Encryption system and method for file management security measures

Abstract

The present invention relates to the technical field of electronic archive management, and discloses an encryption system for archive management security measures, the system comprising: an archive storage center, for storing and calling user archive information; a monitoring end, comprising a flow monitoring module and an access monitoring module, the flow monitoring module is used to monitor the network flow of the archive storage center, and the access monitoring module is used to monitor the user's archive access records; a task generation end, for performing comprehensive evaluation and analysis on the monitoring results of the flow monitoring module and the access monitoring module, and judging the archive leakage risk according to the comprehensive evaluation and analysis results. The present invention adopts a new encryption algorithm to encrypt and update the archive information data with leakage risk, and at the same time, performs off-site backup of the encrypted and updated archive information data, thereby achieving the effect of reducing the risk of electronic archive leakage.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic archive management, and in particular to an encryption system and method for archive management security measures. Background Art

[0002] With the continuous maturity of Internet technology, the transition from paper archives to electronic archives is an important trend in the field of archives management. This transformation has brought many conveniences and advantages. The outstanding advantages of electronic archives are that they are easy to store and find, save space, can be quickly transmitted and consulted, and the security of electronic archives can be guaranteed by setting permissions and encryption technologies.

[0003] Electronic archive encryption specifically refers to the use of encryption technology to process archive data so that it exists in ciphertext form. Only people holding the corresponding decryption key can restore and access the original data. Its main purpose is to prevent unauthorized access, leakage, tampering or destruction, and protect the privacy and security of archive information. However, electronic archives rely on electronic devices and networks. When the archive storage center server is maliciously attacked, there is still a great risk of data leakage. How to reduce this risk is directly related to the development of digital archive management. Summary of the invention

[0004] The purpose of the present invention is to provide an encryption system and method for file management security measures to solve the above technical problems:

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] An encryption system for archive management security measures, the system comprising:

[0007] File storage center, used to store and call user file information;

[0008] The monitoring terminal includes a flow monitoring module and an access monitoring module. The flow monitoring module is used to monitor the flow of the network of the archive storage center, and the access monitoring module is used to monitor the archive access records of the user;

[0009] The task generation end is used to conduct a comprehensive evaluation and analysis on the monitoring results of the traffic monitoring module and the access monitoring module, and judge the risk of file leakage according to the comprehensive evaluation and analysis results, and then establish a file encryption update task and a file backup task according to the size of the file leakage risk;

[0010] A disaster recovery backup module, comprising a plurality of backup servers located at a different location from the archive storage center, the backup servers being used to perform the archive backup task;

[0011] The encryption module is used to execute the encryption update task, and the encryption module has several encryption algorithms built in.

[0012] As a further technical solution, the system further includes:

[0013] A communication module, used to establish a communication relationship between the archive storage center and the backup server;

[0014] The human-computer interaction module includes an information verification unit and a display unit. The information verification unit is used to verify the identity information of the user. The display unit is used to output the encrypted update record and backup record of the corresponding file to the user after the identity information of the user is verified.

[0015] As a further technical solution, the encryption module includes:

[0016] A storage encryption unit, used for encrypting the archive data in the archive storage center;

[0017] The transmission encryption unit is used to encrypt the archive information before sending the archive information data from the archive storage center to the backup server during the execution of the archive backup task.

[0018] As a further technical solution, the process of monitoring the network traffic of the archive storage center includes:

[0019] Configure the port mirroring function on the network equipment of the archive storage center to mirror the traffic to the monitoring port;

[0020] Deploy traffic analysis tools on the monitoring port to capture the mirrored traffic;

[0021] Generate a flow change graph within a preset time period according to the captured flow;

[0022] The flow change graph is analyzed according to a preset analysis algorithm, and the analysis result indicates whether the flow fluctuates abnormally.

[0023] As a further technical solution, the preset analysis algorithm includes:

[0024] Smoothing the flow change curve in the flow change diagram;

[0025] Divide the flow change curve evenly into n unit time period data;

[0026] ；

[0027] ；

[0028] ;

[0029] By formula ~ Calculate and obtain abnormal traffic characteristic parameters ;

[0030] in, is the average flow value of the flow change curve; is the flow rate variation over time; It is the preset standard flow curve; , are respectively the left and right endpoints of the preset time period; , are the left and right endpoints of the i-th unit time period; is the duration of the unit period; is the preset scale factor, and .

[0031] As a further technical solution, the process of monitoring the user's file access records includes:

[0032] Obtaining original information data from the user's file access record, the original information data including the user's access address, access volume, access interval length, and number of information verifications during access;

[0033] By formula Calculate the abnormal access characteristic parameters ;

[0034] in, , , is a preset first weight coefficient; , They are the communication distance between different access addresses corresponding to the change of the access address and the interval between two accesses; The total number of visits within the preset time period; The maximum number of times information verification is triggered during a single visit.

[0035] As a further technical solution, the process of establishing the archive encryption update task and the archive backup task includes:

[0036] By formula Calculate the risk factor of file leakage ;

[0037] in, , is a preset second weight coefficient; is a preset abnormal traffic characteristic parameter benchmark value; The preset abnormal access characteristic parameter baseline value;

[0038] The risk factor of file leakage With preset range For comparison:

[0039] like , then no archive encryption update task and archive backup task will be generated;

[0040] like , only the archive encryption update task is generated;

[0041] like , after the file encryption update task is generated, the encrypted and updated files are backed up off-site through the backup server.

[0042] An encryption method for archive management security measures, the method comprising the following steps:

[0043] S1. Monitor the network traffic of the archive storage center, import the monitoring data into the trained algorithm model, and output the traffic monitoring results to indicate whether there is any abnormality in the network traffic;

[0044] S2. Monitor the user's access records, obtain original information data from the user's file access records, parse the original data, and output access monitoring results to indicate whether there is abnormal access;

[0045] S3, conducting a comprehensive evaluation and analysis on the traffic monitoring results and the access monitoring results, and determining the risk of file leakage based on the comprehensive evaluation and analysis results;

[0046] S4. Establish file encryption update tasks and file backup tasks according to the risk of file leakage;

[0047] S5. Execute encryption update tasks and archive backup tasks.

[0048] Beneficial effects of the present invention:

[0049] The present invention determines the risk of archive leakage based on the monitoring and analysis of the network traffic of the archive storage center and the user access information, adopts a new encryption algorithm to encrypt and update the archive information data with leakage risk, and simultaneously backs up the encrypted and updated archive information data off-site, thereby achieving the effect of reducing the risk of electronic archive leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The present invention will be further described below in conjunction with the accompanying drawings.

[0051] Figure 1 A block diagram showing the contents of the encryption system for the file management security measure of the present invention;

[0052] Figure 2 The figure is a flow chart of the encryption method of the file management security measure in the present invention. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] See also Figure 1 As shown, an encryption system for archive management security measures, the system comprising:

[0055] The archive storage center is used to store and retrieve the user's archive information. The archive storage center can be divided into many types according to its nature and service objects, such as commercial document center, archive storage center, etc.

[0056] The monitoring end includes a flow monitoring module and an access monitoring module. The flow monitoring module is used to monitor the flow of the network of the archive storage center. The flow monitoring module can specifically adopt the open source network monitoring tool Nagios, which can be used to monitor the flow of the archive storage center server and network equipment. The access monitoring module is used to monitor the user's archive access records. The access monitoring module is combined with the database of the archive storage center to automatically record the detailed information of each archive access, including the access time, access user, access method, etc.

[0057] The task generation end is used to conduct a comprehensive evaluation and analysis on the monitoring results of the traffic monitoring module and the access monitoring module, and judge the risk of file leakage according to the comprehensive evaluation and analysis results, and then establish the file encryption update task and the file backup task according to the size of the file leakage risk. If the leakage risk determined by the system is small, it is only necessary to encrypt and update the file through a new encryption algorithm. If the leakage risk is large, the encrypted and updated file needs to be remotely transmitted and backed up to reduce the risk of irreversible file leakage.

[0058] The disaster recovery backup module includes several backup servers that are set up remotely from the archive storage center. The backup servers are used to execute the archive backup tasks. It should be noted that in order to reduce the redundancy and occupied space of the archives, the disaster recovery backup module only backs up the archive data when receiving a backup task.

[0059] The encryption module is used to execute the encryption update task. The encryption module has several encryption algorithms built in. Each time the encryption update task is executed, a new encryption algorithm is used to encrypt the archive data, and a new key is generated and sent to the verified user.

[0060] Through the above technical solution, this embodiment provides an encryption system for archive management security measures. According to the monitoring of the network traffic of the archive storage center and the user access information, the risk of archive leakage is judged, and the archive information data with leakage risk is encrypted and updated using a new encryption algorithm. At the same time, the encrypted and updated archive information data is backed up off-site, thereby achieving the effect of reducing the risk of electronic archive leakage.

[0061] The system further comprises:

[0062] A communication module, used to establish a communication relationship between the archive storage center and the backup server;

[0063] The human-computer interaction module includes an information verification unit and a display unit. The information verification unit is used to verify the identity information of the user. The display unit is used to output the encrypted update record and backup record of the corresponding file to the user after the identity information of the user is verified.

[0064] Through the above technical solution, this embodiment provides a communication module and a human-computer interaction module for realizing remote communication between the archive storage center and the backup server, wherein the human-computer interaction module includes an information verification unit and a display unit, the information verification unit can verify the identity information of the user, and the display unit outputs the encrypted update record and backup record of the corresponding archive to the user after the identity information of the user is verified. It is convenient for users or dynamic information of archives.

[0065] The encryption module comprises:

[0066] A storage encryption unit, used for encrypting the archive data in the archive storage center;

[0067] The transmission encryption unit is used to encrypt the archive information before sending the archive information data from the archive storage center to the backup server during the execution of the archive backup task.

[0068] Through the above technical scheme, this embodiment provides the specific content of the encryption module, wherein the storage encryption unit can encrypt the archive data in the archive storage center, and when the encryption algorithm changes, the encryption update of the archive data is correspondingly implemented. The transmission encryption unit, during the execution of the archive backup task, first compresses and transmits the archive information data after the encryption update, and then sends the compressed and encrypted data to the backup server for backup, so as to improve the efficiency of transmission backup.

[0069] The process of monitoring the network traffic of the archive storage center includes:

[0070] Configure the port mirroring function on the network equipment of the archive storage center to mirror the traffic to the monitoring port;

[0071] Deploy traffic analysis tools on the monitoring port to capture the mirrored traffic;

[0072] Generate a flow change graph within a preset time period according to the captured flow;

[0073] The flow change graph is analyzed according to a preset analysis algorithm, and the analysis result indicates whether the flow fluctuates abnormally.

[0074] Through the above technical solution, this embodiment provides a process for monitoring the flow of the network of the archive storage center. Specifically, first, the port mirroring function is configured on the network equipment of the archive storage center to mirror the flow to the monitoring port, and then the flow analysis tool is deployed on the monitoring port to capture the mirrored flow. According to the captured flow, a flow change graph within a preset period is generated, and finally the flow change graph is analyzed according to a preset analysis algorithm, and the analysis result indicates whether the flow fluctuates abnormally. Because when the flow fluctuates abnormally or increases sharply, it may be related to the generation of a large number of flow task packets in a short period of time, which is also a precursor to malicious attacks on the system.

[0075] The preset analysis algorithm includes:

[0076] Smoothing the flow change curve in the flow change diagram;

[0077] Divide the flow change curve evenly into n unit time period data;

[0078] ；

[0079] ；

[0080] ;

[0081] By formula ~ Calculate and obtain abnormal traffic characteristic parameters ;

[0082] in, is the average flow value of the flow change curve; is the flow rate variation over time; It is the preset standard flow curve; , are respectively the left and right endpoints of the preset time period; , are the left and right endpoints of the i-th unit time period; is the duration of the unit period; is the preset scale factor, and .

[0083] Through the above technical solution, the present embodiment presets the content of the analysis algorithm. Specifically, firstly, the flow change curve in the flow change graph is smoothed, and then the flow change curve is evenly divided into n unit time period data;

[0084] ;

[0085] ;

[0086] ;

[0087] By formula ~ Calculate and obtain abnormal traffic characteristic parameters , when the abnormal traffic characteristic parameters When it is too large, it reflects that the flow rate has large fluctuations or is significantly higher than the normal range. It should be noted that in the formula, is a preset standard flow curve, which can be obtained based on empirical data. is a preset proportional coefficient, which can be obtained by fitting experimental data.

[0088] The process of monitoring the user's file access records includes:

[0089] Obtaining original information data from the user's file access record, the original information data including the user's access address, access volume, access interval length, and number of information verifications during access;

[0090] By formula Calculate the abnormal access characteristic parameters ;

[0091] in, , , is a preset first weight coefficient; , They are the communication distance between different access addresses corresponding to the change of the access address and the interval between two accesses; The total number of visits within the preset time period; The maximum number of times information verification is triggered during a single visit.

[0092] Through the above technical solution, this embodiment provides a process for monitoring the user's file access records. Specifically, firstly, the original information data is extracted from the user's file access records, and the original information data includes the user's access address, access volume, access interval length, and information verification times during access. Then, according to the formula Calculate the abnormal access characteristic parameters , in the formula, , They are the communication distance between different access addresses corresponding to the change of access address and the interval between two accesses. It is the total number of visits within the preset time period. This is the maximum number of times that information verification is triggered during a single access, so the abnormal access characteristic parameter The larger the value of reflects the greater the degree of access anomaly. It should also be noted that , , is a preset first weight coefficient, which is obtained based on empirical data.

[0093] The process of establishing file encryption update tasks and file backup tasks includes:

[0094] By formula Calculate the risk factor of file leakage ;

[0095] in, , is a preset second weight coefficient; is a preset abnormal traffic characteristic parameter benchmark value; The preset abnormal access characteristic parameter baseline value;

[0096] The risk factor of file leakage With preset range For comparison:

[0097] like , then no archive encryption update task and archive backup task will be generated;

[0098] like , only the archive encryption update task is generated;

[0099] like , after the file encryption update task is generated, the encrypted and updated files are backed up off-site through the backup server.

[0100] Through the above technical solution, this embodiment establishes the process of file encryption update task and file backup task. Specifically, firstly, through the formula Calculate the risk factor of file leakage , and then the risk factor of file leakage With preset range For comparison: , it means there is no risk of file information leakage, so no file encryption update task or file backup task is generated. , indicating that there is a risk of archive information leakage, but the risk is low, so only the archive encryption update task is generated, and the archive data is re-encrypted using other encryption algorithms built into the encryption module. When the file is encrypted, it indicates that there is a greater risk of file information leakage. Therefore, after the file encryption update task is generated, the encrypted and updated files are backed up off-site through the backup server.

[0101] See also Figure 2 As shown, an encryption method for archive management security measures comprises the following steps:

[0102] S1. Monitor the network traffic of the archive storage center, import the monitoring data into the trained algorithm model, and output the traffic monitoring results to indicate whether there is any abnormality in the network traffic;

[0103] S2. Monitor the user's access records, obtain original information data from the user's file access records, parse the original data, and output access monitoring results to indicate whether there is abnormal access;

[0104] S3, conducting a comprehensive evaluation and analysis on the traffic monitoring results and the access monitoring results, and determining the risk of file leakage based on the comprehensive evaluation and analysis results;

[0105] S4. Establish file encryption update tasks and file backup tasks according to the risk of file leakage;

[0106] S5. Execute encryption update tasks and archive backup tasks.

[0107] Through the above technical scheme, this embodiment provides an encryption method for archive management security measures. First, the network traffic of the archive storage center and the user access information are monitored, judged and analyzed. Then, the risk of archive leakage is judged based on the monitoring and analysis results, and a new encryption algorithm is used to encrypt and update the archive information data with leakage risks. At the same time, the encrypted and updated archive information data is backed up off-site, thereby reducing the risk of archive information leakage.

[0108] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. An encryption system for file management security measures, characterized in that: The system comprises: File storage center, used to store and call user file information; The monitoring terminal includes a flow monitoring module and an access monitoring module. The flow monitoring module is used to monitor the flow of the network of the archive storage center, and the access monitoring module is used to monitor the archive access records of the user; The task generation end is used to conduct a comprehensive evaluation and analysis on the monitoring results of the traffic monitoring module and the access monitoring module, and judge the risk of file leakage according to the comprehensive evaluation and analysis results, and then establish a file encryption update task and a file backup task according to the size of the file leakage risk; A disaster recovery backup module, comprising a plurality of backup servers which are remotely located from the archive storage center, and the backup servers are used to perform the archive backup task; An encryption module, used to execute the encryption update task, the encryption module has several built-in encryption algorithms; The process of monitoring the network traffic of the archive storage center includes: Configure the port mirroring function on the network equipment of the archive storage center to mirror the traffic to the monitoring port; Deploy traffic analysis tools on the monitoring port to capture the mirrored traffic; Generate a flow change graph within a preset time period according to the captured flow; The flow change graph is analyzed according to a preset analysis algorithm, and the analysis result indicates whether the flow fluctuates abnormally; The preset analysis algorithm includes: Smoothing the flow change curve in the flow change diagram; Divide the flow change curve evenly into n unit time period data; ； ； ； By formula ~ Calculate and obtain abnormal traffic characteristic parameters ; in, is the average flow value of the flow change curve; is the flow rate variation over time; It is the preset standard flow curve; , are respectively the left and right endpoints of the preset time period; , are the left and right endpoints of the i-th unit time period; is the duration of the unit period; is the preset scale factor, and .

2. The encryption system for file management security measures according to claim 1, characterized in that: The system further comprises: A communication module, used to establish a communication relationship between the archive storage center and the backup server; The human-computer interaction module includes an information verification unit and a display unit. The information verification unit is used to verify the identity information of the user. The display unit is used to output the encrypted update record and backup record of the corresponding file to the user after the identity information of the user is verified.

3. The encryption system for file management security measures according to claim 2, characterized in that: The encryption module comprises: A storage encryption unit, used for encrypting the archive data in the archive storage center; The transmission encryption unit is used to encrypt the archive information before sending the archive information data from the archive storage center to the backup server during the execution of the archive backup task.

4. The encryption system for file management security measures according to claim 3, characterized in that: The process of monitoring the user's file access records includes: Obtaining original information data from the user's file access record, the original information data including the user's access address, access volume, access interval length, and number of information verifications during access; By formula Calculate the abnormal access characteristic parameters ; in, , , is a preset first weight coefficient; , They are the communication distance between different access addresses corresponding to the change of the access address and the interval between two accesses; The total number of visits within the preset time period; The maximum number of times information verification is triggered during a single visit.

5. The encryption system for file management security measures according to claim 4, characterized in that: The process of establishing file encryption update tasks and file backup tasks includes: By formula Calculate the risk factor of file leakage ; in, , is a preset second weight coefficient; is a preset abnormal traffic characteristic parameter reference value; The preset abnormal access characteristic parameter baseline value; The risk factor of file leakage With preset range For comparison: like , then no archive encryption update task and archive backup task will be generated; like , only the archive encryption update task is generated; like , after the file encryption update task is generated, the encrypted and updated files are backed up off-site through the backup server.

6. An encryption method for file management security measures, characterized in that: The method is executed in an encryption system for archive management security measures according to any one of claims 1 to 5, and the method comprises the following steps: S1. Monitor the network traffic of the archive storage center, import the monitoring data into the trained algorithm model, and output the traffic monitoring results to indicate whether there is any abnormality in the network traffic; S2. Monitor the user's access records, obtain original information data from the user's file access records, parse the original data, and output access monitoring results to indicate whether there is abnormal access; S3, conducting a comprehensive evaluation and analysis on the traffic monitoring results and the access monitoring results, and determining the risk of file leakage based on the comprehensive evaluation and analysis results; S4. Establish file encryption update tasks and file backup tasks according to the risk of file leakage; S5. Execute encryption update tasks and archive backup tasks.

Images