corresponding error prompt message is returned; optionally, the user's access behavior is continuously monitored, and the user's operation records are obtained to form a behavior log; for the behavior log, a preset abnormal behavior pattern is used for real-time matching analysis to determine whether the user's access behavior is abnormal; if abnormal behavior is found, an early warning is automatically triggered, and corresponding restriction measures are taken for abnormal users according to the preset security policy.

[0085] Specifically, when a user starts a game, the system uses the SHA-256 algorithm to perform a hash operation on the password using the user name and password and other identity information entered by the user, and compares the operation result with the hash value pre-stored in the user identity database. If the comparison results are consistent, it means that the user identity is correct. The system divides the user into three levels: administrator, VIP user and ordinary user according to the preset permission management rules, and each has different data access rights. The system adopts an attribute-based access control strategy and dynamically generates a data access control list based on the user's permission level. The administrator has read and write permissions for all encrypted data, VIP users have read permissions for part of the encrypted data, and ordinary users can only access public data. When a user requests to access encrypted data, the system first checks the data access control list to determine whether the user has the corresponding access rights. If the user has permission, the encrypted data is decrypted using the AES-256 algorithm and the decrypted data is returned to the user. If the user does not have permission, the user's access request is directly rejected. The system continuously monitors the user's access behavior, establishes a user behavior model through the Markov chain algorithm, and calculates the similarity between the user's current behavior and the model in real time. If the similarity is lower than the preset threshold (such as 8), the user behavior is judged to be abnormal, and an alarm is automatically triggered, notifying the administrator for further review, so as to timely discover and prevent illegal intrusions and ensure the security of the system and data.

[0086] In some embodiments, when encrypted data needs to be accessed, decryption is performed using a corresponding decryption algorithm.

[0087] Obtain the encrypted data to be decrypted, and obtain the corresponding decryption algorithm and key information from the key management system according to the identification information of the encrypted data; adopt the decryption algorithm and use the key information to decrypt the encrypted data to obtain the decrypted plaintext data; determine the format and encoding method of the plaintext data according to the metadata information of the plaintext data; adopt the data parsing library corresponding to the format and encoding method to parse and convert the plaintext data to obtain the converted Java object or data structure; transmit the Java object or data structure to the relevant business module for subsequent data analysis, storage or display of specific application scenarios; in the process of decryption and data application, record the time, operator, data summary audit information of key operations through the log framework; transmit the audit information to the centralized log server or SIEM system for subsequent compliance audit and security incident analysis; according to the sensitivity and confidentiality requirements of the plaintext data, use data erasure tools or overwrite technology to thoroughly clean and securely destroy the plaintext data in memory and disk.

[0088] Specifically, when obtaining encrypted data, you first need to determine the encryption algorithm used. Common symmetric encryption algorithms include AES, DES, etc., and asymmetric encryption algorithms include RSA, ECC, etc. Assuming that the AES-256-bit encryption algorithm is used, you need to obtain the corresponding 256-bit key. Pass the key to the AES decryption function, and use the encrypted data as input. The function uses the AES algorithm to decrypt the data to obtain the plaintext data. By parsing the data format, it is found that it is in JSON format and UTF-8 encoding is used. Use the JSON parsing library to parse the plaintext data and convert it into a data object inside the program. Pass the data object to the business module, such as the data visualization module, to display the data content through charts, etc., or pass it to the data storage module to store the data in the database. After the data application is completed, clear the plaintext data in the memory to ensure that the data will not be illegally obtained. Record the time, operator, data summary and other information of the decryption operation in the audit log. The log can be stored on a dedicated log server, and the log is backed up off-site to ensure the integrity and availability of the log, which is convenient for subsequent security audits and problem location.

[0089] In some embodiments, an insurance mechanism is introduced to insure the encrypted data to prevent data loss or damage. Specifically, the game data can be coherently encrypted first, and the encryption key can be generated by using the correlation between the data. Then, the encrypted data can be insured and the data can be backed up to multiple different storage nodes. When the data is lost or damaged, the data can be restored from other nodes to ensure the availability and integrity of the data. Through data insurance encryption, the security and reliability of game data can be improved.

[0090] Obtain original game data, analyze the correlation between the original game data, and extract key features; generate a coherent encryption key based on the correlation between the key features; use the coherent encryption key to encrypt the original game data using a symmetric encryption algorithm to obtain encrypted game data; determine at least three storage nodes as backup nodes; use a consistent hashing algorithm to map the encrypted game data to the backup nodes; write the encrypted game data to the backup nodes; monitor the operating status of the backup nodes, and if any backup node is detected to have a failure, pull the corresponding backup data from other healthy backup nodes; restore the pulled backup data to the failed backup node, and verify the consistency of the restored data with the original data through a data integrity verification algorithm; optionally, continuously monitor the data availability and integrity of the backup nodes, and dynamically adjust the data backup strategy according to the monitoring results.

[0091] Specifically, according to the characteristics of game data, a coherent encryption algorithm based on data correlation is designed. By using the correlation between game data and calculating the cosine similarity of data feature vectors, data blocks with similarity greater than 8 are selected to generate 128-bit coherent encryption keys. The AES-128 algorithm is used to encrypt the original game data with the generated coherent key to obtain encrypted game data. For encrypted data, the data insurance mechanism is started. According to the importance and access frequency of the data, the Markov chain model is used to determine that the data will be backed up to 3-5 storage nodes. The consistent hashing algorithm is used to map the encrypted game data to the corresponding storage node and write the backup. The data integrity of the storage node is continuously monitored. When the data is lost or damaged, the backup data is pulled from other healthy nodes for recovery. The CRC32 check is used to ensure the consistency of the restored data with the original data. The backup strategy is dynamically adjusted according to the data insurance mechanism, such as reducing the number of backups when the data access frequency decreases, so as to balance the storage cost and data reliability and ensure the high availability of game data.

[0092] See also Figure 2 , the application also proposes a game data isolation storage and encryption system, including:

[0093] A first processing module: classifying the game data according to the sensitivity of the game data;

[0094] The second processing module is used to encrypt the game data with high sensitivity and selectively encrypt the remaining game data;

[0095] The third processing module is used to partition and store the encrypted game data;

[0096] Fourth processing module: controlling access to the encrypted game data through the rights management module

[0097] The fifth processing module: when a user accesses the encrypted game data, decrypts it using a corresponding decryption algorithm;

[0098] Wherein, during encryption, the game data is encrypted according to the correlation between the game data.

[0099] It is understandable that if Figure 1 The contents of the game data isolation storage and encryption method embodiment shown in the figure are applicable to the game data isolation storage and encryption system embodiment of the present invention. The functions specifically implemented by the game data isolation storage and encryption system embodiment are similar to those in the embodiment shown in the figure. Figure 1 The isolated storage and encryption method embodiment of the game data shown in the embodiment is the same as that of the embodiment of the game data shown in the embodiment of the game data, and the beneficial effects achieved are the same as those of the embodiment of the game data shown in the embodiment of the game data. Figure 1 The beneficial effects achieved by the illustrated embodiment of the method for isolated storage and encryption of game data are also the same.

[0100] It should be noted that the information interaction, execution process and other contents between the above-mentioned systems are based on the same concept as the embodiment of the method of the present invention. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0101] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0102] See also Figure 3 The embodiment of the present invention further provides a computer device 3, comprising: a memory 302 and a processor 301 and a computer program 303 stored in the memory 302. When the computer program 303 is executed on the processor 301, the isolated storage and encryption method of the game data as described in any one of the above methods is implemented.

[0103] The computer device 3 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The computer device 3 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will appreciate that Figure 3 It is only an example of computer device 3 and does not constitute a limitation on computer device 3. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components, for example, it may also include input and output devices, network access devices, etc.

[0104] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0105] In some embodiments, the memory 302 may be an internal storage unit of the computer device 3, such as a hard disk or memory of the computer device 3. In other embodiments, the memory 302 may also be an external storage device of the computer device 3, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the computer device 3. Further, the memory 302 may also include both an internal storage unit of the computer device 3 and an external storage device. The memory 302 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program. The memory 302 may also be used to temporarily store data that has been output or is to be output.

[0106] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for isolated storage and encryption of game data as described in any one of the above methods is implemented.

[0107] In this embodiment, if the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, USB flash drive, mobile hard disk, disk or optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0108] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for isolated storage and encryption of game data, characterized in that: include: Classifying the game data according to the sensitivity of the game data; Encrypting the game data with high sensitivity and selectively encrypting the remaining game data; storing the encrypted game data in partitions; Controlling access to the encrypted game data through a rights management module; When a user accesses the encrypted game data, the corresponding decryption algorithm is used to decrypt the data; Wherein, during encryption, the game data is encrypted according to the correlation between the game data.

2. The method for isolated storage and encryption of game data according to claim 1, characterized in that: Encrypting the game data according to the correlation between the game data, further comprising: Acquire target map data with spatial correlation, and determine adjacent associated areas of the target map data according to a preset spatial range; Based on the target map data and the map data of the adjacent associated area, a preset second encryption algorithm is used to generate a second encryption key related to the spatial position of the target map data; The target map data is encrypted using the second encryption key to obtain spatially relevant encrypted data.

3. The method for isolated storage and encryption of game data according to claim 1, characterized in that: include: Mapping the encrypted game data to a backup node, wherein the backup node includes at least three storage nodes; Writing the encrypted game data into the backup node; Monitor the running status of the backup nodes, and if any backup node is detected to have a failure, pull the corresponding backup data from other healthy backup nodes; Restoring the pulled backup data to the failed backup node; The consistency between the restored data and the original data is verified through a data integrity check algorithm.

4. The method for isolated storage and encryption of game data according to claim 1, characterized in that: Storing the encrypted game data in partitions specifically includes: Storing the encrypted game data with high sensitivity in a preset sensitive data storage area; Storing the remaining encrypted game data in a preset common data storage area; Data isolation measures are set between the sensitive data storage area and the common data storage area, and the data isolation measures include at least one of using different physical storage devices, network isolation and virtualization isolation.

5. The method for isolated storage and encryption of game data according to claim 1, characterized in that: Controlling access to the encrypted game data through a rights management module specifically includes: Obtaining identity information input by a user, the identity information including a user name and a password; Compare the user's identity information with pre-stored user identity data to determine whether the user's identity is correct; If the user identity verification is passed, the corresponding access permission level is determined according to the user's preset permission level; According to the access authority level, the scope of access of the user to different encrypted data is limited.

6. A game data isolation storage and encryption system, characterized in that: include: A first processing module: classifying the game data according to the sensitivity of the game data; The second processing module is used to encrypt the game data with high sensitivity and selectively encrypt the remaining game data; The third processing module is used to partition and store the encrypted game data; Fourth processing module: controlling access to the encrypted game data through the rights management module The fifth processing module: when a user accesses the encrypted game data, decrypts it using a corresponding decryption algorithm; Wherein, during encryption, the game data is encrypted according to the correlation between the game data.

7. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images