A data security system based on dynamic data splitting

Abstract

The present invention discloses a data security system based on dynamic data splitting, which belongs to the field of data security and aims to ensure the safe, reliable and efficient management of data files throughout the entire life cycle. It includes a data splitting module, a data distribution module, an access control module and a data reorganization module. The data splitting module reads and converts data files, dynamically adjusts the splitting strategy, and combines sensitive information encryption technology to split data files to improve security. The data distribution module optimizes the distribution of data blocks using a consistent hashing algorithm, dynamically monitors the load of storage nodes, and prevents data loss through redundant backup. The access control module implements user identity authentication and authority allocation, and accurately controls data access. The data reorganization module is responsible for the recovery and synchronous update of split data to maintain data consistency. Overall, it provides comprehensive protection for data and meets strict security regulations and efficient processing requirements.

Description

Technical Field

[0001] The present invention relates to the field of data security, and more specifically to a data security system based on dynamic data splitting. Background Art

[0002] With the rapid development of information technology, data has become an important asset and core driving force of modern society. Enterprises and organizations generate and rely on a large amount of data to drive decision-making, optimize services and improve efficiency during operations. However, the centralized storage and processing of data also brings significant security risks. Once a data center is attacked or leaked internally, it may lead to large-scale data loss or abuse, causing huge economic losses and reputation damage to the enterprise. Although traditional data security measures, such as firewalls, intrusion detection systems and encryption technologies, can protect data from unauthorized access and leakage to a certain extent, these static defense measures often seem powerless in the face of increasingly complex network attack methods. In addition, with the widespread application of cloud computing and big data technologies, the surge in data volume has made data security management more complex and difficult.

[0003] The invention patent with announcement number CN117909299B discloses a dynamic hierarchical data splitting system, which includes a file splitting module, a sub-component association module, a sub-component encryption module, a file indexing module and a model training module; the sub-component association module is used to establish a file indexing network according to the relationship between the split execution sub-components, and configure index stamps for different split execution sub-components according to the relationship between the split execution sub-components in the file indexing network; the sub-component encryption module is used to encrypt the split execution sub-components to generate split encrypted sub-components, and send the split encrypted sub-components to the user terminal; the file indexing module is used to retrieve other split encrypted sub-components according to the index stamps of the split encrypted sub-components.

[0004] Although the prior art performs targeted splitting corresponding to different levels, so that the split content can balance the security factor, establishes index stamps through the file index network, facilitates the call of upper-level files or finds users who use lower-level files, and distributes them in an encrypted manner to further improve security, it still fails to solve the problem of safe, reliable and efficient management of data files. Therefore, in order to overcome these limitations, the present invention proposes a data security system based on dynamic data splitting. Summary of the invention

[0005] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a data security system based on dynamic data splitting, which solves the problem of safe, reliable and efficient management of data files. Starting from data splitting, by reading and identifying the data file type, and converting it into a standard format, it is efficiently encrypted and split according to the characteristics and security requirements of the data. The split data blocks are optimized for storage through a data distribution module, and the persistence and reliability of the data are ensured through a redundant backup strategy. In addition, only verified and authorized users are restricted to access sensitive data, thereby maintaining the security and compliance of the system. Finally, the data blocks are restored to their original form, and the integrity and accuracy of the data are guaranteed through an update strategy so that the data can be retrieved and used safely and efficiently.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A data security system based on dynamic data splitting, comprising a data splitting module, a data distribution module, an access control module and a data reorganization module;

[0008] The data splitting module is used to read data files, determine the data file type and convert it into a standard format, optimize the splitting process according to data characteristics and security requirements and operating environment, and perform data file splitting in combination with sensitive data encryption;

[0009] The data distribution module is used to allocate and adjust the distribution of data blocks on storage nodes through a consistent hashing algorithm and a dynamic monitoring strategy, and adopt a redundant backup strategy to copy key data to multiple storage nodes;

[0010] The access control module is used to ensure the legal verification of user identities and the precise control of access to data resources;

[0011] The data reorganization module is used to restore the original form of the data file by recombining the split data blocks, and adopt a data update strategy to make the reorganized data file consistent with the original data file.

[0012] Specifically, the data splitting module includes a preprocessing unit and a splitting unit;

[0013] The preprocessing unit reads the input data file, determines the data file type, and converts the identified data file into a standard format;

[0014] The splitting unit is configured with a dynamic adjustment strategy, and the dynamic adjustment strategy is dynamically adjusted according to the characteristics and security requirements of the data.

[0015] Specifically, the dynamic adjustment strategy includes:

[0016] Configure the initial split granularity, evaluate the current network bandwidth and available storage capacity, and dynamically adjust the split granularity based on the impact of network bandwidth and storage capacity. The formula is as follows: ,in, , and is the adjustment parameter, is the adjusted split granularity, is the network bandwidth, is the storage capacity;

[0017] Calculate the strength of data file splitting, and set the splitting strength as a nonlinear function of the data file size and splitting granularity. The splitting strength formula is: ,in, and is the adjustment parameter, is the split strength, is the data size, is the adjusted split granularity;

[0018] Identify sensitive information contained in data files, classify encryption levels according to the sensitive information, and encrypt sensitive data according to the encryption levels;

[0019] According to the splitting strength and splitting granularity, the data file is divided into data blocks of equal or approximately equal size;

[0020] Create index files, record data file splitting parameters, and encode data blocks;

[0021] Perform integrity and consistency checks on data files.

[0022] Specifically, the step of dividing the encryption levels includes:

[0023] Identify sensitive data types and distinguish information that can be publicly accessed;

[0024] Conduct sensitivity assessments to assess the level of risk caused by a data breach, the scope of individuals or businesses affected by the data breach, and legal requirements;

[0025] According to the sensitivity type M and sensitivity assessment N, the encryption level is set. The sensitivity type M is divided into four levels, public data is 1, internal data is 2, private data is 3, and transaction data is 4; the sensitivity N includes leakage risk N1, impact scope N2, and legal requirement N3. N1, N2 and N3 are divided into four levels respectively, with values ​​ranging from 1 to 4; calculate the encryption level d: , where d is the encryption level.

[0026] Specifically, the data encryption includes:

[0027] According to the encryption level d, AES is used for data block encryption, which is divided into low-level encryption, medium-level encryption and high-level encryption. The encryption algorithm is set as follows:

[0028] Improve the index file and record the encryption level and encryption algorithm of the data block.

[0029] Specifically, the data distribution module includes a load balancing unit and a stability assurance unit;

[0030] The load balancing unit is configured with an equal distribution strategy, which distributes the split data blocks to the storage nodes through a consistent hashing algorithm and monitors the load of the storage nodes in real time;

[0031] The stability guarantee unit is configured with a redundant backup strategy, which stores key data backups in different storage nodes.

[0032] Specifically, the steps of the equal distribution strategy include:

[0033] The split data blocks are distributed to the storage nodes through the consistent hashing algorithm;

[0034] Monitor the load level of storage nodes;

[0035] Based on the monitoring data, determine whether the storage node is overloaded or underloaded. The load level is calculated as follows: ,in, is the load level, is the CPU usage, is the maximum CPU usage, is the memory usage, is the maximum memory usage, is disk I / O, is the maximum disk I / O, , and is the weight parameter;

[0036] Configure the load threshold, which is used to characterize the load level of the storage node. When the load level exceeds the load threshold, that is, when the storage node is detected to be overloaded, the data block is migrated to the node with the lowest load through data migration, and the load level is calculated again until the load level of all storage nodes does not exceed the load threshold.

[0037] Create a distributed file to record the mapping relationship between each data block and the storage node to facilitate data block retrieval and reorganization.

[0038] Specifically, the steps of the redundant backup strategy include:

[0039] Identify key data blocks containing critical information;

[0040] Classify the importance of key data blocks;

[0041] Develop backup strategies based on the importance level of data;

[0042] Back up key data blocks to different storage nodes and synchronize data to data centers located in different storage locations;

[0043] Regularly check the integrity and recoverability of backup data blocks;

[0044] Improve the distribution file, add key data block backup information, and record the mapping relationship between backup data blocks and storage nodes.

[0045] Specifically, the access control module includes a verification unit and an authorization unit;

[0046] The verification unit is configured with a user authentication strategy, which verifies the user's identity information through a user database to confirm the legitimacy of the user;

[0047] The authorization unit is configured with a rights allocation strategy, which controls the user's access to data resources by defining the user's role and rights.

[0048] Specifically, the steps of the authority allocation strategy include:

[0049] The user verifies his / her identity by entering his / her user name and password;

[0050] When the user's identity is verified, the permission information is retrieved from the user database according to the user's role and responsibilities;

[0051] According to the retrieved permission information, the user is granted the corresponding data scope and operation permissions;

[0052] Generate an access token containing user permissions and role information. The user can use this token to perform subsequent data access and operations.

[0053] Monitor and record user access behavior in real time;

[0054] Generate access logs and audit reports regularly or on demand;

[0055] Set up permission update and revocation mechanisms.

[0056] Specifically, the data reorganization module includes a data merging unit and a data synchronization unit;

[0057] The data merging unit is configured with a data integration strategy, and the data integration strategy is to reassemble the split data blocks;

[0058] The data synchronization unit is configured with a data update strategy, and the data update strategy is used to ensure that the reorganized data is consistent with the original data.

[0059] Specifically, the steps of the data integration strategy include:

[0060] Determine the data files that need data integration, and retrieve the index files and distribution files of the data files;

[0061] Reassemble the data blocks according to the index files and distribution files generated during data splitting and data distribution;

[0062] After the data is integrated, difference monitoring is performed to compare the connection points between data blocks and hash values ​​to confirm that there is no error or loss in the data during the reorganization process;

[0063] Convert the data file back to its original format and perform the formatting step to restore the data file to its pre-split state.

[0064] Specifically, the steps of the data update strategy include:

[0065] When the difference monitoring detects a difference, it is determined whether the data block with the difference is a critical data block;

[0066] When the data block with differences is a critical data block, the location mapping information of the backup block of the critical data block is obtained from the distribution file, the backup information is obtained, the data is re-integrated, and the difference monitoring is performed again;

[0067] When the data block with differences is not a critical data block, add remark information;

[0068] When there are still differences in differential monitoring, a warning message is issued to prompt manual intervention for processing;

[0069] When the difference detection is passed, the index file and distribution file of the data file are updated.

[0070] Beneficial effects of the present invention:

[0071] 1. Use dynamic splitting and encryption technology to ensure the security of data files during transmission and storage. By intelligently identifying the data file type and converting it into a standard format, the splitting strategy can be dynamically adjusted according to the characteristics and security requirements of the data file, and sensitive data can be encrypted. In addition, a redundant backup strategy is adopted to copy key data to multiple storage nodes, effectively preventing the risk of data loss and single point failure.

[0072] 2. The consistent hashing algorithm and dynamic monitoring strategy are used to optimize the distribution of data blocks on storage nodes, achieve load balancing, and prevent storage node overload, thereby improving data processing efficiency. At the same time, precise access control is implemented, and through user authentication and permission allocation strategies, it is ensured that only authorized users can access and process data, further improving the efficiency of data processing and management.

[0073] 3. Through the data reorganization module, the split data blocks are reassembled to restore the original form of the data, and the data update strategy is adopted to ensure that the reorganized data files are consistent with the original data files. Measures such as difference monitoring and real-time monitoring of user access behavior ensure the integrity and accuracy of data files during the reorganization process, while ensuring the transparency and traceability of data file access. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 It is a structural diagram of a data security system based on dynamic data splitting;

[0075] Figure 2 A flowchart for dynamically adjusting the strategy;

[0076] Figure 3 A flowchart of the steps for classifying encryption levels;

[0077] Figure 4 Flowchart of the steps of the equal-sharing strategy. DETAILED DESCRIPTION

[0078] Example 1

[0079] See also Figure 1 ,This embodiment introduces a data security system based on dynamic data splitting, including a data splitting module, a data distribution module, an access control module and a data reorganization module;

[0080] The data splitting module is used to read data files, determine the data file type and convert it into a standard format, optimize the splitting process according to data characteristics, security requirements and operating environment, and combine sensitive data encryption to split data files, so as to effectively improve the efficiency and security of data processing, ensure the security of data files during splitting, transmission and storage, and ensure that the quality of data files is not affected; the data distribution module is used to allocate and adjust the distribution of data blocks on storage nodes through consistent hashing algorithms and dynamic monitoring strategies to optimize performance and prevent overload, and adopt redundant backup strategies to copy key data to multiple storage nodes to prevent data loss due to single point failures; the access control module is used to ensure the legal verification of user identity and precise control of access to data resources to ensure data security and compliance; the data reorganization module is used to restore the original form of the data by recombining the split data blocks, and adopts a data update strategy to ensure that the reorganized data files are consistent with the original data files, and maintain the integrity and accuracy of the data files.

[0081] The data splitting module includes a preprocessing unit and a splitting unit. The preprocessing unit reads the input data file, determines the data file type, and converts the identified data file into a standard format to facilitate the processing and analysis of the data file. The splitting unit is configured with a dynamic adjustment strategy, which is dynamically adjusted according to the characteristics and security requirements of the data to optimize the security and performance of data file splitting.

[0082] Specifically, data file types include, but are not limited to, text files, image files, audio files, video files, database files, HTML files, and binary files;

[0083] Specifically, data standard formats include but are not limited to Parquet, CSV, JSON, Avro, and XML.

[0084] See also Figure 2 Specifically, the dynamic adjustment strategies include:

[0085] Configuring the initial split granularity , evaluate the current network bandwidth and available storage capacity to ensure the efficiency of data splitting and data transmission, and that the split data files can be properly stored. According to the influence of network bandwidth and storage capacity, dynamically adjust the split granularity. The formula is as follows: ,in, , and is the adjustment parameter, is the adjusted split granularity, is the network bandwidth, is the storage capacity;

[0086] Calculate the strength of data file splitting, and set the splitting strength as a nonlinear function of the data file size and splitting granularity. The splitting strength formula is: ,in, and is the adjustment parameter, is the split strength, is the data size, is the adjusted split granularity;

[0087] Identify sensitive information contained in data files, including personal identity information and financial information, classify encryption levels according to sensitive information, encrypt sensitive data according to encryption levels, and ensure the security of data files during data splitting, data transmission and data storage;

[0088] Divide data files into data blocks of equal or approximately equal size according to the splitting strength and splitting granularity to ensure that each data block contains data rows with similar data, so as to optimize data transmission efficiency, ensure data security, and improve data processing efficiency;

[0089] Create index files, record data file splitting parameters, and encode data blocks to facilitate subsequent access and management of data files;

[0090] After the data splitting is completed, the data file is checked for integrity and consistency to ensure that the quality of the data file is not affected by the splitting process.

[0091] See also Figure 3 Specifically, the steps of dividing the encryption levels include:

[0092] Identify sensitive data block types, including public data, internal data, privacy data, and transaction data, to distinguish publicly accessible information, including company news releases and public reports; data that is limited to internal use, including employee information and internal reports; information involving personal privacy or business secrets, including personal identity information and financial records; extremely sensitive information, including payment information, passwords, and medical records;

[0093] Conduct sensitivity assessments, including the risk of leakage, scope of impact and legal requirements, to assess the degree of risk caused by data leakage, the scope of individuals or businesses affected by data leakage and legal requirements;

[0094] According to the sensitivity type M and sensitivity assessment N, the encryption level is set. The sensitivity type M is divided into four levels, public data is 1, internal data is 2, private data is 3, and transaction data is 4; the sensitivity N includes leakage risk N1, impact scope N2, and legal requirement N3. N1, N2 and N3 are divided into four levels respectively, with values ​​ranging from 1 to 4; calculate the encryption level d: , where d is the encryption level. The value range of encryption level d will be from 0 to 1, which can more accurately reflect the sensitivity of the data and the required protection level.

[0095] Specifically, data encryption includes:

[0096] According to the encryption level d, AES is used for data block encryption, which is divided into low-level encryption, medium-level encryption and high-level encryption. The encryption algorithm is set as follows:

[0097] By performing different types of encryption on sensitive data, the security level of the data can be improved.

[0098] Improve the index file and record the encryption level and encryption algorithm of the data block to facilitate the restoration of the data block in the data file.

[0099] The data distribution module includes a load balancing unit and a stability assurance unit. The load balancing unit is configured with an equal distribution strategy. The equal distribution strategy distributes the split data blocks to the storage nodes through a consistent hashing algorithm, and monitors the load of the storage nodes in real time to prevent the storage nodes from being overloaded and affecting performance. The stability assurance unit is configured with a redundant backup strategy. The redundant backup strategy stores key data backups in different storage nodes to prevent data loss due to single point failures.

[0100] See also Figure 4 Specifically, the steps of the equal distribution strategy include:

[0101] The split data blocks are distributed to the storage nodes through the consistent hashing algorithm to ensure that the data blocks are evenly distributed to the storage nodes and improve the load capacity;

[0102] Monitor the load factors of storage nodes, including CPU usage, memory usage, and disk I / O;

[0103] Based on the monitoring data, determine whether the storage node is overloaded or underloaded, and characterize the load level as a linear combination of load factors. The calculation formula for the load level is as follows: ,in, is the load level, is the CPU usage, is the maximum CPU usage, is the memory usage, is the maximum memory usage, is disk I / O, is the maximum disk I / O, , and is the weight parameter;

[0104] Configure the load threshold, which is used to characterize the load level of the storage node. When the load level exceeds the load threshold, that is, when the storage node is detected to be overloaded, the data block is migrated to the node with the lowest load through data migration, and the load level is calculated again until the load level of all storage nodes does not exceed the load threshold, so as to achieve load balancing.

[0105] Create a distributed file to record the mapping relationship between each data block and the storage node to facilitate data block retrieval and reorganization.

[0106] Specifically, the steps of the redundant backup strategy include:

[0107] Identify key data blocks containing critical information, including customer information, transaction records, key business data, important documents and configuration files;

[0108] Critical data blocks are graded according to their importance. Customer information and transaction records are classified as primary data; critical business data and important documents are considered secondary data; and configuration files and other non-business-critical supporting documents are considered tertiary data.

[0109] Develop backup strategies based on the importance of data, including full backup, incremental backup, and differential backup. For level 1 data, use a full backup strategy to ensure that all data can be fully backed up; for level 2 data, use incremental backup to only back up data that has changed since the last backup to improve efficiency and reduce storage requirements. Level 3 data uses differential backup to balance the frequency of backup and storage consumption, while ensuring that all data since the last complete state can be restored;

[0110] Back up critical data blocks to different storage nodes and synchronize data to data centers located in different storage locations, thus providing an additional layer of security and ensuring rapid recovery when the original data is damaged;

[0111] Regularly check the integrity and recoverability of backup data blocks to ensure that the backup data blocks are valid and available when needed, so as to detect any potential problems in a timely manner;

[0112] Improve the distribution file, add key data block backup information, and record the mapping relationship between backup data blocks and storage nodes.

[0113] The access control module includes a verification unit and an authorization unit. The verification unit is configured with a user authentication strategy. The user authentication strategy verifies the user's identity information through the user database and confirms the user's legitimacy to ensure that only verified users can enter the system; the authorization unit is configured with a permission allocation strategy. The permission allocation strategy controls the user's access to data resources by defining the user's role and permissions to ensure that the user can only access data within his or her authorized scope.

[0114] Specifically, the user database settings include:

[0115] Basic user information, including username, password and contact information;

[0116] User roles, which are defined based on organizational structure and business needs, including administrator, analyst, and sales;

[0117] Permission level, which defines the data scope and operation permissions that each role can access. The data scope includes customer information, transaction records, and financial statements; the operation permissions include read, write, modify, and delete;

[0118] Authentication history, which records the user's login attempts, including successful and failed login information;

[0119] User status, records the user's account status, including activation, lock, and logout status.

[0120] Specifically, the steps of the permission allocation strategy include:

[0121] The user enters the user name and password to verify the user identity;

[0122] When the user's identity is verified, the permission information is retrieved from the user database according to the user's role and responsibilities to ensure that only authenticated users can access the system;

[0123] According to the retrieved permission information, users are granted corresponding data scope and operation permissions, including reading, writing, and modifying data blocks, to ensure that users can perform necessary data operations while preventing users from performing tasks beyond their permission scope, thereby maintaining data integrity and security;

[0124] Generate an access token containing user permissions and role information. The user can perform subsequent data access and operations with this token, providing a secure way to manage user sessions and ensure that each access is authorized;

[0125] Real-time monitoring and recording of user access behavior, including data resources accessed, operations performed, and access time, to ensure compliance and facilitate future audit tracking. By monitoring and recording user activities, potential misconduct or non-compliant operations can be detected and evidence can be provided for audits.

[0126] Generate access logs and audit reports regularly or on demand for internal audit and compliance checks to ensure transparency and traceability of data access;

[0127] Set up a permission update and revocation mechanism to promptly update or revoke user permissions when their roles change or their responsibilities end, ensuring data security and preventing employees whose roles have changed from continuing to access sensitive data, thereby protecting data from internal threats.

[0128] The data reorganization module includes a data merging unit and a data synchronization unit. The data merging unit is configured with a data integration strategy, which restores the original form of the data by recombining the split data blocks; the data synchronization unit is configured with a data update strategy, which is used to ensure that the reorganized data is consistent with the original data to maintain the integrity and accuracy of the data.

[0129] Specifically, the steps of the data integration strategy include:

[0130] Determine the data files that need data integration, retrieve the index files and distribution files of the data files to obtain information on data splitting, data distribution and data encryption;

[0131] Reassemble the data blocks according to the index files and distribution files generated during data splitting and data distribution to ensure that the data can be combined in the correct order and structure;

[0132] After data integration, difference monitoring is performed to compare the connection points between data blocks and hash values ​​to confirm that no errors or losses occurred during the reorganization process. This method of monitoring data integrity can effectively detect inconsistencies or errors by comparing the hash values ​​before and after the reorganization.

[0133] Convert the data file back to its original format and perform the formatting step to restore it to the state of the data file before splitting. Convert the data file from the intermediate format during the splitting and encryption process back to its original application or storage format to ensure that the data file can be correctly recognized and used by the upper-layer application again.

[0134] Specifically, the steps of the data update strategy include:

[0135] When the difference is detected during the difference monitoring, it is determined whether the data block with the difference is a critical data block;

[0136] When the data block with differences is a critical data block, the location mapping information of the backup block of the critical data block is obtained from the distribution file, and the backup information is obtained to reintegrate the data and perform difference monitoring again;

[0137] When the data block with differences is not a critical data block, add notes to facilitate tracking and future analysis, and accumulate long-term statistical information on data variation;

[0138] When there are still differences in the differential monitoring, a warning message is issued to prompt manual intervention for troubleshooting and data repair;

[0139] When the difference monitoring is passed, in order to ensure that the latest status of the data file can be effectively retrieved, the index file and the distribution file of the data file are updated to ensure that the latest status of the data file can be effectively retrieved and managed.

[0140] Working principle and its effect:

[0141] The data splitting module converts various types of data files into a unified standard format by reading and identifying them. Then, according to the characteristics and security requirements of the data, the splitting strategy is dynamically adjusted, and the file splitting is combined with sensitive data encryption technology to improve the security of data processing. During the splitting process, an index file is established to record parameters, encode data blocks, and finally an integrity check is performed to ensure that the data quality is not affected. The data distribution module uses the consistent hashing algorithm to optimize the distribution of data blocks on storage nodes to achieve load balancing. At the same time, the load of the storage nodes is dynamically monitored, and key data is copied to multiple nodes through redundant backup strategies to prevent data loss. The distribution file records the mapping relationship between data blocks and nodes, which is convenient for subsequent data retrieval and reorganization. The access control module accurately controls user access to data resources through user authentication and permission allocation strategies. This ensures that only authorized users can access and process data. At the same time, user behavior is monitored in real time, access logs and audit reports are recorded, and the transparency and traceability of data access are guaranteed. When the data needs to be used, the data reorganization module is responsible for recombining the split data blocks and restoring them to their original form. And difference monitoring is performed to ensure that the reorganized data is consistent with the original data and maintain the integrity and accuracy of the data. At the same time, the index file and distribution file are updated to ensure that the latest status of the data file can be effectively retrieved and managed. In general, through intelligent splitting, efficient distribution, precise access control and reliable reorganization, the security and integrity of data throughout the life cycle are ensured, providing strong support for coping with complex data protection needs.

[0142] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A data security system based on dynamic data splitting, characterized in that: It includes data splitting module, data distribution module, access control module and data reorganization module; The data splitting module is used to read data files, determine the data file type and convert it into a standard format, optimize the splitting process according to data characteristics and security requirements and operating environment, and split the data file in combination with sensitive data encryption; The data distribution module is used to allocate and adjust the distribution of data blocks on storage nodes through a consistent hashing algorithm and a dynamic monitoring strategy, and adopt a redundant backup strategy to copy key data to multiple storage nodes; The access control module is used to ensure the legal verification of user identities and the precise control of access to data resources; The data reorganization module is used to restore the original form of the data file by recombining the split data blocks, and adopt a data update strategy to make the reorganized data file consistent with the original file data; The data splitting module includes a preprocessing unit and a splitting unit; The preprocessing unit reads the input data file, determines the data file type, and converts the identified data file into a standard format; The splitting unit is configured with a dynamic adjustment strategy, and the dynamic adjustment strategy is dynamically adjusted according to the characteristics and security requirements of the data; The dynamic adjustment strategy includes: Configure the initial split granularity, evaluate the current network bandwidth and available storage capacity, and dynamically adjust the split granularity based on the impact of network bandwidth and storage capacity. The formula is as follows: ,in, , and is the adjustment parameter, is the adjusted split granularity, is the network bandwidth, is the storage capacity; Calculate the strength of data file splitting, and set the splitting strength as a nonlinear function of the size of the data file and the splitting granularity. The splitting strength formula is: ,in, and is the adjustment parameter, is the split strength, is the data size, is the adjusted split granularity; Identify sensitive information contained in data files, classify encryption levels according to the sensitive information, and encrypt sensitive data according to the encryption levels; According to the splitting strength and splitting granularity, the data file is divided into data blocks of equal or approximately equal size; Create index files, record data file splitting parameters, and encode data blocks; Perform integrity and consistency checks on data files; The data distribution module includes a load balancing unit and a stability assurance unit; The load balancing unit is configured with an equal distribution strategy, which distributes the split data blocks to the storage nodes through a consistent hashing algorithm and monitors the load of the storage nodes in real time; The stability guarantee unit is configured with a redundant backup strategy, which stores key data backups in different storage nodes; The steps of the equal sharing strategy include: The split data blocks are distributed to the storage nodes through the consistent hashing algorithm; Monitor the load level of storage nodes; Based on the monitoring data, determine whether the storage node is overloaded or underloaded. The load level is calculated as follows: ,in, is the load level, is the CPU usage, is the maximum CPU usage, is the memory usage, is the maximum memory usage, is disk I / O, is the maximum disk I / O, , and is the weight parameter; Configure the load threshold, which is used to characterize the load level of the storage node. When the load level exceeds the load threshold, that is, when the storage node is detected to be overloaded, the data block is migrated to the node with the lowest load through data migration, and the load level is calculated again until the load level of all storage nodes does not exceed the load threshold. Create a distribution file to record the mapping relationship between each data block and storage node to facilitate data block retrieval and reorganization; The step of dividing the encryption levels comprises: Identify sensitive data types and distinguish information that can be publicly accessed; Conduct sensitivity assessments to assess the level of risk caused by a data breach, the scope of individuals or businesses affected by the data breach, and legal requirements; According to the sensitivity type M and sensitivity assessment N, the encryption level is set. The sensitivity type M is divided into four levels, with public data as 1, internal data as 2, private data as 3, and transaction data as 4. The sensitivity N includes the leakage risk N1, the impact scope N2, and the legal requirement N3. N1, N2, and N3 are divided into four levels, ranging from 1 to 4. The formula for calculating the encryption level is: , where d is the encryption level; The data encryption includes: according to the encryption level d, using AES to encrypt data blocks, divided into low-level encryption, medium-level encryption and high-level encryption, the encryption algorithm is set as follows: , improve the index file, and record the encryption level and encryption algorithm of the data block.

2. A data security system based on dynamic data splitting as claimed in claim 1, characterized in that: The data reorganization module includes a data merging unit and a data synchronization unit; The data merging unit is configured with a data integration strategy, and the data integration strategy is to reassemble the split data blocks; The data synchronization unit is configured with a data update strategy, and the data update strategy is used to ensure that the reorganized data is consistent with the original data.

3. A data security system based on dynamic data splitting as claimed in claim 2, characterized in that: The steps of the data integration strategy include: Determine the data files that need data integration, and retrieve the index files and distribution files of the data files; Reassemble the data blocks according to the index files and distribution files generated during data splitting and data distribution; After the data is integrated, difference monitoring is performed to compare the connection points between data blocks and hash values ​​to confirm that there is no error or loss in the data during the reorganization process; Convert the data file back to its original format and perform the formatting step to restore the data file to its pre-split state.

4. A data security system based on dynamic data splitting as claimed in claim 3, characterized in that: The steps of the data update strategy include: When the difference monitoring detects a difference, it is determined whether the data block with the difference is a critical data block; When the data block with differences is a critical data block, the location mapping information of the backup block of the critical data block is obtained from the distribution file, the backup information is obtained, the data is re-integrated, and the difference monitoring is performed again; When the data block with differences is not a critical data block, add remark information; When there are still differences in differential monitoring, a warning message is issued to prompt manual intervention for processing; When the difference detection is passed, the index file and distribution file of the data file are updated.

Images