Security protection method and system based on big data analysis and cloud computing

Abstract

The invention belongs to the field of data security, and particularly relates to a security protection method based on big data analysis and cloud computing, and the method comprises the steps: carrying out the security evaluation grading of to-be-processed data, carrying out the preprocessing of different degrees according to the security evaluation grading of the to-be-processed data, and taking a first security protection measure; establishing a big data end and cloud computing end interactive communication protocol with an independent communication channel through key exchange as a second security and protection measure; before unpacking, confirming the consistency of double-end data through traversal proofreading of a password book and a password hidden mark, and taking the data as a third security and protection measure; the core data is coded and detranslated by a compiler to serve as a fourth security and protection measure; by setting multiple security and protection measures, data security protection during double-end interaction is carried out, the problems of data omission, data leakage and data hijacking are effectively solved, and the security of double-end interaction is improved while the data transmission integrity is ensured.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a security protection method and system based on big data analysis and cloud computing. Background Art

[0002] Big data refers to a collection of data that is large in scale and diverse in types, exceeding the processing capabilities of conventional database technology. The characteristics of big data include large data volume, fast generation speed, high diversity and uncertainty. Through the analysis and mining of big data, people can obtain important information about consumption trends, market demand, user preferences, etc., and obtain commercial value from it.

[0003] Cloud computing is a model that provides computing resources and services through the Internet. It no longer requires users to rely on local hardware and software resources, but outsources computing power to cloud service providers through the Internet. Cloud computing has the characteristics of high flexibility, low cost, and easy expansion and management. Users can adjust the use of computing resources at any time according to their needs, so as to better adapt to business changes.

[0004] Cloud computing and big data complement each other. Cloud computing provides powerful computing resources and storage capabilities, providing strong support for big data analysis. The processing of big data requires a large amount of computing resources, and cloud computing can provide elastic computing power according to demand. In addition, the high availability and disaster recovery capabilities provided by cloud computing also play an important role in the security and stability of big data. On the other hand, big data analysis can bring better resource utilization and performance optimization to cloud computing. Through in-depth analysis of big data, cloud service providers can more accurately predict user needs and optimize resource allocation. In addition, through the mining of big data, cloud computing can also provide enterprises with more value-added services, such as personalized recommendations and intelligent decision-making.

[0005] In the big data and cloud computing environment, the risk of data leakage is higher because a large amount of sensitive data is stored and processed in a centralized manner and is usually accessed through the Internet, which increases the risk of being attacked by hackers. How to maximize the value of big data and cloud computing while ensuring security and privacy protection is an urgent problem to be solved. Summary of the invention

[0006] 1. Purpose of the invention In order to solve the technical problems existing in the background technology, the present invention proposes a security protection method based on big data analysis and cloud computing, which has the characteristics of high data security protection through data classification and distributed transmission.

[0007] (II) Technical solution In order to solve the above technical problems, the present invention provides a security protection method based on big data analysis and cloud computing. Step 1: perform security assessment and classification on the data to be processed, including level 1, level 2 and level 3 general data, important data and core data, and allocate security preparation strategies for the data before communicating to the cloud computing end according to the level; Step 2: Preprocess general data, important data and core data according to the security preparation strategy, obtain general data set, important data set and core data set, and generate a code book; Step 3: Establish multiple communication channels between the big data end and the cloud computing end, where the cloud computing end includes at least one virtual sub-server, which performs key exchange before establishing the communication channel with the big data end; Step 4: After the general data set, the important data set and the core data set are combined, a group package is randomly extracted to generate several communication packages, and the passwords in the corresponding code book are hidden and marked in the communication packages; Step 5: transmitting several communication packets in parallel to each virtual sub-server through the established communication channel, and comparing the password hidden mark of each virtual sub-server receiving the communication packet with the password book of the virtual main server; Step 6: After the proofreading is completely passed, the data in the communication packet is unpacked in the virtual sub-server, and the unpacked data is aggregated to the virtual main server to obtain complete data to be processed for cloud computing.

[0008] Preferably, in step 1: performing security assessment and grading on the data to be processed includes: Classify the data to be processed according to its source, content, purpose and other attributes through the big data security capability model; The data is classified by sensitivity, importance and potential risk, and is classified into level 1, level 2 and level 3 according to low, medium and high, corresponding to general data, important data and core data; The corresponding security preparation strategies include: general security strategy, important security strategy and core security strategy.

[0009] Preferably, in step 2, preprocessing general data, important data and core data according to the security preparation strategy includes: Under the general security policy, general data is split into several data segments of the same bytes, compressed and processed to generate general data packets which are stored in the general data set; Under the important security policy, the important data is split into several data segments of the same bytes, compressed with passwords to generate important data packets and stored in the important data set; Under the core security policy, the core data is converted into encoded data through compiler encoding, the encoded data is split into several data segments of the same bytes, and the core data packets are generated after password compression and stored in the core data set.

[0010] Preferably, in step 2, generating a password book includes: numbering and collecting passwords corresponding to important data packets and core data packets of the important data set and the core data set, each set of passwords corresponding to an important data packet or a core data packet.

[0011] Preferably, in step three, multiple communication channels between the big data end and the cloud computing end are established; The two ends of a single communication channel are virtual sub-servers at the big data end and the cloud computing end respectively, and at least one communication packet is transmitted. The transmission rate of each communication channel is the same, and the data transmission rate is the sum of each communication channel. Each communication packet arrives at the corresponding virtual sub-server at the same time.

[0012] Preferably, the key exchange performed before the cloud computing end and the big data end establish a communication channel includes a symmetric key and an asymmetric key; The communication channels used for transmission of general data sets, important data sets, and core data sets are interconnected through symmetric keys; The communication channels used for the transmission of compilers and codebooks are interconnected by asymmetric keys; Among them, the asymmetric key consists of a public key and a private key. The public key is used to encrypt data, and the private key is used to decrypt data.

[0013] Preferably, in step 4, the communication packet is generated by randomly extracting a group of packets from the general data set, the important data set and the core data set, wherein one communication packet includes at least one general data packet and one important data packet or core data packet with a password, and the total number of bytes of each communication packet is the same; The passwords in the corresponding code book are hidden and marked in the communication packet, and each password is transcoded into the same number of compiled strings through a transcoding algorithm and mixed in the communication packet.

[0014] Preferably, step five also includes uploading the password book directly to the virtual main server through the communication channel of the asymmetric key interconnection, transcoding each password in the password book into a compiled string through a transcoding algorithm in the virtual main server, and the compiled string is used for traversal proofreading of the password hidden mark compiled string of the communication packet received by the virtual sub-server; When there is missing content, the virtual sub-server is denied from depacketizing the communication packet.

[0015] Step five also includes aggregating the unpacked data to the virtual main server, and de-translating the encoded core data through a compiler in the virtual main server to obtain data that is the same as the original data to be processed for cloud computing.

[0016] The present invention also provides a security protection system based on big data analysis and cloud computing, comprising: The policy allocation module performs security assessment and classification of the data to be processed, including general data, important data and core data at level one, level two and level three, and prepares security strategies for data before communicating to the cloud computing end according to the level allocation; The data processing module pre-processes general data, important data and core data according to the security preparation strategy, obtains general data sets, important data sets and core data sets, and generates a code book; A communication channel establishment module is used to establish multiple communication channels between the big data end and the cloud computing end. The cloud computing end includes at least one virtual sub-server, which performs key exchange before establishing the communication channel with the big data end. The data integration module randomly extracts group packages after the general data set, the important data set and the core data set are combined to generate several communication packages, and the passwords in the corresponding code book are hidden and marked in the communication packages; The communication proofreading module transmits several communication packets to each virtual sub-server in parallel through the established communication channel, and proofreads the password hidden mark of each virtual sub-server receiving the communication packet with the password book of the virtual main server; The cloud computing unpacking module unpacks the data in the communication package in the virtual sub-server after the proofreading is completely passed, and the unpacked data is aggregated to the virtual main server to obtain complete data to be processed for cloud computing.

[0017] The above technical solution of the present invention has the following beneficial technical effects: Carry out different levels of pre-processing according to the security assessment level of the data to be processed as the first line of security measure; Through key exchange, an interactive communication protocol between the big data end and the cloud computing end with independent communication channels is established as a second security measure; Before unpacking, the consistency of the data on both ends is confirmed by traversal proofreading of the code book and the password hidden mark as a third security measure; The core data is encoded and de-translated using a compiler as a fourth security measure; By establishing multiple security measures, data security protection is carried out during two-way interaction, effectively solving the problems of data omission, data leakage, and data hijacking, ensuring the integrity of data transmission while improving the security of two-way interaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 Schematic diagram of the method of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

[0020] like Figure 1 As shown, the present invention proposes a security protection method based on big data analysis and cloud computing, step 1, security assessment and classification of the data to be processed, including level 1, level 2 and level 3 general data, important data and core data, and security preparation strategies for data before communicating to the cloud computing end according to the level allocation; Step 2: Preprocess general data, important data and core data according to the security preparation strategy, obtain general data set, important data set and core data set, and generate a code book; Step 3: Establish multiple communication channels between the big data end and the cloud computing end, where the cloud computing end includes at least one virtual sub-server, which performs key exchange before establishing the communication channel with the big data end; Step 4: After the general data set, the important data set and the core data set are combined, a group package is randomly extracted to generate several communication packages, and the passwords in the corresponding code book are hidden and marked in the communication packages; Step 5: transmitting several communication packets in parallel to each virtual sub-server through the established communication channel, and comparing the password hidden mark of each virtual sub-server receiving the communication packet with the password book of the virtual main server; Step 6: After the proofreading is completely passed, the data in the communication packet is unpacked in the virtual sub-server, and the unpacked data is aggregated to the virtual main server to obtain complete data to be processed for cloud computing.

[0021] In this embodiment, after the data to be processed is classified, a corresponding security preparation strategy is adopted to split, transcode, compress and encrypt the data before transmission, and different degrees of preprocessing are performed according to the security assessment classification of the data as the first security measure; Through key exchange, an interactive communication protocol between the big data end and the cloud computing end with independent communication channels is established as a second security measure; Before unpacking, the consistency of the data on both ends is confirmed by traversal proofreading of the code book and the password hidden mark as a third security measure; The core data is encoded and de-translated using a compiler as a fourth security measure; By establishing multiple security measures, data security protection is carried out during two-way interaction, effectively solving the problems of data omission, data leakage, and data hijacking, and improving the security of two-way interaction.

[0022] In one embodiment, performing security assessment on the data to be processed includes: Classify the data to be processed according to its source, content, purpose and other attributes through the big data security capability model; The data is classified by sensitivity, importance and potential risk, and is classified into level 1, level 2 and level 3 according to low, medium and high, corresponding to general data, important data and core data; The corresponding security preparation strategies include: general security strategy, important security strategy and core security strategy.

[0023] Among them, preprocessing of general data, important data and core data according to the security preparation strategy includes: Under the general security policy, general data is split into several data segments of the same bytes, compressed and processed to generate general data packets which are stored in the general data set; Under the important security policy, the important data is split into several data segments of the same bytes, compressed with passwords to generate important data packets and stored in the important data set; Under the core security policy, the core data is converted into encoded data through compiler encoding, the encoded data is split into several data segments of the same bytes, and the core data packets are generated after password compression and stored in the core data set.

[0024] It is understandable that general data sets account for the highest proportion of data to be processed because they do not involve important and core data, and their leakage has no impact on security; Although important data sets are important data, they are only useful when they are called together with the core data sets associated with them. Important data cannot be used directly if obtained alone, so they are only compressed with passwords. The core data set involves core data and has the highest calling authority. Therefore, it is encoded before calling to prevent hijacking. Even if hijacking occurs and causes loss or leakage, password cracking and compiler decompression are required to increase the difficulty of cracking.

[0025] In one embodiment, generating the password book includes: numbering and collecting passwords corresponding to important data packets and core data packets of the important data set and the core data set, each group of passwords corresponding to an important data packet or a core data packet.

[0026] In one embodiment, multiple communication channels between the big data end and the cloud computing end are established; The two ends of a single communication channel are virtual sub-servers at the big data end and the cloud computing end respectively, and at least one communication packet is transmitted. The transmission rate of each communication channel is the same, and the data transmission rate is the sum of each communication channel. Each communication packet arrives at the corresponding virtual sub-server at the same time.

[0027] The key exchange performed before the cloud computing end and the big data end establish a communication channel includes symmetric keys and asymmetric keys; The communication channels used for transmission of general data sets, important data sets, and core data sets are interconnected through symmetric keys; A symmetric key is a single key used to encrypt and decrypt data. The sender on the big data end and the receiver on the cloud computing end use the same key, that is, the key is used in both the encryption and decryption processes. The main advantage of the symmetric key system is its fast encryption speed.

[0028] The communication channels used for the transmission of compilers and codebooks are interconnected by asymmetric keys; Among them, the asymmetric key consists of a public key and a private key. The public key is used to encrypt data, and the private key is used to decrypt data. The main advantage of the asymmetric key system is that the key management is simple. The private key is assigned to the user manager of the virtual master server on the cloud computing side. Therefore, if the public key on the big data side is used to encrypt data, only the person who has the private key on the cloud computing side (or has access to the private key on the cloud computing side) can decrypt the data and protect the compiler and code book.

[0029] In one embodiment, the communication packet is generated by randomly extracting a group of packets from the general data set, the important data set and the core data set, wherein one communication packet includes at least one general data packet and one important data packet or core data packet with a password, and the total number of bytes of each communication packet is the same; It should be noted that: if there is a difference in the total number of bytes of each communication packet, a virtual byte string with no practical meaning is added to the communication packet to adjust the total number of bytes of each communication packet to be the same. The purpose is to prevent hackers from distinguishing between general data, important data and core data in terms of the total number of bytes. On the other hand, it increases the difficulty of data processing in the event of a leak. The cracked communication packet appears as a garbled byte string, preventing partial extraction of important data and core data.

[0030] The password hiding mark corresponding to the password book is in the communication packet. Each password is transcoded into the same number of compiled strings through a transcoding algorithm and mixed in the communication packet. The password hiding mark hides the password in the communication packet. When the communication packet is hijacked, due to the lack of a transcoding algorithm for the password hiding mark, it is impossible to directly decrypt and decompress each data packet in the communication packet.

[0031] The password book is directly uploaded to the virtual main server through the communication channel interconnected by asymmetric keys. Each password in the password book is transcoded into a compiled string through a transcoding algorithm in the virtual main server. The compiled string is used for traversal and proofreading of the password hidden mark compiled string of the communication packet received by the virtual sub-server; When there is missing content, the virtual sub-server is denied from depacketizing the communication packet.

[0032] It can be understood that the password hidden mark is used for decryption and decompression of each data packet in the communication package on the one hand, and can serve as the numbering content on the other hand. After traversal and proofreading with the password book, the integrity of the communication package is detected to prevent phishing Trojans from defrauding the password book content.

[0033] In one embodiment, the unpacked data is aggregated to a virtual host server, and the encoded core data is de-translated by a compiler in the virtual host server to obtain data identical to the original data to be processed for cloud computing.

[0034] A security protection based on big data analysis and cloud computing, including: The policy allocation module performs security assessment and classification of the data to be processed, including general data, important data and core data at level one, level two and level three, and prepares security strategies for data before communicating to the cloud computing end according to the level allocation; The data processing module pre-processes general data, important data and core data according to the security preparation strategy, obtains general data sets, important data sets and core data sets, and generates a code book; A communication channel establishment module is used to establish multiple communication channels between the big data end and the cloud computing end. The cloud computing end includes at least one virtual sub-server, which performs key exchange before establishing the communication channel with the big data end. The data integration module randomly extracts group packages after the general data set, the important data set and the core data set are combined to generate several communication packages, and the passwords in the corresponding code book are hidden and marked in the communication packages; The communication proofreading module transmits several communication packets to each virtual sub-server in parallel through the established communication channel, and proofreads the password hidden mark of each virtual sub-server receiving the communication packet with the password book of the virtual main server; The cloud computing unpacking module unpacks the data in the communication package in the virtual sub-server after the proofreading is completely passed, and the unpacked data is aggregated to the virtual main server to obtain complete data to be processed for cloud computing.

[0035] It should be understood that the above specific embodiments of the present invention are only used to illustrate or explain the principles of the present invention, and do not constitute a limitation of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc. made without departing from the spirit and scope of the present invention should be included in the protection scope of the present invention. In addition, the appended claims of the present invention are intended to cover all changes and modifications that fall within the scope and boundaries of the appended claims, or the equivalent forms of such scope and boundaries.

Claims

1. A security protection method based on big data analysis and cloud computing, characterized in that: The following steps are involved: Step 1: Perform security assessment and classification of the data to be processed, including general data, important data and core data at level 1, level 2 and level 3, and allocate security preparation strategies for the data before communicating to the cloud computing end according to the level; Step 2: Preprocess general data, important data and core data according to the security preparation strategy, obtain general data set, important data set and core data set, and generate a code book; Step 3: Establish multiple communication channels between the big data end and the cloud computing end, where the cloud computing end includes at least one virtual sub-server, which performs key exchange before establishing the communication channel with the big data end; Step 4: After the general data set, the important data set and the core data set are combined, a group package is randomly extracted to generate several communication packages, and the passwords in the corresponding code book are hidden and marked in the communication packages; Step 5: transmitting several communication packets in parallel to each virtual sub-server through the established communication channel, and comparing the password hidden mark of each virtual sub-server receiving the communication packet with the password book of the virtual main server; Step 6: After the proofreading is completely passed, the data in the communication packet is unpacked in the virtual sub-server, and the unpacked data is aggregated to the virtual main server to obtain complete data to be processed for cloud computing.

2. According to claim 1, a security protection method based on big data analysis and cloud computing is characterized in that: In step 1, the security assessment of the data to be processed includes: Classify the data to be processed according to its source, content, purpose and other attributes through the big data security capability model; The data is classified by sensitivity, importance and potential risk, and is classified into level 1, level 2 and level 3 according to low, medium and high, corresponding to general data, important data and core data; The corresponding security preparation strategies include: general security strategy, important security strategy and core security strategy.

3. A security protection method based on big data analysis and cloud computing according to claim 2, characterized in that: In step 2, general data, important data, and core data are preprocessed according to the security preparation strategy, including: Under the general security policy, general data is split into several data segments of the same bytes, compressed and processed to generate general data packets which are stored in the general data set; Under the important security policy, the important data is split into several data segments of the same bytes, compressed with passwords to generate important data packets and stored in the important data set; Under the core security policy, the core data is converted into encoded data through compiler encoding, and the encoded data is split into several data segments with the same bytes. After being compressed with a password, a core data packet is generated and stored in the core data set.

4. According to the security protection method based on big data analysis and cloud computing in claim 1, it is characterized in that: In step 2, generating a password book includes: numbering and collecting passwords corresponding to important data packets and core data packets of the important data set and the core data set, and each group of passwords corresponds to an important data packet or a core data packet.

5. According to the security protection method based on big data analysis and cloud computing in claim 1, it is characterized in that: In step 3, multiple communication channels between the big data end and the cloud computing end are established; The two ends of a single communication channel are virtual sub-servers at the big data end and the cloud computing end respectively, and at least one communication packet is transmitted. The transmission rate of each communication channel is the same, and the data transmission rate is the sum of each communication channel. Each communication packet arrives at the corresponding virtual sub-server at the same time.

6. The security protection method based on big data analysis and cloud computing according to claim 1 is characterized in that: The key exchange performed before the cloud computing end and the big data end establish a communication channel includes symmetric keys and asymmetric keys; The communication channels used for transmission of general data sets, important data sets, and core data sets are interconnected through symmetric keys; The communication channels used for the transmission of compilers and codebooks are interconnected by asymmetric keys; Among them, the asymmetric key consists of a public key and a private key. The public key is used to encrypt data, and the private key is used to decrypt data.

7. The security protection method based on big data analysis and cloud computing according to claim 1 is characterized in that: In step 4, a communication packet is generated by randomly extracting a group of packets from the general data set, the important data set and the core data set, wherein one communication packet includes at least one general data packet and one important data packet or core data packet with a password, and the total number of bytes of each communication packet is the same; The passwords in the corresponding code book are hidden and marked in the communication packet, and each password is transcoded into the same number of compiled strings through a transcoding algorithm and mixed in the communication packet.

8. The security protection method based on big data analysis and cloud computing according to claim 1 is characterized in that: Step 5 also includes uploading the password book directly to the virtual main server through the communication channel of the asymmetric key interconnection, transcoding each password in the password book into a compiled string through a transcoding algorithm in the virtual main server, and the compiled string is used for traversal proofreading of the password hidden mark compiled string of the communication packet received by the virtual sub-server; When there is missing content, the virtual sub-server is denied from depacketizing the communication packet.

9. The security protection method based on big data analysis and cloud computing according to claim 1 is characterized in that: Step five also includes aggregating the unpacked data to the virtual main server, and de-translating the encoded core data through a compiler in the virtual main server to obtain data that is the same as the original data to be processed for cloud computing.

10. A security protection system based on big data analysis and cloud computing according to any one of claims 1 to 9, characterized in that: include: The policy allocation module performs security assessment and classification of the data to be processed, including general data, important data and core data at level one, level two and level three, and prepares security strategies for data before communicating to the cloud computing end according to the level allocation; The data processing module pre-processes general data, important data and core data according to the security preparation strategy, obtains general data sets, important data sets and core data sets, and generates a code book; A communication channel establishment module is used to establish multiple communication channels between the big data end and the cloud computing end. The cloud computing end includes at least one virtual sub-server, which performs key exchange before establishing the communication channel with the big data end. The data integration module randomly extracts group packages after the general data set, the important data set and the core data set are combined to generate several communication packages, and the passwords in the corresponding code book are hidden and marked in the communication packages; The communication proofreading module transmits several communication packets to each virtual sub-server in parallel through the established communication channel, and proofreads the password hidden mark of each virtual sub-server receiving the communication packet with the password book of the virtual main server; The cloud computing unpacking module unpacks the data in the communication package in the virtual sub-server after the proofreading is completely passed, and the unpacked data is aggregated to the virtual main server to obtain complete data to be processed for cloud computing.

Images