Preparation method and system of computer hardware security encryption module

Abstract

The invention relates to the technical field of computer hardware encryption module preparation, and provides a computer hardware security encryption module preparation method and system.The method comprises the steps that original encryption algorithm data of computer hardware is obtained, data optimization is conducted on the original encryption algorithm data, and an optimized data set is obtained; calculating the data activeness of the optimized data set, and performing redundancy removal on the optimized data set based on the data activeness to obtain a target data set; performing data encryption on the target data set to obtain initial encrypted data, performing a fuzzy test on the initial encrypted data, and obtaining target encrypted data when a fuzzy test result is optimal; performing role authorization on the target encrypted data to obtain authorized data, performing data encapsulation on the authorized data to obtain encapsulated data, performing error detection on the encapsulated data to obtain target data, and constructing a security encryption module of the computer hardware according to the target data. The protection effect of the computer hardware security encryption module can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer hardware encryption module preparation, and in particular to a method for preparing a computer hardware security encryption module. Background Art

[0002] In today's digital age, information security has become a vital issue, and computer hardware security encryption modules play a key role in protecting sensitive data and ensuring system security. Preparing an efficient and reliable computer hardware security encryption module can effectively encrypt and decrypt data, prevent unauthorized access and data leakage, and thus improve the security and stability of computer systems. By preparing such an encryption module, enterprises can protect commercial secrets, financial institutions can ensure the security of customers' financial information, and government departments can ensure the confidentiality of government data, providing strong support for the normal operation of various fields. At the same time, it can detect and prevent potential security threats in real time, and provide timely warnings and responses to provide continuous and stable security protection services.

[0003] At present, the preparation of computer hardware security encryption modules is generally achieved through traditional circuit design technology to build hardware circuits with specific encryption algorithms. However, with this method, many encryption processes need to rely on fixed algorithms and circuit structures. Due to the increasingly complex and diverse means of network attacks, this fixed model is not flexible enough to deal with new security threats, resulting in the protection effect of computer hardware security encryption modules being less than ideal. Summary of the invention

[0004] In order to solve the above problems, the present invention provides a method for preparing a computer hardware security encryption module, which can improve the protection effect of the computer hardware security encryption module.

[0005] In a first aspect, the present invention provides a method for preparing a computer hardware security encryption module, comprising:

[0006] Acquire original encryption algorithm data of computer hardware, and perform data sorting on the original encryption algorithm data to obtain a sorted data set;

[0007] Identifying the data distribution structure, data organization status and data accuracy of the collated data set to determine the data disorder status of the collated data set, and optimizing the collated data set based on the data disorder status to obtain an optimized data set;

[0008] Calculating a data hash value of the optimized data set, calculating data activity of the optimized data set based on the data hash value, and de-redundanting the optimized data set based on the data activity to obtain a target data set;

[0009] Performing data scrambling on the target data set to obtain scrambled data, performing data encryption on the scrambled data to obtain initial encrypted data, performing a fuzzy test on the initial encrypted data to obtain a fuzzy test result, and obtaining target encrypted data when the fuzzy test result is excellent;

[0010] The target encrypted data is stored in a preconfigured non-volatile memory to obtain the stored data, the stored data is role-authorized to obtain the authorized data, the authorized data is re-encrypted to obtain the re-encrypted data, the re-encrypted data is data-encapsulated to obtain the encapsulated data, a data link between the encapsulated data and the computer hardware is identified, an error detection is performed on the encapsulated data using the data link, the target data is obtained when the error detection result meets the preset result, the access control policy of the computer hardware is set according to the target data, and a security encryption module of the computer hardware is constructed according to the access control policy.

[0011] Furthermore, the identifying the data distribution structure, data organization status and data accuracy of the collated data set to determine the data disorder status of the collated data set includes:

[0012] constructing a visualization chart of the collated data set;

[0013] Analyzing the data distribution structure of the collated data set using the visualization chart to obtain a data structure analysis result;

[0014] Performing data summary statistics on the collated data set to analyze the data organization status of the collated data set to obtain a data organization status analysis result;

[0015] Performing a data consistency check on the collated data set to analyze the data accuracy of the collated data set and obtain a data accuracy analysis result;

[0016] The data disorder status of the sorted data set is determined according to the data structure analysis result, the data organization status analysis result and the data accuracy analysis result.

[0017] Further, the calculating of the data hash value of the optimized data set includes:

[0018] Initializing the optimized data set to obtain a prepared data set;

[0019] After configuring the hash function for the prepared data set, the data hash value of the prepared data set is calculated using the following formula:

[0020]

[0021] Among them, H represents the data hash value, F() represents the hash function, and c i Indicates the string length of the i-th data in the prepared data set, f i represents the access frequency of the i-th data, G represents the data size of the prepared data set, and y represents the data redundancy threshold of the prepared data set.

[0022] Further, the calculating the data activity of the optimized data set based on the data hash value includes:

[0023] Based on the data hash value, the data activity of the optimized data set is calculated using the following formula:

[0024]

[0025] Among them, θ represents the data activity, f() represents the mean shift transfer function, and H i Represents the data hash value of the i-th data in the optimized data set, N i represents the number of activities for the i-th data in the optimization data set, t i Indicates the active time of the i-th data in the optimized data set, T i Represents the active period of the i-th data in the optimization data set.

[0026] Further, performing data scrambling on the target data set to obtain scrambled data includes:

[0027] The target data set is linearly transformed using the following formula to obtain linearly transformed data:

[0028]

[0029] Among them, A1 represents the first linear transformation data, A2 represents the second linear transformation data, and A n represents the nth linear transformation data, a1 represents the first linear transformation parameter in the first group, a2 represents the second linear transformation parameter in the first group, a j represents the jth linear transformation parameter in the first group, b1 represents the first linear transformation parameter in the second group, b2 represents the second linear transformation parameter in the second group, and b j represents the jth linear transformation parameter in the second group, c1 represents the first linear transformation parameter in the third group, c2 represents the second linear transformation parameter in the third group, and c j represents the jth linear transformation parameter in the third group, B1 represents the first data corresponding to the target data set, B2 represents the second data corresponding to the target data set, and B n Indicates the nth data corresponding to the target data set;

[0030] Affine transformation is performed on the linear transformation data to obtain affine transformation data, and position replacement is performed on the affine transformation data to obtain scrambled data.

[0031] Furthermore, the encrypting the scrambled data to obtain initial encrypted data includes:

[0032] constructing an initial key for the scrambled data;

[0033] a global identifier identifying the target data set;

[0034] Based on the global identifier, construct a data public key of the scrambled data;

[0035] The scrambled data is encrypted based on the initial key and the data public key to obtain initial encrypted data.

[0036] Further, the performing a fuzzy test on the initial encrypted data to obtain a fuzzy test result includes:

[0037] After determining the test scope of the initial encrypted data, construct a fuzzy test case of the initial encrypted data to perform a fuzzy test on the initial encrypted data, and record test data of the initial encrypted data during the fuzzy test;

[0038] identifying a test response system for the initial encrypted data based on the test data;

[0039] An abnormality analysis is performed on the test response system to obtain a fuzzy test result.

[0040] Further, the performing role authorization on the stored data to obtain the authorization data includes:

[0041] identifying data sensitivity of the stored data;

[0042] Based on the data sensitivity, user definition is performed on the access role corresponding to the stored data to obtain a defined user;

[0043] Associating the defined user with the stored data to obtain an associated data role;

[0044] Based on the associated data role, permission is set for the stored data to obtain permission data.

[0045] Further, the performing error detection on the encapsulated data by using the data link includes:

[0046] constructing a polynomial code for said data link;

[0047] A data code identifying the encapsulated data;

[0048] Using the polynomial code to update the data code to obtain an updated code;

[0049] constructing a query symbol for the encapsulated data using the update code and the polynomial code;

[0050] Based on the query symbol, error detection is performed on the encapsulated data.

[0051] In a second aspect, the present invention provides a system for preparing a computer hardware security encryption module, the system comprising:

[0052] The original data sorting module is used to obtain the original encryption algorithm data of the computer hardware, sort the original encryption algorithm data, and obtain a sorted data set;

[0053] A data set optimization module, used for identifying the data distribution structure, data organization status and data accuracy of the collated data set to determine the data disorder status of the collated data set, and based on the data disorder status, performing data optimization on the collated data set to obtain an optimized data set;

[0054] A data set de-redundancy module, used for calculating a data hash value of the optimized data set, calculating the data activity of the optimized data set based on the data hash value, and de-redundancy-reducing the optimized data set based on the data activity to obtain a target data set;

[0055] A data encryption module, used for performing data scrambling on the target data set to obtain scrambled data, performing data encryption on the scrambled data to obtain initial encrypted data, performing a fuzzy test on the initial encrypted data to obtain a fuzzy test result, and obtaining target encrypted data when the fuzzy test result is excellent;

[0056] A security encryption module preparation module is used to store the target encrypted data in a preconfigured non-volatile memory to obtain stored data, perform role authorization on the stored data to obtain authorization data, perform secondary encryption on the authorization data to obtain secondary encrypted data, perform data encapsulation on the secondary encrypted data to obtain encapsulated data, identify the data link between the encapsulated data and the computer hardware, perform error detection on the encapsulated data using the data link, obtain target data when the error detection result meets the preset result, set the access control policy of the computer hardware according to the target data, and construct a security encryption module for the computer hardware according to the access control policy.

[0057] Compared with the prior art, the technical principle and beneficial effects of this solution are:

[0058] The embodiment of the present invention performs data sorting on the original encryption algorithm data to obtain a sorted data set, which can make the data easier to understand and analyze, save storage space and improve data access efficiency, and identifies the data distribution structure, data organization status and data accuracy of the sorted data set to determine the data chaos status of the sorted data set, which can help users find potential data errors and outliers, and then perform data correction to improve data quality and reliability. Furthermore, the embodiment of the present invention performs data optimization on the sorted data set based on the data chaos status to obtain an optimized data set, which can reduce noise and errors, improve data accuracy, and provide a better data basis for subsequent modeling and prediction, and calculate the data of the optimized data set. The data integrity can be verified according to the hash value to ensure that the data has not been accidentally tampered with during transmission or storage, and the target data set is scrambled to obtain scrambled data that can disrupt the order of the data set, increase the randomness and complexity of the data, and improve the encryption effect. Furthermore, the embodiment of the present invention stores the target encrypted data in a preconfigured non-volatile memory to obtain stored data that can ensure that the data will not be lost after the device is powered off or shut down, and also facilitates data recovery and migration. In addition, according to the target data, setting the access control policy of the computer hardware can prevent unauthorized users from accessing sensitive data, ensure the confidentiality, integrity and availability of the data, reduce potential security risks, and prevent data leakage, system failures and other problems. A method and system for preparing a computer hardware security encryption module proposed in an embodiment of the present invention can improve the protection effect of a computer hardware security encryption module. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0061] Figure 1 A schematic flow chart of a method for preparing a computer hardware security encryption module provided by one embodiment of the present invention;

[0062] Figure 2 A module schematic diagram of a system for preparing a computer hardware security encryption module provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0063] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0064] The embodiment of the present invention provides a method for preparing a computer hardware security encryption module, and the execution subject of the method for preparing a computer hardware security encryption module includes but is not limited to at least one of the electronic devices such as a server and a terminal that can be configured to execute the method provided by the embodiment of the present invention. In other words, the method for preparing a computer hardware security encryption module can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc. The server can be an independent server, or it can be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms.

[0065] See also Figure 1 FIG. 1 is a flow chart of a method for preparing a computer hardware security encryption module provided by an embodiment of the present invention. Figure 1 A method for preparing a computer hardware security encryption module described in the invention comprises:

[0066] S1. Acquire original encryption algorithm data of computer hardware, and sort the original encryption algorithm data to obtain a sorted data set.

[0067] The embodiment of the present invention can understand the working principle and design of computer hardware by obtaining the original encryption algorithm data of computer hardware, wherein the original encryption algorithm data refers to the encryption key, parameters and encryption configuration information of the data.

[0068] Furthermore, the embodiment of the present invention can make the data easier to understand and analyze, save storage space and improve data access efficiency by sorting the original encryption algorithm data to obtain a sorted data set.

[0069] Optionally, the process of performing data sorting on the original encryption algorithm data to obtain a sorted data set is: performing data cleaning on the original encryption algorithm data to obtain cleaned data, performing data classification on the cleaned data to obtain classified data, and performing data aggregation on the classified data to obtain a sorted data set. The classified data can be classified by identifying data features of the cleaned data, and the data aggregation of the classified data can be clustered by a k-means algorithm.

[0070] S2. Identify the data distribution structure, data organization status and data accuracy of the collated data set to determine the data chaos status of the collated data set, and optimize the collated data set based on the data chaos status to obtain an optimized data set.

[0071] The embodiment of the present invention can help users find potential data errors and outliers by identifying the data distribution structure, data organization status and data accuracy of the collated data set to determine the data chaos status of the collated data set, and then make data corrections to improve the quality and reliability of the data. For example, if it is found that the sales volume of certain products in the sales data set has unreasonable negative values, it can be corrected in time. The data chaos status refers to the abnormal state of the frequency distribution of the data, as well as the obvious degree of classification and hierarchical structure of the data.

[0072] As an embodiment of the present invention, the identifying the data distribution structure, data organization status and data accuracy of the collated data set to determine the data chaos condition of the collated data set includes: constructing a visualization chart of the collated data set, using the visualization chart to analyze the data distribution structure of the collated data set to obtain a data structure analysis result, performing data summary statistics on the collated data set to analyze the data organization status of the collated data set to obtain a data organization status analysis result, performing a data consistency check on the collated data set to analyze the data accuracy of the collated data set to obtain a data accuracy analysis result, and determining the data chaos condition of the collated data set based on the data structure analysis result, the data organization status analysis result and the data accuracy analysis result.

[0073] Optionally, the constructing of a visualization chart of the collated data set, using the visualization chart to analyze the data distribution structure of the collated data set, and obtaining the data structure analysis results can display the data distribution structure through charts such as bar charts, line charts and box plots, the performing of data summary statistics on the collated data set to analyze the data organization status of the collated data set, and obtaining the data organization status analysis results can be achieved by calculating statistics such as the data mean, median, standard deviation, minimum value and maximum value of the collated data set to understand the basic characteristics of the data organization status, and the performing of data consistency check on the collated data set to analyze the data accuracy of the collated data set can be achieved by comparing data from different data sources or at different time points to ensure data consistency, such as by checking whether the monthly sales report is consistent with the annual summary report in the sales data.

[0074] Furthermore, the embodiment of the present invention optimizes the sorted data set based on the data chaos to obtain an optimized data set, which can reduce noise and errors, improve data accuracy, and thus provide a better data basis for subsequent modeling and prediction.

[0075] Optionally, based on the data chaos condition, data optimization is performed on the sorted data set to obtain the optimized data set by reconstructing the structure of the sorted data set according to the data chaos condition to obtain reconstructed data, constructing a data relationship table of the reconstructed data, and using the data relationship table to optimize the sorted data set.

[0076] S3. Calculate a data hash value of the optimized data set, calculate the data activity of the optimized data set based on the data hash value, and remove redundancy from the optimized data set based on the data activity to obtain a target data set.

[0077] The embodiment of the present invention can verify the integrity of the data by calculating the data hash value of the optimized data set to ensure that the data has not been accidentally tampered with during transmission or storage. For example, when transmitting a large data set from one server to another, the receiver can calculate the hash value of the received data and compare it with the original hash value provided by the sender. If the two are consistent, it means that the data is complete and correct; otherwise, it indicates that there is a problem with the data during transmission.

[0078] As an embodiment of the present invention, the calculating of the data hash value of the optimized data set includes: initializing the optimized data set to obtain a prepared data set, configuring a hash function for the prepared data set, and calculating the data hash value of the prepared data set using the following formula:

[0079]

[0080] Among them, H represents the data hash value, F() represents the hash function, c i Indicates the length of the i-th data string in the prepared data set, f i represents the access frequency of the i-th data, G represents the data size of the prepared data set, and y represents the data redundancy threshold of the prepared data set.

[0081] Among them, the initialization setting of the optimized data set to obtain the prepared data set means performing some necessary preparations before executing a certain operation or process to ensure that subsequent operations can proceed normally. For example, the calculation operation of the hash value can be obtained by configuring the calculation parameters of the optimized data set, loading the corresponding required resources, and preparing space for storing or processing results. The hash function can be configured using the MD-5H function.

[0082] Furthermore, the embodiment of the present invention can understand the usage frequency or update frequency of the data by calculating the data activity of the optimized data set based on the data hash value, and then analyze the popularity or attention of the data to find hot spots or active areas in the data.

[0083] As an embodiment of the present invention, the calculating the data activity of the optimized data set based on the data hash value includes: calculating the data activity of the optimized data set based on the data hash value using the following formula:

[0084]

[0085] Among them, θ represents the data activity, f() represents the mean shift transfer function, and H i Represents the data hash value of the i-th data in the optimized data set, N i represents the number of activities for the i-th data in the optimization data set, t i Indicates the active time of the i-th data in the optimized data set, T i Represents the active period of the i-th data in the optimization data set.

[0086] Furthermore, the embodiment of the present invention deduplicates the optimized data set based on the data activity to obtain a target data set, which can improve data accuracy and reliability and reduce storage costs, thereby improving the efficiency and speed of data processing.

[0087] Optionally, based on the data activity, the optimized data set is deduplicated to obtain a target data set by selecting an appropriate data activity measurement indicator according to the specific situation. For example, in transaction data, the deduplication threshold set by the user is 30 days, that is, transaction records with an activity value of less than 30 days are considered redundant records. Then, for a record with a transaction time of 45 days ago, its activity value is 45-30=15 days, which is lower than the deduplication threshold and should be deleted. Through the above steps, we can perform deduplication operations on the optimized data set based on data activity to obtain a more concise and accurate target data set, thereby improving the efficiency and quality of data analysis and decision-making. It should be noted that more factors and complex situations need to be considered in actual applications. The specific deduplication operation should be customized according to the characteristics of the data and the application scenario.

[0088] S4. Scramble the target data set to obtain scrambled data, encrypt the scrambled data to obtain initial encrypted data, perform a fuzzy test on the initial encrypted data to obtain a fuzzy test result, and when the fuzzy test result is excellent, obtain the target encrypted data.

[0089] In the embodiment of the present invention, by scrambling the target data set, the scrambled data obtained can disrupt the order of the data set, increase the randomness and complexity of the data, and thus improve the encryption effect.

[0090] As an embodiment of the present invention, the step of performing data scrambling on the target data set to obtain scrambled data includes: performing data linear transformation on the target data set using the following formula to obtain linear transformation data:

[0091]

[0092] Among them, A1 represents the first linear transformation data, A2 represents the second linear transformation data, and A n represents the nth linear transformation data, a1 represents the first linear transformation parameter in the first group, a2 represents the second linear transformation parameter in the first group, a j represents the jth linear transformation parameter in the first group, b1 represents the first linear transformation parameter in the second group, b2 represents the second linear transformation parameter in the second group, and b j represents the jth linear transformation parameter in the second group, c1 represents the first linear transformation parameter in the third group, c2 represents the second linear transformation parameter in the third group, and c j represents the jth linear transformation parameter in the third group, B1 represents the first data corresponding to the target data set, B2 represents the second data corresponding to the target data set, and B n Indicates the nth data corresponding to the target data set;

[0093] Affine transformation is performed on the linear transformation data to obtain affine transformation data, and position replacement is performed on the affine transformation data to obtain scrambled data.

[0094] Optionally, the linear transformation data is affine transformed to obtain affine transformation data which can be obtained by transforming the data through an affine transformation matrix constructed by java, and the data is permuted to obtain scrambled data which can be obtained by permuting the data front and back.

[0095] Furthermore, the embodiment of the present invention encrypts the scrambled data to obtain initial encrypted data, and can encrypt the scrambled data to protect the security of the data.

[0096] As an embodiment of the present invention, the encrypting the scrambled data to obtain initial encrypted data includes: constructing an initial key for the scrambled data, identifying a global identifier for the target data set, constructing a data public key for the scrambled data based on the global identifier, and encrypting the scrambled data based on the initial key and the data public key to obtain initial encrypted data.

[0097] The global identifier refers to an identifier that can be accessed by any function or module in a program and is usually defined in a global scope.

[0098] Optionally, the initial key for constructing the scrambled data can be generated by a key of a cryptographic algorithm, the global identifier can be obtained by reading the global code of the target data set, and the data public key for constructing the scrambled data based on the global identifier can be constructed by a random number generation method.

[0099] Furthermore, the embodiment of the present invention performs fuzzy testing on the initial encrypted data to obtain fuzzy test results, which can be used to test various abnormal inputs and situations of the encrypted data to evaluate its security and stability.

[0100] As an embodiment of the present invention, the fuzzy test is performed on the initial encrypted data to obtain the fuzzy test result, including: after determining the test scope of the initial encrypted data, constructing a fuzzy test case for the initial encrypted data to perform a fuzzy test on the initial encrypted data, and recording the test data of the initial encrypted data during the fuzzy test, identifying the test response system of the initial encrypted data based on the test data, performing anomaly analysis on the test response system, and obtaining the fuzzy test result.

[0101] Among them, determining the test scope of the initial encrypted data refers to clarifying the specific part of the encryption algorithm, encryption system or encrypted data to be tested, and all the data of the initial encrypted data can be used as the test scope. The fuzzy test case of the initial encrypted data refers to using a special fuzzy test tool to generate a large amount of random or mutated data, such as random byte sequences, abnormal input lengths, special character combinations, etc., which can be constructed by Java tools. The fuzzy test can be tested by inputting the initial encrypted data into a pre-built test system. The test system refers to the hardware and software system of the computer. The data analysis of the test data to obtain the fuzzy test results can be performed by analyzing obvious errors such as error messages, crashes, abnormal exits, etc. detected by the encryption system. The test response system refers to a system that responds to test errors and a system with data errors. The abnormal analysis of the test response system to obtain the fuzzy test results can be performed by classifying and analyzing the abnormalities and errors found to determine their possible causes and impacts.

[0102] It should be noted that when the fuzzy test result is excellent, obtaining the target encrypted data means

[0103] When the evaluation results of the fuzz test show good results (reaching the pre-set excellent standards), encrypted data that meets specific requirements or expectations is obtained, such as when a user is testing an encryption algorithm for protecting financial transaction data. After fuzz testing, it is found that no matter how complex and abnormal the input data is, the algorithm can accurately encrypt and decrypt, and the encrypted ciphertext is highly random and complex, making it difficult to crack. At this point, these successfully tested financial transaction data are "target encrypted data", which means that they are considered safe and reliable under the protection of this encryption algorithm and can be used in actual financial transaction scenarios. Specific standards need to be set in combination with actual application scenarios.

[0104] S5. Store the target encrypted data in a preconfigured non-volatile memory to obtain stored data, perform role authorization on the stored data to obtain authorized data, perform secondary encryption on the authorized data to obtain secondary encrypted data, perform data encapsulation on the secondary encrypted data to obtain encapsulated data, identify a data link between the encapsulated data and the computer hardware, perform error detection on the encapsulated data using the data link, obtain target data when the error detection result meets a preset result, set an access control policy for the computer hardware according to the target data, and construct a security encryption module for the computer hardware according to the access control policy.

[0105] The embodiment of the present invention stores the target encrypted data in a preconfigured non-volatile memory to obtain the stored data, which can ensure that the data will not be lost after the device is powered off or shut down, and also facilitates data recovery and migration. If the device fails or needs to be replaced, the stored data can be extracted from the non-volatile memory and restored to a new device or environment. Among them, the non-volatile memory refers to a memory that can retain data after power failure or shutdown, such as flash memory and read-only memory.

[0106] Furthermore, the embodiment of the present invention performs role authorization on the stored data to obtain authorized data, which can prevent unauthorized personnel from viewing sensitive information, thereby protecting data security.

[0107] As an embodiment of the present invention, the role authorization of the stored data to obtain the authorization data includes: identifying the data sensitivity of the stored data, based on the data sensitivity, user-defining the access role corresponding to the stored data to obtain a defined user, role-associating the defined user with the stored data to obtain an associated data role, and based on the associated data role, setting permissions for the stored data to obtain permission data.

[0108] The data sensitivity refers to the importance and sensitivity of the data to an organization or individual. Highly sensitive data may include personal identity information, financial information, medical records, business secrets, etc. The leakage or abuse of this data may lead to serious consequences.

[0109] Optionally, the data sensitivity of the stored data is obtained by classifying the stored data according to the sensitivity. For example, in financial transaction data, the user's basic transaction information, such as transaction time and transaction amount, can be classified into one category, which is low-sensitivity data; the user's transaction account information, including account number and account balance, can be classified into two categories, which are generally sensitive; the user's investment portfolio details, such as specific investment products and proportions, can be classified into three categories, which are medium-sensitive; the user's credit assessment report and loan application records can be classified into four categories, which are relatively sensitive; the user's large-scale fund sources and destinations, and transaction records involving suspected money laundering can be classified into five categories, which are highly sensitive; based on the data sensitivity, the access role corresponding to the stored data is user-defined, and the defined user can define the role according to the data. The sensitivity level of sensitivity is defined, such as a type of sensitive user corresponding to the access level of low-sensitivity data, and the defined user is associated with the stored data by role, and the associated data role can be obtained by classifying the access role by role level, such as administrator, ordinary employee, customer, etc., and then associated, such as low-sensitivity data: broad access rights can be granted, such as ordinary employees and customers; general sensitive data: restricted access rights, only granted to specific roles, such as employees of relevant departments; medium-sensitive data: further restricted access, only granted to senior management or specific authorized personnel; more sensitive data: strictly controlled access, limited to a few key personnel; highly sensitive data: the most stringent access control is adopted, and only specific senior leaders or regulatory agencies have access.

[0110] Based on the associated data role, the storage data is given permission, and the permission data can be obtained by setting the access permission password level.

[0111] Furthermore, the embodiment of the present invention can further improve the security level of data by performing secondary encryption on the authorization data to obtain secondary encrypted data.

[0112] As an embodiment of the present invention, the second encryption of the authorization data to obtain the second encrypted data includes: calculating a data characteristic value of the authorization data, and second encrypting the authorization data based on the data characteristic value using the following formula to obtain the second encrypted data:

[0113]

[0114] Among them, ω represents the secondary encrypted data, ρ represents the data characteristic value, and p krepresents the data access user type of the authorized data, R(p) represents the query condition of the authorized data, σ represents the encrypted ciphertext of the authorized data, and θ(p) represents the data classification function of the authorized data.

[0115] Optionally, the data feature values ​​of the authorization data may be calculated by a deep learning model.

[0116] The embodiment of the present invention performs data encapsulation on the secondary encrypted data to obtain encapsulated data, which can ensure that only authorized parties can decrypt and access the original data, and prevent the data from being tampered with during transmission or storage.

[0117] Optionally, the second encrypted data is encapsulated, and the encapsulated data obtained can be encapsulated by a digital signature method.

[0118] Furthermore, the embodiment of the present invention can ensure that the encapsulated data is not lost or damaged during transmission by performing error detection on the encapsulated data using the data link, and can promptly discover and correct errors in the data, thereby improving the credibility of the data.

[0119] As an embodiment of the present invention, the use of the data link to perform error detection on the encapsulated data includes: constructing a polynomial code of the data link, identifying the data code of the encapsulated data, using the polynomial code to update the data code to obtain an update code, using the update code and the polynomial code to construct a query symbol for the encapsulated data, and based on the query symbol, performing error detection on the encapsulated data.

[0120] Optionally, the polynomial code of the data link can be constructed by binary code, such as the polynomial "x3+x+1" corresponds to the code "1011", and the data code is updated by the polynomial code to obtain an updated code, such as the code of the data code is "101010", and the same number of 0s as the order of the polynomial code is added after the polynomial code. Assuming that the generating polynomial is of order 3, the data becomes "101010000", and the query symbol of the encapsulated data is constructed by the update code and the polynomial code, and a remainder "Q" is obtained by dividing "101010000" by "101010", and "Q" is used as the query symbol. Based on the query symbol, the encapsulated data is error-checked by appending the remainder "Q" after the encapsulated data, and finally the data to be sent is formed, and the data to be sent is sent to the receiver by the data link, for example, from "101010" to "101010001". After receiving the data, the receiver also divides the data by the generating polynomial "1011". If the remainder is 0, it means that there is no error in the data transmission process; if the remainder is not 0, it indicates that an error has occurred.

[0121] It should be noted that when the error detection result meets the preset result, the target data is obtained, which means that when the result obtained after error detection on the data meets a certain condition or standard set in advance, the detected data is identified as the target data. If the preset result is that no error is found in the error detection (that is, the remainder is 0), then when a group of data is error-detected, if the remainder is 0, this group of data meets the preset result and is determined to be the target data, which can be subsequently processed, transmitted or used.

[0122] The embodiment of the present invention can prevent unauthorized users from accessing sensitive data by setting the access control policy of the computer hardware according to the target data, ensure the confidentiality, integrity and availability of the data, reduce potential security risks, and prevent problems such as data leakage and system failure.

[0123] Among them, the access control policy is a set of rules and measures for managing and controlling access to data. The access control policy for the computer hardware is set according to the target data. The access control policy for the computer hardware can be constructed by setting data access authentication, data authorization, data access level, and auditing and monitoring through the target data.

[0124] Furthermore, the embodiment of the present invention can improve the security protection effect of the security encryption module of the computer hardware by constructing the security encryption module of the computer hardware according to the access control policy.

[0125] like Figure 2 The figure shows a functional module diagram of a system for preparing a computer hardware security encryption module according to the present invention.

[0126] The preparation system 200 of a computer hardware security encryption module described in the present invention can be installed in an electronic device. According to the functions to be implemented, the preparation system of a computer hardware security encryption module can include an original data sorting module 201, a data set optimization module 202, a data set de-redundancy module 203, a data encryption module 204, and a security encryption module preparation module 205. The module described in the present invention can also be referred to as a unit, which refers to a series of computer program segments that can be executed by an electronic device processor and can complete fixed functions, which are stored in the memory of the electronic device.

[0127] In the embodiment of the present invention, the functions of each module / unit are as follows:

[0128] The original data sorting module 201 is used to obtain the original encryption algorithm data of the computer hardware, sort the original encryption algorithm data, and obtain a sorted data set;

[0129] The data set optimization module 202 is used to identify the data distribution structure, data organization status and data accuracy of the collated data set to determine the data disorder status of the collated data set, and based on the data disorder status, perform data optimization on the collated data set to obtain an optimized data set;

[0130] The data set de-redundancy module 203 is used to calculate the data hash value of the optimized data set, calculate the data activity of the optimized data set based on the data hash value, and de-redundancy the optimized data set based on the data activity to obtain a target data set;

[0131] The data encryption module 204 is used to perform data scrambling on the target data set to obtain scrambled data, perform data encryption on the scrambled data to obtain initial encrypted data, perform fuzzy testing on the initial encrypted data to obtain fuzzy testing results, and obtain target encrypted data when the fuzzy testing results are excellent;

[0132] The security encryption module preparation module 205 is used to store the target encrypted data in a preconfigured non-volatile memory to obtain the stored data, perform role authorization on the stored data to obtain the authorization data, perform secondary encryption on the authorization data to obtain secondary encrypted data, perform data encapsulation on the secondary encrypted data to obtain encapsulated data, identify the data link between the encapsulated data and the computer hardware, perform error detection on the encapsulated data using the data link, obtain the target data when the error detection result meets the preset result, set the access control policy of the computer hardware according to the target data, and construct the security encryption module of the computer hardware according to the access control policy.

[0133] In detail, each module in the system 200 for preparing a computer hardware security encryption module in the embodiment of the present invention is used in the same manner as described above. Figure 1 The same technical means as the method for preparing a computer hardware security encryption module described in the specification and the like can produce the same technical effects, which will not be repeated here.

[0134] The above description is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A method for preparing a computer hardware security encryption module, characterized in that: The method comprises: Acquire original encryption algorithm data of computer hardware, and perform data sorting on the original encryption algorithm data to obtain a sorted data set; Identifying the data distribution structure, data organization status and data accuracy of the collated data set to determine the data disorder status of the collated data set, and optimizing the collated data set based on the data disorder status to obtain an optimized data set; Calculating a data hash value of the optimized data set, calculating data activity of the optimized data set based on the data hash value, and de-redundanting the optimized data set based on the data activity to obtain a target data set; Performing data scrambling on the target data set to obtain scrambled data, performing data encryption on the scrambled data to obtain initial encrypted data, performing a fuzzy test on the initial encrypted data to obtain a fuzzy test result, and obtaining target encrypted data when the fuzzy test result is excellent; The target encrypted data is stored in a preconfigured non-volatile memory to obtain the stored data, the stored data is role-authorized to obtain the authorized data, the authorized data is re-encrypted to obtain the re-encrypted data, the re-encrypted data is data-encapsulated to obtain the encapsulated data, a data link between the encapsulated data and the computer hardware is identified, an error detection is performed on the encapsulated data using the data link, the target data is obtained when the error detection result meets the preset result, the access control policy of the computer hardware is set according to the target data, and a security encryption module of the computer hardware is constructed according to the access control policy.

2. The method according to claim 1, characterized in that The identifying the data distribution structure, data organization status and data accuracy of the collated data set to determine the data disorder status of the collated data set includes: constructing a visualization chart of the collated data set; Analyzing the data distribution structure of the collated data set using the visualization chart to obtain a data structure analysis result; Performing data summary statistics on the collated data set to analyze the data organization status of the collated data set to obtain a data organization status analysis result; Performing a data consistency check on the collated data set to analyze the data accuracy of the collated data set and obtain a data accuracy analysis result; The data disorder status of the sorted data set is determined according to the data structure analysis result, the data organization status analysis result and the data accuracy analysis result.

3. The method according to claim 1, characterized in that The calculating the data hash value of the optimized data set includes: Initializing the optimized data set to obtain a prepared data set; After configuring the hash function for the prepared data set, the data hash value of the prepared data set is calculated using the following formula: Among them, H represents the data hash value, F() represents the hash function, and c i Indicates the string length of the i-th data in the prepared data set, f i represents the access frequency of the i-th data, G represents the data size of the prepared data set, and y represents the data redundancy threshold of the prepared data set.

4. The method according to claim 1, characterized in that The calculating the data activity of the optimized data set based on the data hash value includes: Based on the data hash value, the data activity of the optimized data set is calculated using the following formula: Among them, θ represents the data activity, f() represents the mean shift transfer function, and H i Represents the data hash value of the i-th data in the optimized data set, N i represents the number of activities for the i-th data in the optimization data set, t i Indicates the active time of the i-th data in the optimized data set, T i Represents the active period of the i-th data in the optimization data set.

5. The method according to claim 1, characterized in that The step of performing data scrambling on the target data set to obtain scrambled data includes: The target data set is linearly transformed using the following formula to obtain linearly transformed data: Among them, A1 represents the first linear transformation data, A2 represents the second linear transformation data, and A n represents the nth linear transformation data, a1 represents the first linear transformation parameter in the first group, a2 represents the second linear transformation parameter in the first group, a j represents the jth linear transformation parameter in the first group, b1 represents the first linear transformation parameter in the second group, b2 represents the second linear transformation parameter in the second group, and b j represents the jth linear transformation parameter in the second group, c1 represents the first linear transformation parameter in the third group, c2 represents the second linear transformation parameter in the third group, and c j represents the jth linear transformation parameter in the third group, B1 represents the first data corresponding to the target data set, B2 represents the second data corresponding to the target data set, and B n Indicates the nth data corresponding to the target data set; Affine transformation is performed on the linear transformation data to obtain affine transformation data, and position replacement is performed on the affine transformation data to obtain scrambled data.

6. The method according to claim 1, characterized in that The step of encrypting the scrambled data to obtain initial encrypted data includes: constructing an initial key for the scrambled data; a global identifier identifying the target data set; Based on the global identifier, construct a data public key of the scrambled data; The scrambled data is encrypted based on the initial key and the data public key to obtain initial encrypted data.

7. The method according to claim 1, characterized in that The performing a fuzzy test on the initial encrypted data to obtain a fuzzy test result includes: After determining the test scope of the initial encrypted data, construct a fuzzy test case of the initial encrypted data to perform a fuzzy test on the initial encrypted data, and record test data of the initial encrypted data during the fuzzy test; identifying a test response system for the initial encrypted data based on the test data; An abnormality analysis is performed on the test response system to obtain a fuzzy test result.

8. The method according to claim 1, characterized in that The step of performing role authorization on the stored data to obtain authorization data includes: identifying data sensitivity of the stored data; Based on the data sensitivity, user definition is performed on the access role corresponding to the stored data to obtain a defined user; Associating the defined user with the stored data to obtain an associated data role; Based on the associated data role, permission is set for the stored data to obtain permission data.

9. The method according to claim 1, characterized in that: The utilizing the data link to perform error detection on the encapsulated data comprises: constructing a polynomial code for said data link; A data code identifying the encapsulated data; Using the polynomial code to update the data code to obtain an updated code; constructing a query symbol for the encapsulated data using the update code and the polynomial code; Based on the query symbol, error detection is performed on the encapsulated data.

10. A system for preparing a computer hardware security encryption module, the system implementing the method according to any one of claims 1 to 9, characterized in that: The system comprises: The original data sorting module is used to obtain the original encryption algorithm data of the computer hardware, sort the original encryption algorithm data, and obtain a sorted data set; A data set optimization module, used for identifying the data distribution structure, data organization status and data accuracy of the collated data set to determine the data disorder status of the collated data set, and based on the data disorder status, performing data optimization on the collated data set to obtain an optimized data set; A data set de-redundancy module, used for calculating a data hash value of the optimized data set, calculating the data activity of the optimized data set based on the data hash value, and de-redundancy-reducing the optimized data set based on the data activity to obtain a target data set; A data encryption module, used for performing data scrambling on the target data set to obtain scrambled data, performing data encryption on the scrambled data to obtain initial encrypted data, performing a fuzzy test on the initial encrypted data to obtain a fuzzy test result, and obtaining target encrypted data when the fuzzy test result is excellent; A security encryption module preparation module is used to store the target encrypted data in a preconfigured non-volatile memory to obtain stored data, perform role authorization on the stored data to obtain authorization data, perform secondary encryption on the authorization data to obtain secondary encrypted data, perform data encapsulation on the secondary encrypted data to obtain encapsulated data, identify the data link between the encapsulated data and the computer hardware, perform error detection on the encapsulated data using the data link, obtain target data when the error detection result meets the preset result, set the access control policy of the computer hardware according to the target data, and construct a security encryption module for the computer hardware according to the access control policy.

Images