Secure data storage system based on cloud computing

Abstract

The present invention relates to the field of data storage technology, specifically to a secure data storage system based on cloud computing, the system comprising a data importance assessment module, a data encryption storage module, a user authority dynamic adjustment module and a data access management module. The present invention optimizes the adjustment of data access authority thresholds by combining data types, quantities and sizes to comprehensively assess the importance of data, making data storage security more accurate, dynamically adjusting the number of backups of distributed nodes according to the importance of data, improving data security and reliability, strengthening control over user access based on risk index assessment and authority adjustment of user behavior data, managing user authority in a refined manner, effectively reducing security risks caused by improper user behavior, and adjusting data access keys through authority deviation assessment, achieving stricter real-time control over data access, and ensuring the accuracy and timeliness of data storage access management.

Description

Technical Field

[0001] The present invention relates to the technical field of data storage, and in particular to a secure data storage system based on cloud computing. Background Art

[0002] The field of data storage technology involves technologies for the storage, retrieval, and management of information. The field of data storage includes various storage media, as well as methods and protocols for managing data storage and transmission, such as database management systems, file systems, and cloud storage services. Data storage technology not only focuses on improving the physical performance of storage devices, such as read and write speeds and data density, but also includes the development of technologies to improve data reliability, accessibility, and security, such as data encryption, redundant storage, and disaster recovery strategies.

[0003] Among them, secure data storage systems are data storage solutions designed to enhance data protection, prevent unauthorized access, and prevent data loss. The system usually uses encryption technology, access control, and redundant backup strategies to ensure the security and integrity of data stored in the system. It has a wide range of uses and is suitable for industries that require high security standards, such as financial services, healthcare, and government agencies, to ensure the confidentiality and security of sensitive information. By implementing comprehensive security measures, secure data storage systems help organizations comply with data protection regulations and prevent cyber attacks, thereby maintaining competitiveness in an environment where the risk of data leaks is increasing.

[0004] Traditional storage systems lack dynamic assessment of data importance and corresponding permission adjustment mechanisms, resulting in a one-size-fits-all approach to data protection, which affects the efficiency of real-time data access due to over-protection. Traditional systems rely only on static access control lists in terms of user permission management, lack real-time analysis and risk assessment of user behavior patterns, and are unable to effectively respond to internal threats or abnormal behavior, which can easily lead to security vulnerabilities. Static permission management models are inadequate in handling dynamically changing access requests, such as being unable to respond to sudden security incidents in real time, increasing the risk of data leakage. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings in the prior art and to propose a secure data storage system based on cloud computing.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: a secure data storage system based on cloud computing, the system comprising:

[0007] The data importance assessment module assesses the importance of the data based on the information of the data to be stored, according to the basic importance corresponding to the data type, combined with the quantity and size of the data, and adjusts the access permission threshold of the data according to the importance of the data to obtain the data access threshold adjustment result;

[0008] The data encryption storage module transmits the data to the cloud server based on the data access threshold adjustment result, adjusts the number of distributed backup nodes of the data according to the importance of the data, and encrypts and stores the data to obtain a data encryption storage result;

[0009] The user rights dynamic adjustment module evaluates the user risk index based on the user's data access behavior data, the deviation between the user's login node and the historical login node, the number of access password verifications, and the deviation between the login time and the historical login time. Combined with the user's basic data access rights, the user's access rights are adjusted to obtain the user rights dynamic adjustment result;

[0010] Based on the data encryption storage results and the user authority dynamic adjustment results, the data access management module compares the user access rights with the data access rights threshold, evaluates the authority deviation, and adjusts the validity period of the data access key assigned to the user according to the authority deviation, accesses the data through the access key, and obtains the data storage access management result.

[0011] The present invention is improved in that the method for evaluating the importance of data is:

[0012] Based on the data to be stored, the quantity and size information of the data to be stored are extracted, and basic importance information corresponding to the data type is obtained to obtain importance association information;

[0013] Based on the importance association information, the formula:

[0014] ;

[0015] Calculate the importance index of data , and obtain the data importance assessment results, where Represents the basic importance of the data type, is the amount of data, is the data size, and is the weight coefficient, is the complexity coefficient of the data type, is the importance index of the data.

[0016] The present invention is improved in that the step of obtaining the data access threshold adjustment result is:

[0017] Based on the data importance evaluation result, according to the data type, a baseline access permission threshold of the data is obtained to obtain threshold adjustment associated data;

[0018] The associated data is adjusted based on the threshold, by the formula:

[0019] ;

[0020] Calculate adjusted access rights threshold , get the data access threshold adjustment result, where, is the baseline access permission threshold for data, is the benchmark importance index, is the importance index of the data, is the adjustment factor, is the adjusted access permission threshold.

[0021] The present invention is improved in that the steps of obtaining the data encryption storage result are:

[0022] Extracting the importance index of the data based on the data access threshold adjustment result , and obtain the number of baseline backup nodes of the data, and obtain the data backup related information;

[0023] Based on the data backup association information, by formula:

[0024] ;

[0025] Calculate the adjusted number of backup nodes ,in, is the base of natural logarithms, is the number of baseline backup nodes, is the importance index of the data, is the adjustment factor, is the importance threshold, is the growth rate parameter, is the number of nodes after adjustment;

[0026] Based on the adjusted number of backup nodes , perform distributed backup of data, encrypt and store the data, and obtain data encryption storage results.

[0027] The present invention is improved in that the method for evaluating the user risk index is:

[0028] Based on the user's data access behavior record, the user's login behavior data is extracted, including the geographical location information of the user's login node, login time, and login access password verification times, to obtain access behavior data;

[0029] Based on the access behavior data, the formula is:

[0030] ;

[0031] Calculate login geolocation deviation , and by the formula:

[0032] ;

[0033] Calculating Login Time Deviation ,in, and Respectively represent the longitude and latitude of the currently logged in geographic location, and It is the average of the longitude and latitude of the user's historical login location. is the stability constant, Indicates the current time. is the average of the user's historical login time. To log the geographic location deviation, Login time deviation;

[0034] Based on the login geolocation deviation , Login time deviation And access behavioral data, through the formula:

[0035] ;

[0036] Calculate user risk index , get the user risk assessment result, where To log the geographic location deviation, Login time deviation, The number of failed password verifications. is the scaling factor, , and is the weight coefficient, The user risk index.

[0037] The present invention is improved in that the steps of obtaining the result of dynamic adjustment of user rights are as follows:

[0038] Based on the user risk assessment result, obtaining the user's baseline access rights and obtaining user authority related data;

[0039] Based on the user authority association data, through the formula:

[0040] ;

[0041] Calculating adjusted access rights , get the result of dynamic adjustment of user rights, where: is the user's risk index, Base access permissions for users. is the authority adjustment coefficient, is the lowest permission level, The access rights after adjustment.

[0042] The present invention is improved in that the method for evaluating the authority deviation is:

[0043] Based on the data encryption storage result and the user authority dynamic adjustment result, extracting the adjusted access rights and the adjusted access rights threshold to obtain deviation-related data;

[0044] Based on the deviation correlation data, through the formula:

[0045] ;

[0046] Calculate the authority deviation ratio , and obtain the authority deviation evaluation result, where For the adjusted access permissions, is the adjusted access permission threshold, is the stability constant, is the authority deviation ratio.

[0047] The present invention is improved in that the step of obtaining the data storage access management result is:

[0048] Based on the permission deviation evaluation result, the result is compared with the preset deviation level, and according to the preset deviation level, the user's access restriction to the data is adjusted to obtain the access restriction adjustment result;

[0049] Based on the access restriction adjustment result, a corresponding data access key is assigned to the user, and the formula is:

[0050] ;

[0051] Calculate the adjusted key validity period ,in, and is the adjustment factor, is the authority deviation ratio, is the base validity period of the key, is the adjusted key validity period;

[0052] Based on the adjusted key validity period ,The user accesses the data through the access key and obtains the ,data storage access management result.

[0053] Compared with the prior art, the advantages and positive effects of the present invention are:

[0054] In the present invention, by combining the data type, quantity and size, a comprehensive assessment of the importance of data is made, the adjustment of the data access permission threshold is optimized, the data storage security is made more accurate, the number of backups of distributed nodes is dynamically adjusted according to the importance of the data, the security and reliability of the data are improved, the security of sensitive data during transmission and storage is ensured, data leakage and unauthorized access are effectively prevented, risk index assessment and permission adjustment based on user behavior data are performed, the control over user access is strengthened, user permissions are managed in a refined manner, and the security risks caused by improper user behavior are effectively reduced, the data access key is adjusted through permission deviation assessment, and stricter real-time control over data access is achieved, ensuring the accuracy and timeliness of data storage access management. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 is a system flow chart of the present invention;

[0056] Figure 2 A flow chart for evaluating the significance of data for the present invention;

[0057] Figure 3 A flow chart of obtaining a data access threshold adjustment result according to the present invention;

[0058] Figure 4 A flowchart of obtaining data encryption storage results for the present invention;

[0059] Figure 5 A flow chart for evaluating a user risk index for the present invention;

[0060] Figure 6 A flowchart of the present invention for obtaining the result of dynamic adjustment of user rights;

[0061] Figure 7 Flowchart for evaluating authority deviations for the present invention;

[0062] Figure 8 This is a flow chart of obtaining data storage access management results according to the present invention. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0064] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating positions or positional relationships, are based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0065] See also Figure 1 The present invention provides a technical solution: a secure data storage system based on cloud computing, the system comprising:

[0066] The data importance assessment module assesses the importance of the data based on the information of the data to be stored, according to the basic importance corresponding to the data type, combined with the quantity and size of the data, and adjusts the access permission threshold of the data according to the importance of the data to obtain the data access threshold adjustment result;

[0067] The data encryption storage module transmits the data to the cloud server based on the data access threshold adjustment result, adjusts the number of distributed backup nodes of the data according to the importance of the data, and encrypts and stores the data to obtain the data encryption storage result;

[0068] The user rights dynamic adjustment module evaluates the user risk index based on the user's data access behavior data, the deviation between the user's login node and the historical login node, the number of access password verifications, and the deviation between the login time and the historical login time. Combined with the user's basic data access rights, the user's access rights are adjusted to obtain the user rights dynamic adjustment result;

[0069] Based on the data encryption storage results and the dynamic adjustment results of user permissions, the data access management module compares the user's access rights with the data's access rights threshold, evaluates the permission deviation, and adjusts the validity period of the data access key assigned to the user according to the permission deviation. The data is accessed through the access key to obtain the data storage access management results.

[0070] The results of data access threshold adjustment include the importance index corresponding to the data type, the data access permission baseline threshold, and the adjusted access permission threshold. The results of data encryption storage include the number of distributed node backups, the selected encryption algorithm, and the encrypted data storage location. The results of user permission dynamic adjustment include user risk index, basic access permissions, and adjusted access permissions. The results of data storage access management include permission deviation assessment value, permission level of data access keys, and validity period of the keys.

[0071] See also Figure 2, the method to evaluate the importance of data is:

[0072] Based on the data to be stored, the quantity and size information of the data to be stored are extracted, and basic importance information corresponding to the data type is obtained to obtain importance association information;

[0073] Based on the importance association information, the formula is:

[0074] ;

[0075] Calculate the importance index of data , and obtain the data importance assessment results, where Represents the basic importance of the data type, is the amount of data, is the data size, and is the weight coefficient, is the complexity coefficient of the data type, is the importance index of the data.

[0076] formula:

[0077] ;

[0078] Parameter details and how to obtain them:

[0079] : A coefficient that represents the basic importance of a data type. The parameter is determined by the data type. For example, certain data types such as financial information or personally identifiable information have a higher basic importance coefficient due to their sensitivity and importance to business operations. The coefficient is generally set through expert analysis or industry standards and can be obtained from a pre-set classification table in the database.

[0080] : Indicates the number of data items contained in the dataset, usually obtained directly from the metadata of the data management system or database, reflecting the size of the dataset.

[0081] : The total size of the data, usually in bytes. The information can be obtained directly from the file system or database management system, which indicates the amount of space required to store the data.

[0082] : Data type complexity coefficient, adjusted according to the complexity of the data. The coefficient can be set based on the structured degree of the data, update frequency, and usage frequency. Highly complex data (such as multidimensional databases) will have a higher coefficient, which can be set by experts or managers.

[0083] and : Weight coefficients are used to adjust the influence of different parameters on the final importance assessment. The weights are usually set through expert evaluation or statistical analysis based on previous cases.

[0084] Calculation example:

[0085] The following parameters are set:

[0086] , the basic materiality coefficient of sensitive financial data.

[0087] , the number of data items, indicating a medium-sized data set.

[0088] , data size in MB.

[0089] , corresponding to the complexity coefficient of the semi-structured data type.

[0090] , , weight coefficient.

[0091] Substituting these parameters into the formula:

[0092] ;

[0093] Calculation results, importance index , this value can be used to evaluate the importance of data. The higher the value, the higher the importance of the data.

[0094] See also Figure 3 , the steps to obtain the data access threshold adjustment results are:

[0095] Based on the data importance assessment result, according to the data type, the baseline access permission threshold of the data is obtained, and the threshold adjustment related data is obtained;

[0096] Adjust the associated data based on the threshold, through the formula:

[0097] ;

[0098] Calculate adjusted access rights threshold , get the data access threshold adjustment result, where, is the baseline access permission threshold for data, is the benchmark importance index, is the importance index of the data, is the adjustment factor, is the adjusted access permission threshold.

[0099] formula:

[0100] ;

[0101] Parameter details and how to obtain them:

[0102] : Baseline access rights threshold for data, usually set based on the data's security classification and protection level. For example, sensitive personal data may have a higher baseline threshold. The value can be obtained directly from the security policy document or security management system.

[0103] : The preset baseline importance index, which represents the importance index of the corresponding baseline access permission threshold, is usually set by the data governance team based on industry standards.

[0104] : The importance index of the data, calculated by the previous method.

[0105] : Adjustment coefficient, used to adjust the impact of the importance index on the access permission threshold. The coefficient is adjusted according to the security policy and data sensitivity requirements to ensure the rationality and sensitivity of the threshold adjustment.

[0106] Calculation example:

[0107] Set the following parameters:

[0108] , baseline access rights threshold, , benchmark importance index, , the importance index of the data, , adjustment coefficient.

[0109] Calculation process:

[0110] ;

[0111] The calculation results show that due to the high importance of the data, the access permission threshold is adjusted from 50 to 53, which reflects the sensitive response of the security policy to the change of data importance, improves the protection level of the data, and makes the data access permission more stringent to better protect sensitive information.

[0112] See also Figure 4 , the steps to obtain the data encryption storage result are:

[0113] Extract the importance index of data based on the data access threshold adjustment results , and obtain the number of baseline backup nodes of the data, and obtain the data backup related information;

[0114] Based on the data backup association information, through the formula:

[0115] ;

[0116] Calculate the adjusted number of backup nodes ,in, is the base of natural logarithms, is the number of baseline backup nodes, is the importance index of the data, is the adjustment factor, is the importance threshold, is the growth rate parameter, is the number of nodes after adjustment;

[0117] Based on the adjusted number of backup nodes , perform distributed backup of data, encrypt and store the data, and obtain data encryption storage results.

[0118] formula:

[0119] ;

[0120] Parameter details and how to obtain them:

[0121] :The number of baseline backup nodes is the minimum number of backup nodes preset for the data type. This value is set based on the basic security requirements and business needs of the data, and is usually determined by data management policies or industry standards.

[0122] : The importance index of the data, calculated by the previous method.

[0123] : Adjustment coefficient, used to balance the relationship between importance assessment and node quantity adjustment. This coefficient is set based on data security requirements and backup strategy flexibility to ensure that the number of nodes can be adjusted accordingly when the importance of data changes significantly.

[0124] : Importance threshold, used to define when to add a backup node. It is a fixed value preset based on the data protection level, usually set by the data security policy.

[0125] : Growth rate parameter, used to determine the rate at which the number of backup nodes increases when the importance of data is significantly higher than the threshold. This parameter reflects the need for accelerating response to data that exceeds the normal protection requirements.

[0126] Calculation example:

[0127] The parameters are set as follows:

[0128] : The number of baseline backup nodes, applicable to general commercial data.

[0129] : Importance index.

[0130] : Adjustment coefficient.

[0131] : The set importance threshold.

[0132] : Growth rate parameter.

[0133] Calculation process:

[0134] ;

[0135] The calculation process shows that the number of nodes increased from the baseline of 3 to 5 nodes, providing stronger data redundancy and recovery capabilities to cope with potential data loss or failure risks.

[0136] See also Figure 5 ,The method for evaluating the user risk index is:

[0137] Based on the user's data access behavior record, the user's login behavior data is extracted, including the geographical location information of the user's login node, login time, and login access password verification times, to obtain access behavior data;

[0138] Based on the access behavior data, through the formula:

[0139] ;

[0140] Calculate login geolocation deviation , and by the formula:

[0141] ;

[0142] Calculating Login Time Deviation ,in, and Respectively represent the longitude and latitude of the currently logged in geographic location, and It is the average of the longitude and latitude of the user's historical login location. is the stability constant, Indicates the current time. is the average of the user's historical login time. To log the geographic location deviation, Login time deviation;

[0143] Based on login geolocation bias , Login time deviation And access behavior data, through the formula:

[0144] ;

[0145] Calculate user risk index , get the user risk assessment result, where To log the geographic location deviation, Login time deviation, The number of failed password verifications. is the scaling factor, , and is the weight coefficient, The user risk index.

[0146] formula:

[0147] and and ;

[0148] Parameter details and how to obtain them:

[0149] Geographic Bias : Calculate geographic location deviation It is to measure the difference between the user's current login location and its historical average login location by extracting the longitude of the user's current login node and latitude and log longitude with the historical average and latitude For comparison, the Euclidean distance formula is used to calculate this deviation. It is a stability constant added to prevent the variance from being zero during calculation.

[0150] Login time deviation :Login time deviation is used to measure the difference between the user's current login time and the historical average login time. This is done by comparing the current login time The historical average time to calculate.

[0151] Password verification failure times : The data is obtained directly from the security system and records the number of times the user's password verification fails in the current session.

[0152] : Scaling factor, used to scale the calculation results.

[0153] , and : The weight coefficients correspond to the importance of geographic location deviation, time deviation and number of password verification failures in risk assessment, and are set according to risk judgment requirements.

[0154] Calculation examples;

[0155] Set the parameters as follows:

[0156] Current login node longitude ,latitude , historical mean longitude ,latitude , current login time , historical average login time , , , , , , .

[0157] Calculate the geolocation bias:

[0158] ;

[0159] Calculate the time deviation:

[0160] ;

[0161] Now apply the risk assessment formula:

[0162] ;

[0163] Calculated risk index It shows that after considering geographic location deviation, time deviation and number of login errors, the user is assessed as a lower risk. This risk index can be used to adjust the user's data access permissions to ensure that security policies match user behavior risks.

[0164] See also Figure 6 , the steps to obtain the results of dynamic adjustment of user permissions are:

[0165] Based on the user risk assessment results, obtain the user's baseline access rights and obtain user permission-related data;

[0166] Based on the user rights associated data, through the formula:

[0167] ;

[0168] Calculating adjusted access rights , get the result of dynamic adjustment of user rights, where: is the user's risk index, Base access permissions for users. is the authority adjustment coefficient, is the lowest permission level, The access rights after adjustment.

[0169] formula:

[0170] ;

[0171] Parameter details and how to obtain them:

[0172] : User risk index, calculated by the previous method.

[0173] : Baseline access rights for users, which are usually pre-set in an organization based on their responsibilities and roles. For example, administrators may have higher baseline rights, while regular users may have lower ones.

[0174] : The permission adjustment factor is a preset factor used to adjust the user's access rights according to the user's risk index. The factor reflects the organization's overall attitude towards security sensitivity. A higher value means that the permission adjustment is more sensitive to risk.

[0175] : The minimum permission level set by the system. The set minimum permission level generally corresponds to the permission to browse file directories.

[0176] Calculation example:

[0177] Set the parameters as follows:

[0178] User Risk Index .

[0179] Baseline access rights , suitable for an employee with medium responsibilities.

[0180] Authority adjustment factor , indicating that for every increase in risk unit, the user's authority will decrease by 0.2.

[0181] Minimum permission level , ensuring that users retain basic access capabilities.

[0182] Enter the formula for calculation:

[0183] ;

[0184] Calculation results , indicating that the user's access rights have been adjusted from the baseline value of 10 to 8. Due to the high risk of his behavior, his rights have been reduced, but are still above the minimum limit. This adjustment is intended to reduce potential security risks while maintaining business efficiency.

[0185] See also Figure 7 , the method to evaluate permission deviation is:

[0186] Based on the data encryption storage result and the user authority dynamic adjustment result, the adjusted access rights and the adjusted access rights threshold are extracted to obtain deviation-related data;

[0187] Based on the deviation correlation data, through the formula:

[0188] ;

[0189] Calculate the authority deviation ratio , and obtain the authority deviation evaluation result, where For the adjusted access permissions, is the adjusted access permission threshold, is the stability constant, is the authority deviation ratio.

[0190] formula:

[0191] ;

[0192] Parameter details and how to obtain them:

[0193] : The adjusted user access rights are calculated using the previous method.

[0194] : The adjusted access permission threshold, calculated using the previous method.

[0195] : Stability constant. This parameter is mainly used to prevent the denominator from being zero. It is usually taken as a very small value, such as 0.01, to ensure that it will not have a substantial impact on the result while effectively avoiding calculation errors.

[0196] Calculation example:

[0197] Set the parameters as follows:

[0198] : Indicates the adjusted permissions of a user based on his / her risk assessment.

[0199] : Represents the access permission threshold for sensitive data.

[0200] : Stability constant.

[0201] Calculation process:

[0202] ;

[0203] Calculated , indicating that the user's current permissions are about 24.99% lower than the required data access permissions. The ratio indicates that the user's permissions are low, so it is necessary to restrict the user's access to the data to ensure data security.

[0204] See also Figure 8 , the steps to obtain the data storage access management results are:

[0205] Based on the permission deviation assessment result, the result is compared with the preset deviation level, and the user's access restriction to the data is adjusted according to the preset deviation level to obtain the access restriction adjustment result;

[0206] Based on the access restriction adjustment results, the corresponding data access key is assigned to the user, and the formula is used:

[0207] ;

[0208] Calculate the adjusted key validity period ,in, and is the adjustment factor, is the authority deviation ratio, is the base validity period of the key, is the adjusted key validity period;

[0209] Based on the adjusted key validity period ,The user accesses the data through the access key and obtains the ,data storage access management result.

[0210] formula:

[0211] ;

[0212] Parameter details and how to obtain them:

[0213] : Permission deviation ratio, calculated using the previous method.

[0214] : Baseline validity period, usually preset based on the sensitivity of the data and the usual access requirements. This is the standard validity period for data access keys without any risk adjustment.

[0215] and : is the adjustment factor, which is used to adjust the validity period of the key according to the deviation ratio. directly affects the product of the deviation ratio, and The proportion of deviations within the logarithmic term is adjusted. This setting is intended to increase the nonlinearity of the response to deviations, so that small deviations have smaller effects, while large deviations lead to more significant shelf life adjustments.

[0216] Calculation example:

[0217] Set the following parameters:

[0218] : The user's permission deviation ratio.

[0219] Hours: Benchmark validity period.

[0220] : The authority deviation ratio directly affects the coefficient.

[0221] : Logarithmic adjustment factor, used to increase the nonlinear characteristics of the calculation.

[0222] Calculation examples;

[0223] Substitute the improved formula for calculation:

[0224] ;

[0225] ;

[0226] ;

[0227] ;

[0228] ;

[0229] Calculation results, hours, indicating that because the user's access rights are below the required threshold, the validity period of his data access key is reduced from the baseline 12 hours to about 10.78 hours. This adjustment of the validity period reflects the dynamic security management strategy based on user permission deviation, which manages the access risk of sensitive data by fine-tuning the key validity period.

[0230] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A secure data storage system based on cloud computing, characterized in that: The system comprises: The data importance assessment module assesses the importance of the data based on the information of the data to be stored, according to the basic importance corresponding to the data type, combined with the quantity and size of the data, and adjusts the data access permission threshold according to the importance of the data to obtain the data access permission threshold adjustment result; The method for evaluating the importance of data is: Based on the data to be stored, the quantity and size information of the data to be stored are extracted, and basic importance information corresponding to the data type is obtained to obtain importance association information; Based on the importance association information, the formula: ； Calculate the importance index of data , and obtain the data importance assessment results, where Represents the basic importance of the data type, is the amount of data, is the data size, and is the weight coefficient, is the complexity coefficient of the data type, is the importance index of the data; The steps for obtaining the data access permission threshold adjustment result are: Based on the data importance evaluation result, according to the data type, a baseline access permission threshold of the data is obtained to obtain threshold adjustment associated data; The associated data is adjusted based on the threshold, by the formula: ； Calculating adjusted access rights thresholds , get the data access permission threshold adjustment result, where, is the baseline access permission threshold for data, is the benchmark importance index, is the importance index of the data, is the adjustment factor, is the adjusted access permission threshold; The data encryption storage module transmits the data to the cloud server based on the data access permission threshold adjustment result, adjusts the number of distributed backup nodes of the data according to the importance of the data, and encrypts and stores the data to obtain a data encryption storage result; The user rights dynamic adjustment module evaluates the user risk index based on the user's data access behavior data, the deviation between the user's login node and the historical login node, the number of access password verifications, and the deviation between the login time and the historical login time. Combined with the user's basic data access rights, the user's access rights are adjusted to obtain the user rights dynamic adjustment result; Based on the data encryption storage results and the user authority dynamic adjustment results, the data access management module compares the user access rights with the data access rights threshold, evaluates the authority deviation, and adjusts the validity period of the data access key assigned to the user according to the authority deviation, accesses the data through the access key, and obtains the data storage access management result.

2. The secure data storage system based on cloud computing according to claim 1, characterized in that: The steps for obtaining the data encryption storage result are: Extracting the importance index of the data based on the data access permission threshold adjustment result , and obtain the number of baseline backup nodes of the data, and obtain the data backup related information; Based on the data backup association information, by formula: ； Calculate the adjusted number of backup nodes ,in, is the base of natural logarithms, is the number of baseline backup nodes, is the importance index of the data, is the adjustment factor, is the importance threshold, is the growth rate parameter, is the number of nodes after adjustment; Based on the adjusted number of backup nodes , perform distributed backup of data, encrypt and store the data, and obtain data encryption storage results.

3. The secure data storage system based on cloud computing according to claim 1, characterized in that: The method for evaluating the user risk index is: Based on the user's data access behavior record, the user's login behavior data is extracted, including the geographical location information of the user's login node, login time, and login access password verification times, to obtain access behavior data; Based on the access behavior data, the formula is: ； Calculate login geolocation deviation , and by the formula: ； Calculating Login Time Deviation ,in, and Respectively represent the longitude and latitude of the currently logged in geographic location, and It is the average of the longitude and latitude of the user's historical login location. is the stability constant, Indicates the current time. is the average of the user's historical login time. To log the geographic location deviation, Login time deviation; Based on the login geolocation deviation , Login time deviation And access behavioral data, through the formula: ； Calculate user risk index , get the user risk assessment result, where To log the geographic location deviation, Login time deviation, The number of failed password verifications. is the scaling factor, , and is the weight coefficient, The user risk index.

4. The cloud computing-based secure data storage system according to claim 3, characterized in that: The steps for obtaining the user rights dynamic adjustment result are: Based on the user risk assessment result, obtaining the user's baseline access rights and obtaining user authority related data; Based on the user authority association data, through the formula: ； Calculating adjusted access rights , get the result of dynamic adjustment of user rights, where: is the user's risk index, Base access permissions for users. is the authority adjustment coefficient, is the lowest permission level, The access rights after adjustment.

5. The secure data storage system based on cloud computing according to claim 1, characterized in that: The method for evaluating authority deviation is: Based on the data encryption storage result and the user authority dynamic adjustment result, extracting the adjusted access rights and the adjusted access rights threshold to obtain deviation-related data; Based on the deviation correlation data, through the formula: ； Calculate the authority deviation ratio , and obtain the authority deviation evaluation result, where For the adjusted access permissions, is the adjusted access permission threshold, is the stability constant, is the authority deviation ratio.

6. The cloud computing-based secure data storage system according to claim 5, characterized in that: The steps for obtaining the data storage access management result are: Based on the permission deviation evaluation result, the result is compared with the preset deviation level, and according to the preset deviation level, the user's access restriction to the data is adjusted to obtain the access restriction adjustment result; Based on the access restriction adjustment result, a corresponding data access key is assigned to the user, and the formula is: ； Calculate the adjusted key validity period ,in, and is the adjustment factor, is the authority deviation ratio, is the base validity period of the key, is the adjusted key validity period; Based on the adjusted key validity period ,The user accesses the data through the access key and obtains the ,data storage access management result.

Images