Data encryption storage method and system of integrated system

Abstract

The invention belongs to the technical field of data storage, and discloses a data encryption storage method and system of an integrated system. The method comprises the following steps: carrying out key generation and identity registration based on a trusted mechanism; carrying out encryption and signature based on the integrated system; performing dual encryption; performing abnormal traffic detection based on the cloud storage center; if abnormity exists, disconnecting a network transmission channel, otherwise, receiving data; signature verification and primary decryption are carried out; carrying out integrity verification; performing data classification, and generating transaction data and a data storage request; and consensus is performed on the data storage request, and link uploading is performed on the data block. The problems that in the prior art, data reliability is poor, transmission safety is insufficient, and data integrity is difficult to guarantee are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of data storage, and in particular relates to a data encryption storage method and system for an integrated system. Background Art

[0002] With the continuous development of information technology, integrated systems have been widely used in various fields. However, the security issues of data in integrated systems are becoming increasingly serious, bringing great security risks to users.

[0003] Problems with the integrated system in the prior art include: 1) Poor data reliability: Most of the data in the integrated system is stored locally, which is prone to hardware crashes and data loss; 2) Insufficient transmission security: Existing data storage methods may not be able to effectively prevent data from being intercepted or tampered with by unauthorized third parties during transmission; 3) Data integrity is difficult to ensure: Existing data storage methods may not be able to effectively verify the integrity and authenticity of the data, resulting in the data being tampered with during transmission. Summary of the invention

[0004] In order to solve the problems of poor data reliability, insufficient transmission security and difficulty in ensuring data integrity in the prior art, the present invention aims to provide a data encryption storage method and system for an integrated system.

[0005] The technical solution adopted by the present invention is: A data encryption storage method for an integrated system comprises the following steps: Based on the trusted institution, key generation is performed for the cloud storage center to obtain the first public-private key pair of the cloud storage center, key generation and identity registration are performed for all integrated systems connected to the cloud storage center to obtain the second public-private key pair and signature information of each integrated system; Based on the integrated system, a first hash characteristic value of the system internal data is generated, and the system internal data is encrypted and signed according to the first hash characteristic value, the second private key in the second public-private key pair, and the signature information to obtain the encrypted system internal data and signature data; Generate a second hash characteristic value of the encrypted system internal data, double-encrypt the encrypted system internal data according to the second hash characteristic value and the first public key in the first public-private key pair to obtain the double-encrypted system internal data, and upload the second hash characteristic value, the double-encrypted system internal data and the signature data to the cloud storage center through a network transmission channel; Based on the cloud storage center, the real-time access traffic data of the network transmission channel of the integrated system is collected, and the pre-trained abnormal traffic detection model is used to perform abnormal traffic detection on the real-time access traffic data to obtain real-time abnormal traffic detection results; If the real-time abnormal traffic detection result is abnormal, the network transmission channel of the integrated system is disconnected, the second hash characteristic value, the double-encrypted system internal data and the signature data uploaded by the integrated system are intercepted, and the data encryption storage is ended; otherwise, the second hash characteristic value, the double-encrypted system internal data and the signature data are received, and the next step is entered; Perform signature verification on the signature data. If the signature verification passes, decrypt the double-encrypted system internal data once according to the second hash characteristic value and the first private key in the first public-private key pair to obtain the decrypted system internal data and proceed to the next step. Otherwise, intercept the corresponding double-encrypted system internal data and end the data encryption storage. The IPFS system of the blockchain storage system generates a third hash characteristic value of the system internal data after one decryption, and performs integrity verification with the second hash characteristic value. If the integrity verification passes, the system internal data after one decryption is consistent with the encrypted system internal data in the integrated system, and proceeds to the next step. Otherwise, the corresponding system internal data after one decryption is deleted, and the data encryption storage is terminated; Use the pre-trained data classification model to classify the system internal data after one decryption, obtain the corresponding data classification results, store the system internal data after one decryption in the IPFS system, call the smart contract of the blockchain storage system, generate the corresponding transaction data and data storage request, and publish the transaction data and data storage request to the blockchain network of the blockchain storage system; According to the data classification results, the blockchain network is used to reach a consensus on the data storage request. If the consensus is successful, the main node of the blockchain network is used to package the transaction data into data blocks, link the data blocks to the chain, and end the data encryption storage. Otherwise, a consensus failure signal is returned to the main node, and the data encryption storage is ended.

[0006] Further, based on the trusted institution, a key is generated for the cloud storage center to obtain a first public-private key pair of the cloud storage center, and keys are generated and identities are registered for all integrated systems connected to the cloud storage center to obtain a second public-private key pair and signature information of each integrated system, including the following steps: Based on the trusted institution, key initialization is performed to obtain public parameters, master key and initial key; Collecting first attribute information of the cloud storage center, and using an asymmetric encryption algorithm to generate a key for the cloud storage center according to the first attribute information, public parameters, a master key, and an initial key, to obtain a corresponding first public-private key pair; Publishing the first public key in the first public-private key pair to all integrated systems connected to the cloud storage center, and returning the first private key in the first public-private key pair to the cloud storage center; Collect the second attribute information and entity ID of the integrated system connected to the cloud storage center, and generate a key for the integrated system using an asymmetric encryption algorithm based on the second attribute information, public parameters, a master key, and an initial key to obtain a corresponding second public-private key pair; According to the second public-private key pair and the corresponding entity ID, a digital identity authentication method is used to register the identity and obtain the signature information of the corresponding integrated system; The second private key and signature information in the second public-private key pair are returned to the corresponding integrated system, and the second public key in the second public-private key pair is published to the cloud storage center and other integrated systems.

[0007] Further, based on the integrated system, a first hash characteristic value of the system internal data is generated, and according to the first hash characteristic value, the second private key in the second public-private key pair, and the signature information, the system internal data is encrypted and signed to obtain the encrypted system internal data and signature data, including the following steps: Based on the integrated system, the SHA-3 algorithm is used to generate the first hash characteristic value of the internal data of the system; Concatenate the first hash characteristic value with the second private key in the second public-private key pair to obtain a first hybrid encryption key; According to the first hybrid encryption key, using an asymmetric encryption algorithm, encrypting the system internal data to obtain encrypted system internal data; According to the signature information of the integrated system, the encrypted internal data of the system is signed to obtain the corresponding signature data.

[0008] Further, generating a second hash characteristic value of the encrypted system internal data, doubly encrypting the encrypted system internal data according to the second hash characteristic value and the first public key in the first public-private key pair to obtain doubly encrypted system internal data, and uploading the second hash characteristic value, the doubly encrypted system internal data and the signature data to a cloud storage center through a network transmission channel, including the following steps: Use the SHA-3 algorithm to generate a second hash characteristic value of the encrypted system internal data; Concatenate the second hash characteristic value with the first public key in the first public-private key pair to obtain a second mixed encryption key; According to the second mixed encryption key, using an asymmetric encryption algorithm, double-encrypting the encrypted system internal data to obtain double-encrypted system internal data; The second hash characteristic value, the double-encrypted system internal data and the signature data are uploaded to the cloud storage center through the network transmission channel.

[0009] Furthermore, the abnormal traffic detection model is constructed based on the N-GAN-MLP algorithm.

[0010] Further, the signature data is signature verified. If the signature verification passes, the double-encrypted system internal data is decrypted once according to the second hash characteristic value and the first private key in the first public-private key pair to obtain the decrypted system internal data, and enter the next step; otherwise, the corresponding double-encrypted system internal data is intercepted, and the data encryption storage is ended, including the following steps: The signature data is sent to a trusted institution. Based on the trusted institution, the signature data is verified. If the signature verification is successful, a signature verification success signal is returned to the cloud storage center and the signature verification ends. Otherwise, a signature verification failure signal is returned to the cloud storage center and the signature verification ends. Based on the cloud storage center, if a signature verification pass signal is received, the second hash characteristic value and the first private key in the first public-private key pair are concatenated to obtain a first mixed decryption key, and the next step is entered; otherwise, the corresponding double-encrypted internal system data is intercepted, and the data encryption storage is terminated; According to the first mixed decryption key, the double-encrypted system internal data is decrypted once to obtain the once-decrypted system internal data, and then enter the data distributed storage step.

[0011] Furthermore, the data classification model is built based on the BiLSTM algorithm.

[0012] Further, according to the data classification result, the blockchain network is used to reach a consensus on the data storage request. If the consensus is successful, the main node of the blockchain network is used to package the transaction data into data blocks, link the data blocks to the chain, and end the data encryption storage. Otherwise, a consensus failure signal is returned to the main node, and the data encryption storage is ended, including the following steps: Using a comprehensive hierarchical mechanism, all nodes in the blockchain network are divided into a classification consensus layer, a consensus confirmation layer, and a supervision layer; Taking the data classification type as the clustering target, all consensus nodes in the classification consensus layer are clustered to obtain several consensus node groups consistent with the data classification type; Conduct leader election for all consensus nodes in the consensus node group to obtain the corresponding leader nodes, and form a leader node group based on the leader nodes of all consensus node groups; According to the data classification results, the data storage request and transaction data are sent to the target consensus node group with the same data classification type, and the target leader node in the target consensus node group is used as the master node; Based on the target consensus node group, the PBFT consensus algorithm is used to conduct group consensus on the data storage request. If the consensus is successful, the data storage request is sent to other leader nodes in the leader node group and proceeds to the next step. Otherwise, a consensus failure signal is returned to the master node and the data encryption storage ends. Based on other leader nodes, use the PBFT consensus algorithm to conduct inter-group consensus in the corresponding other consensus node groups. If the consensus is successful, the data storage request is sent to the consensus confirmation layer and proceeds to the next step. Otherwise, a consensus failure signal is returned to the master node and data encryption storage ends; Based on the consensus confirmation layer, the PBFT consensus algorithm is used to conduct secondary consensus among all confirmation nodes in the consensus confirmation layer. If the consensus is successful, the next step is entered. Otherwise, a consensus failure signal is returned to the master node and data encryption storage is terminated. Based on the master node in the target consensus node group, the transaction data is packaged into data blocks, the data blocks are linked to the chain, and the data encrypted storage is completed.

[0013] Furthermore, taking the data classification type as the clustering target, the AP clustering algorithm is used to cluster all consensus nodes in the classification consensus layer to obtain several consensus node groups consistent with the data classification type.

[0014] A data encryption storage system of an integrated system is used to implement a data encryption storage method. The system includes a cloud storage center, a trusted organization and several integrated systems. The cloud storage center and the trusted organization are respectively communicated with the several integrated systems, and the cloud storage center is communicated with the trusted organization.

[0015] The beneficial effects of the present invention are: The present invention discloses a data encryption storage method and system for an integrated system. A cloud storage center is used to encrypt and store the data of the integrated system, thereby avoiding the defects of local storage and improving data reliability. During the data transmission process, an asymmetric encryption algorithm, a double-layer encryption algorithm and a digital identity authentication technology are combined to effectively prevent the data from being intercepted or tampered with by an unauthorized third party during the transmission process, thereby improving the security of data transmission. In the cloud storage center, the data integrity is verified to effectively verify the integrity and authenticity of the data and avoid the possibility of data being tampered with during the transmission process. The decentralization and non-tamperability of blockchain technology are used to improve the reliability of data storage. During the data storage process, it is always performed in an encrypted form, thereby avoiding attacks and intrusions on the cloud storage center, resulting in data leakage and improving data security. An abnormal traffic detection model and a data classification model are combined to improve functionality and practicality, and accelerate the speed and efficiency of data encryption storage and the convenience of query.

[0016] Other beneficial effects of the present invention will be further described in the specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flowchart of the data encryption storage method of the integrated system in the present invention.

[0018] Figure 2 It is a structural block diagram of the data encryption storage system of the integrated system in the present invention. DETAILED DESCRIPTION

[0019] The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments.

[0020] Embodiment 1: like Figure 1 As shown, this embodiment provides a data encryption storage method for an integrated system, comprising the following steps: S1: Based on a trusted institution, a key is generated for the cloud storage center to obtain a first public-private key pair of the cloud storage center, and keys are generated and identities are registered for all integrated systems connected to the cloud storage center to obtain a second public-private key pair and signature information of each integrated system, including the following steps: S1-1: Initialize the key based on the trusted institution to obtain the public parameters, master key and initial key;

[0021] In the formula, is a public parameter; is the master key; is the initial key; Integer domain A random number; Both are target hash functions; Both are cyclic groups The random number of the generator; is a random number Bilinear mapping of ; S1-2: Collect the first attribute information of the cloud storage center , and using an asymmetric encryption algorithm to generate a key for the cloud storage center according to the first attribute information, the public parameter, the master key and the initial key, to obtain a corresponding first public-private key pair;

[0022] In the formula, It is the first private key of the cloud storage center; Integer domain A random number; It is the first private key parameter of the cloud storage center; Public parameters The target hash hash function; Indicates the amount of storage in the cloud; is the master key; is the initial key; It is the first public key of the cloud storage center; Cyclic group The random number of the generator; It is the first attribute information of the cloud storage center; S1-3: publishing the first public key in the first public-private key pair to all integrated systems connected to the cloud storage center, and returning the first private key in the first public-private key pair to the cloud storage center; S1-4: Collect the second attribute information and entity ID of the integrated system connected to the cloud storage center, and , public parameters, master key and initial key, use asymmetric encryption algorithm to generate keys for the integrated system and obtain the corresponding second public-private key pair;

[0023] In the formula, For integrated systems The second private key; Integer domain A random number; For integrated systems The second private key parameter; Public parameters The target hash hash function; Indicator for the integrated system; is the master key; is the initial key; For integrated systems The second public key of Cyclic group The random number of the generator; For integrated systems The second attribute information; S1-5: Using a digital identity authentication method, perform identity registration based on the second public-private key pair and the corresponding entity ID, and obtain signature information of the corresponding integrated system; The formula is:

[0024] In the formula, is a random number; For integrated systems Registration parameters; For integrated systems Registration ID; and the corresponding Signature information ; Hash function for target hash; For integrated systems The entity ID of is a prime number order; It is the base point of the prime domain; To find the remainder function; S1-6: Returning the second private key and signature information in the second public-private key pair to the corresponding integrated system, and publishing the second public key in the second public-private key pair to the cloud storage center and other integrated systems; S2: Based on the integrated system, a first hash characteristic value of the system internal data is generated, and the system internal data is encrypted and signed according to the first hash characteristic value, the second private key in the second public-private key pair, and the signature information to obtain the encrypted system internal data and signature data, including the following steps: S2-1: Based on the integrated system, use the SHA-3 algorithm to generate the first hash feature value of the system internal data; S2-2: Concatenate the first hash characteristic value with the second private key in the second public-private key pair to obtain a first mixed encryption key; S2-3: Encrypt the system internal data using an asymmetric encryption algorithm according to the first mixed encryption key to obtain encrypted system internal data; The formula is:

[0025] In the formula, It is the encrypted internal data of the system; is an asymmetric encryption function; Internal data of the system; For integrated systems The second private key; is the first hash feature value; is a first hybrid encryption key; S2-4: According to the signature information of the integrated system, the encrypted internal system data is signed to obtain the corresponding signature data; The formula is:

[0026] In the formula, is a random number; is a prime number order; It is the base point of the prime domain; Hash function for target hash; Signature information Integrated system Registration parameters; Signature information Integrated system Registration ID; For integrated systems The entity ID of ; Integrated Systems The signature parameters of S3: Generate a second hash characteristic value of the encrypted system internal data, double-encrypt the encrypted system internal data according to the second hash characteristic value and the first public key in the first public-private key pair to obtain double-encrypted system internal data, and upload the second hash characteristic value, the double-encrypted system internal data and the signature data to the cloud storage center through a network transmission channel, including the following steps: S3-1: Use the SHA-3 algorithm to generate the second hash characteristic value of the encrypted system internal data; S3-2: Concatenate the second hash characteristic value with the first public key in the first public-private key pair to obtain a second mixed encryption key; S3-3: Using an asymmetric encryption algorithm according to the second mixed encryption key, double-encrypt the encrypted system internal data to obtain double-encrypted system internal data; The formula is:

[0027] In the formula, The system internal data is double encrypted; is an asymmetric encryption function; It is the encrypted internal data of the system; It is the first public key of the cloud storage center; is the second hash feature value; is a second mixed encryption key; S3-4: Upload the second hash characteristic value, the double-encrypted system internal data and the signature data to the cloud storage center through the network transmission channel; S4: Based on the cloud storage center, collect the real-time access traffic data of the network transmission channel of the integrated system, and use the pre-trained abnormal traffic detection model to perform abnormal traffic detection on the real-time access traffic data to obtain real-time abnormal traffic detection results; The abnormal traffic detection model is built based on the N-Generative Adversarial Network (GAN)-Multilayer Perceptron (MLP) algorithm, where N is the total number of dimensions of interest, and the abnormal traffic detection model includes an N-dimensional feature extraction module built based on the GAN algorithm and an abnormal traffic detection module built based on the MLP algorithm; The dimensions of interest include access frequency, access time, and access behavior; The GAN network includes a generator and a discriminator. The generator is responsible for generating traffic data features from the latent space, and the discriminator is responsible for judging the authenticity of the traffic data features. The discriminator is added with recognition of traffic data, so that it can not only judge the authenticity of traffic data, but also judge whether it conforms to the traffic data features. By extracting the features of traffic data from different dimensions, multi-angle analysis is achieved, which improves the comprehensiveness of abnormal traffic detection. The MLP network fuses the traffic data features from multiple angles, improves the ability of traffic data features to represent data information, and improves the accuracy of abnormal traffic detection. S5: If the real-time abnormal traffic detection result is abnormal, disconnect the network transmission channel of the integrated system, intercept the second hash characteristic value, the double-encrypted system internal data and the signature data uploaded by the integrated system, and end the data encryption storage; otherwise, receive the second hash characteristic value, the double-encrypted system internal data and the signature data, and proceed to the next step; S6: Perform signature verification on the signature data. If the signature verification passes, decrypt the double-encrypted system internal data once according to the second hash characteristic value and the first private key in the first public-private key pair to obtain the decrypted system internal data and proceed to the next step. Otherwise, intercept the corresponding double-encrypted system internal data and end the data encryption storage, including the following steps: S6-1: Send the signature data to the trusted institution, and perform signature verification on the signature data based on the trusted institution. If the signature verification passes, a signature verification pass signal is returned to the cloud storage center, and the signature verification ends. Otherwise, a signature verification failure signal is returned to the cloud storage center, and the signature verification ends. The formula is:

[0028] In the formula, For integrated systems The second public key of ; if the left formula is equal to the right formula, the signature verification is successful; S6-2: Based on the cloud storage center, if a signature verification pass signal is received, the second hash characteristic value and the first private key in the first public-private key pair are concatenated to obtain a first mixed decryption key, and the next step is entered; otherwise, the corresponding double-encrypted internal system data is intercepted, and the data encryption storage is terminated; S6-3: Decrypt the double-encrypted system internal data once according to the first mixed decryption key to obtain the once-decrypted system internal data, and enter the data distributed storage step; The formula is:

[0029] In the formula, It is the internal data of the system after one decryption; is an asymmetric decryption function; The system internal data is double encrypted; It is the first private key of the cloud storage center; is the second hash feature value; is a first mixed decryption key; S7: Use the IPFS system of the blockchain storage system to generate a third hash characteristic value of the system internal data after decryption, and perform integrity verification with the second hash characteristic value. If the integrity verification passes, the system internal data after decryption is Encrypted system internal data in the integrated system Keep consistent and go to the next step, otherwise, delete the corresponding system internal data after one decryption and end the data encryption storage; When only two integrated systems need to share data, the integrated system as the data provider sends the corresponding first hash characteristic value to the integrated system as the data recipient. Based on the integrated system as the data recipient, the first hash characteristic value and the second public key in the second public-private key pair of the integrated system as the data provider are concatenated to obtain a second mixed decryption key. According to the second mixed decryption key, the system internal data after the first decryption is secondary decrypted to obtain the system internal data after the secondary decryption. , the system internal data after secondary decryption and the real system internal data Stay consistent; The formula is:

[0030] In the formula, It is the system internal data after secondary decryption; is an asymmetric decryption function; It is the internal data of the system after one decryption; For integrated systems The second public key of is a second mixed decryption key; is the first hash feature value; S8: Use the pre-trained data classification model to classify the system internal data after one decryption, obtain the corresponding data classification results, store the system internal data after one decryption in the InterPlanetary File System (IPFS), call the smart contract of the blockchain storage system, generate the corresponding transaction data and data storage request, and publish the transaction data and data storage request to the blockchain network of the blockchain storage system; The data classification model is built based on the Bidirectional Long Short-Term Memory (BiLSTM) algorithm; The BiLSTM network uses a deep structure to learn the characteristics of the encrypted system's internal data, explore the potential connection between data characteristics and data classification types, and classify the encrypted system's internal data; S9: Based on the data classification results, the blockchain network is used to reach a consensus on the data storage request. If the consensus is successful, the main node of the blockchain network is used to package the transaction data into data blocks, link the data blocks to the chain, and end the data encryption storage. Otherwise, a consensus failure signal is returned to the main node, and the data encryption storage is ended, including the following steps: S9-1: Use a comprehensive hierarchical mechanism to divide all nodes in the blockchain network into a classification consensus layer, a consensus confirmation layer, and a supervision layer; S9-2: Taking the data classification type as the clustering target, use the Affinity-Propagation (AP) clustering algorithm to cluster all consensus nodes in the classification consensus layer to obtain several consensus node groups consistent with the data classification type; S9-2-1: Use the entropy weight method to obtain the honest behavior weights and malicious behavior weights of all nodes in the classification consensus layer; Construct an evaluation matrix of honest behavior and malicious behavior. The evaluation matrix includes several honest behavior indicators / malicious behavior indicators. Then obtain the information entropy of the evaluation matrix. The formula is:

[0031] In the formula, For the Information entropy of the indicator; It is the indicator quantity; is the indicator quantity of the evaluation matrix column; is the total number of indicators; For the The indicator is in Normalized value of the column; According to the ratio of information entropy to total information entropy, the honest behavior weight of each honest behavior indicator and the malicious behavior weight of each malicious behavior indicator are obtained. The smaller the information entropy, the greater the weight. The formula is:

[0032] In the formula, For the The weight of the indicator; Use the entropy weight method to quantitatively evaluate each node's behavior and determine the corresponding weight in the consensus, so as to formulate reward and punishment measures more objectively, more accurately reward nodes that abide by the rules and participate in good faith, and punish nodes that deliberately violate the rules and disrupt the transaction order; S9-2-2: Obtain the node's reward and penalty values ​​based on the honest behavior weight and malicious behavior weight. Obtain the node's reputation value based on the reward and penalty values ​​using the reputation mechanism scoring strategy, and set the node's reputation value update strategy. The formula is:

[0033] In the formula, For Node i In the number of iterations Reputation value; Indicators of honest behavior The reward base; Indicators of honest behavior The weight of honest behavior; Indicators of honest behavior L Count of; Indicators of malicious behavior The penalty base; Indicators of malicious behavior The weight of malicious behavior; Indicators of malicious behavior Count of; i is the node indicator; is the indicator of the number of iterations; It is an indicator of honest behavior; It is an indicator of malicious behavior;

[0034] In the formula, For Node i In the number of iterations The updated reputation value of is the upper limit of the reputation value; is the slope parameter; For Node i In the number of iterations Reputation value; The honest and malicious behaviors of nodes are associated with the factors of efficient and normal operation of the blockchain. The new reputation value of the node is calculated based on the reward value and the penalty value. When the node performs well, its reputation value will be improved, thereby improving its status and weight in the system, and when the node performs poorly, its reputation value will decrease. S9-2-3: According to the reputation value of the node, several nodes are sorted in descending order to obtain a node sorting set, and bias parameters are set for the first M nodes in the node sorting set. p ( i ); the bias parameter represents the node i The tendency of being selected as the cluster center has an important influence on which class representatives will be used as the final cluster center. p ( i )The larger the value, the smaller the node i The greater the possibility of being the final cluster center, the weaker the impact of the AP clustering algorithm on the initial node; S9-2-4: Use the AP clustering algorithm to initialize and obtain M initial cluster centers, where M is the total number of cluster centers; S9-2-5: Obtain the initial attraction information and initial belonging information of the node to each initial cluster center; The formula for attractiveness information is:

[0035] In the formula, is the number of iterations t +1 hour node k Suitable as a node i The degree of cluster center, that is, the node k For Node i Information about attractiveness; is the number of iterations t Time Node i Select Node j The degree of fitness as its cluster center; is the number of iterations t Time Node j Suitable as a node i The degree of cluster center; For Node k As a node i The similarity of the cluster centers; i , j as well as k All are node indicators; The formula for attribution information is:

[0036] In the formula, is the number of iterations t +1 hour node k The overall suitability for being a cluster center; is the number of iterations t +1 hour node k Suitable for nodes i The degree of other cluster centers; is the number of iterations t +1 hour node i Select Node k As the fitness of its cluster center, that is, the node k For Node i attribution information; S9-2-6: introducing an iterative attenuation coefficient, updating the attraction information and the belonging information of all nodes, and updating the M initial cluster centers according to the updated attraction information and the updated belonging information to obtain M updated cluster centers; The formula is:

[0037]

[0038] In the formula, , is the number of iterations t +1 hour node k For Node i updated attractiveness information and updated belonging information; is the iterative attenuation coefficient; is the number of iterations t , t +1 hour node k For Node i Information about attractiveness; is the number of iterations t , t +1 hour node k For Nodei attribution information; The formula for determining the cluster center is:

[0039] In the formula, i , k are all node indicators; if , then the node i Is a node k The cluster center of , then the node k Is a node i The cluster center of S9-2-7: Obtain the similarity between each node and several updated cluster centers, group all nodes, and obtain several corresponding initial consensus node groups; Update the consensus node group according to the number of nodes in the consensus node group; determine the number of nodes in the consensus node group. When it is greater than the maximum number of nodes that the consensus node group can accommodate, the newly applied node is divided into the smallest consensus node group except the cluster center point; when the number of nodes is less than 4, update the attraction and belongingness values ​​of each point, and repeat this process continuously to make all consensus node groups meet Byzantine fault tolerance; S9-2-8: If the number of iterations exceeds the iteration threshold or the cluster center does not change, output the final consensus node groups; S9-3: Elect leaders for all consensus nodes in the consensus node group to obtain corresponding leader nodes, and form a leader node group based on the leader nodes of all consensus node groups; The cluster center in the consensus node group is used as the corresponding leader node, and the other nodes in the consensus node group are used as consensus nodes; S9-4: according to the data classification result, the data storage request and transaction data are sent to the target consensus node group of the same data classification type, and the target leader node in the target consensus node group is used as the master node; S9-5: Based on the target consensus node group, the Practical Byzantine Fault Tolerance (PBFT) consensus algorithm is used to conduct group consensus on the data storage request. If the consensus succeeds, the data storage request is sent to other leader nodes in the leader node group and the next step is entered. Otherwise, a consensus failure signal is returned to the master node and the data encryption storage ends. S9-6: Based on other leader nodes, use the PBFT consensus algorithm to conduct inter-group consensus in the corresponding other consensus node groups. If the consensus is successful, the data storage request is sent to the consensus confirmation layer and proceeds to the next step. Otherwise, a consensus failure signal is returned to the master node and data encryption storage ends; S9-7: Based on the consensus confirmation layer, use the PBFT consensus algorithm to conduct secondary consensus among all confirmation nodes in the consensus confirmation layer. If the consensus is successful, proceed to the next step. Otherwise, return a consensus failure signal to the master node and end data encryption storage; S9-8: Based on the master node in the target consensus node group, the transaction data is packaged into data blocks, the data blocks are linked to the chain, and the data encryption storage is ended.

[0040] Embodiment 2: like Figure 2 As shown, this embodiment provides a data encryption storage system of an integrated system, which is used to implement a data encryption storage method. The system includes a cloud storage center, a trusted institution, and several integrated systems. The cloud storage center and the trusted institution are respectively connected to the several integrated systems in communication, and the cloud storage center is connected to the trusted institution in communication; The trusted institution is used to generate keys for the cloud storage center, obtain a first public-private key pair for the cloud storage center, generate keys and register identities for all integrated systems connected to the cloud storage center, and obtain a second public-private key pair and signature information for each integrated system; The integrated system includes a cryptographic signature unit and a dual encryption unit connected in sequence; An encryption and signature unit, used to generate a first hash characteristic value of the system internal data, and encrypt and sign the system internal data according to the first hash characteristic value, the second private key in the second public-private key pair, and the signature information, to obtain the encrypted system internal data and signature data; A double encryption unit, used to generate a second hash characteristic value of the encrypted system internal data, double-encrypt the encrypted system internal data according to the second hash characteristic value and the first public key in the first public-private key pair to obtain the double-encrypted system internal data, and upload the second hash characteristic value, the double-encrypted system internal data and the signature data to a cloud storage center through a network transmission channel; The cloud storage center includes an abnormal traffic detection unit, a signature verification unit, an integrity verification unit, a data storage unit, and a link up unit which are connected in sequence; The abnormal traffic detection unit is used to collect the real-time access traffic data of the network transmission channel of the integrated system based on the cloud storage center, and use the pre-trained abnormal traffic detection model to perform abnormal traffic detection on the real-time access traffic data to obtain the real-time abnormal traffic detection result; if the real-time abnormal traffic detection result is that there is an abnormality, the network transmission channel of the integrated system is disconnected, the second hash characteristic value, the double-encrypted system internal data and the signature data uploaded by the integrated system are intercepted, and the data encryption storage is ended; otherwise, the second hash characteristic value, the double-encrypted system internal data and the signature data are received, and the next step is entered; The signature verification unit is used to perform signature verification on the signature data. If the signature verification passes, the double-encrypted system internal data is decrypted once according to the second hash characteristic value and the first private key in the first public-private key pair to obtain the decrypted system internal data and proceed to the next step; otherwise, the corresponding double-encrypted system internal data is intercepted and the data encryption storage is terminated; The integrity verification unit is used for the IPFS system using the blockchain storage system to generate a third hash characteristic value of the system internal data after one decryption, and perform integrity verification with the second hash characteristic value. If the integrity verification passes, the system internal data after one decryption is consistent with the encrypted system internal data in the integrated system, and proceed to the next step; otherwise, the corresponding system internal data after one decryption is deleted, and the data encryption storage is terminated; The data storage unit is used to use a pre-trained data classification model to classify the system internal data after one decryption, obtain the corresponding data classification results, store the system internal data after one decryption in the IPFS system, call the smart contract of the blockchain storage system, generate the corresponding transaction data and data storage request, and publish the transaction data and data storage request to the blockchain network of the blockchain storage system; The linking unit is used to use the blockchain network to reach a consensus on the data storage request based on the data classification results. If the consensus is successful, the main node of the blockchain network is used to package the transaction data into data blocks, link the data blocks to the chain, and end the data encryption storage. Otherwise, a consensus failure signal is returned to the main node, and the data encryption storage is ended.

[0041] The present invention discloses a data encryption storage method and system for an integrated system. A cloud storage center is used to encrypt and store the data of the integrated system, thereby avoiding the defects of local storage and improving data reliability. During the data transmission process, an asymmetric encryption algorithm, a double-layer encryption algorithm and a digital identity authentication technology are combined to effectively prevent the data from being intercepted or tampered with by an unauthorized third party during the transmission process, thereby improving the security of data transmission. In the cloud storage center, the data integrity is verified to effectively verify the integrity and authenticity of the data and avoid the possibility of data being tampered with during the transmission process. The decentralization and non-tamperability of blockchain technology are used to improve the reliability of data storage. During the data storage process, it is always performed in an encrypted form, thereby avoiding attacks and intrusions on the cloud storage center, resulting in data leakage and improving data security. An abnormal traffic detection model and a data classification model are combined to improve functionality and practicality, and accelerate the speed and efficiency of data encryption storage and the convenience of query.

[0042] The present invention is not limited to the above optional implementations, and anyone can derive other various forms of products under the enlightenment of the present invention. The above specific implementations should not be understood as limiting the scope of protection of the present invention. The scope of protection of the present invention should be based on the definition in the claims, and the description can be used to interpret the claims.

Claims

1. A data encryption storage method for an integrated system, characterized in that: The steps include: Based on the trusted institution, key generation is performed for the cloud storage center to obtain the first public-private key pair of the cloud storage center, key generation and identity registration are performed for all integrated systems connected to the cloud storage center to obtain the second public-private key pair and signature information of each integrated system; Based on the integrated system, a first hash characteristic value of the system internal data is generated, and the system internal data is encrypted and signed according to the first hash characteristic value, the second private key in the second public-private key pair, and the signature information to obtain the encrypted system internal data and signature data; Generate a second hash characteristic value of the encrypted system internal data, double-encrypt the encrypted system internal data according to the second hash characteristic value and the first public key in the first public-private key pair to obtain the double-encrypted system internal data, and upload the second hash characteristic value, the double-encrypted system internal data and the signature data to the cloud storage center through a network transmission channel; Based on the cloud storage center, the real-time access traffic data of the network transmission channel of the integrated system is collected, and the pre-trained abnormal traffic detection model is used to perform abnormal traffic detection on the real-time access traffic data to obtain real-time abnormal traffic detection results; If the real-time abnormal traffic detection result is abnormal, the network transmission channel of the integrated system is disconnected, the second hash characteristic value, the double-encrypted system internal data and the signature data uploaded by the integrated system are intercepted, and the data encryption storage is ended; otherwise, the second hash characteristic value, the double-encrypted system internal data and the signature data are received, and the next step is entered; Perform signature verification on the signature data. If the signature verification passes, decrypt the double-encrypted system internal data once according to the second hash characteristic value and the first private key in the first public-private key pair to obtain the decrypted system internal data and proceed to the next step. Otherwise, intercept the corresponding double-encrypted system internal data and end the data encryption storage. The IPFS system of the blockchain storage system generates a third hash characteristic value of the system internal data after one decryption, and performs integrity verification with the second hash characteristic value. If the integrity verification passes, the system internal data after one decryption is consistent with the encrypted system internal data in the integrated system, and proceeds to the next step. Otherwise, the corresponding system internal data after one decryption is deleted, and the data encryption storage is terminated; Use the pre-trained data classification model to classify the system internal data after one decryption, obtain the corresponding data classification results, store the system internal data after one decryption in the IPFS system, call the smart contract of the blockchain storage system, generate the corresponding transaction data and data storage request, and publish the transaction data and data storage request to the blockchain network of the blockchain storage system; According to the data classification results, the blockchain network is used to reach a consensus on the data storage request. If the consensus is successful, the main node of the blockchain network is used to package the transaction data into data blocks, link the data blocks to the chain, and end the data encryption storage. Otherwise, a consensus failure signal is returned to the main node, and the data encryption storage is ended.

2. The data encryption storage method of an integrated system according to claim 1, characterized in that: Based on the trusted institution, a key is generated for the cloud storage center to obtain a first public-private key pair of the cloud storage center, and keys are generated and identities are registered for all integrated systems connected to the cloud storage center to obtain a second public-private key pair and signature information of each integrated system, including the following steps: Based on a trusted institution, key initialization is performed to obtain public parameters, master keys and initial keys; Collecting first attribute information of the cloud storage center, and using an asymmetric encryption algorithm to generate a key for the cloud storage center according to the first attribute information, public parameters, a master key, and an initial key, to obtain a corresponding first public-private key pair; Publishing the first public key in the first public-private key pair to all integrated systems connected to the cloud storage center, and returning the first private key in the first public-private key pair to the cloud storage center; Collect the second attribute information and entity ID of the integrated system connected to the cloud storage center, and generate a key for the integrated system using an asymmetric encryption algorithm based on the second attribute information, public parameters, a master key, and an initial key to obtain a corresponding second public-private key pair; According to the second public-private key pair and the corresponding entity ID, a digital identity authentication method is used to register the identity and obtain the signature information of the corresponding integrated system; The second private key and signature information in the second public-private key pair are returned to the corresponding integrated system, and the second public key in the second public-private key pair is published to the cloud storage center and other integrated systems.

3. The data encryption storage method of an integrated system according to claim 1, characterized in that: Based on the integrated system, a first hash characteristic value of the system internal data is generated, and according to the first hash characteristic value, the second private key in the second public-private key pair, and the signature information, the system internal data is encrypted and signed to obtain the encrypted system internal data and signature data, including the following steps: Based on the integrated system, the SHA-3 algorithm is used to generate the first hash characteristic value of the internal data of the system; Concatenate the first hash characteristic value with the second private key in the second public-private key pair to obtain a first hybrid encryption key; According to the first hybrid encryption key, using an asymmetric encryption algorithm, encrypting the system internal data to obtain encrypted system internal data; According to the signature information of the integrated system, the encrypted internal data of the system is signed to obtain the corresponding signature data.

4. The data encryption storage method of an integrated system according to claim 1, characterized in that: Generate a second hash characteristic value of the encrypted system internal data, double-encrypt the encrypted system internal data according to the second hash characteristic value and the first public key in the first public-private key pair to obtain the double-encrypted system internal data, and upload the second hash characteristic value, the double-encrypted system internal data and the signature data to the cloud storage center through a network transmission channel, including the following steps: Use the SHA-3 algorithm to generate a second hash characteristic value of the encrypted system internal data; Concatenate the second hash characteristic value with the first public key in the first public-private key pair to obtain a second mixed encryption key; According to the second mixed encryption key, using an asymmetric encryption algorithm, double-encrypting the encrypted system internal data to obtain double-encrypted system internal data; The second hash characteristic value, the double-encrypted system internal data and the signature data are uploaded to the cloud storage center through the network transmission channel.

5. The data encryption storage method of an integrated system according to claim 1, characterized in that: The abnormal traffic detection model is constructed based on the N-GAN-MLP algorithm.

6. The data encryption storage method of an integrated system according to claim 1, characterized in that: Perform signature verification on the signature data. If the signature verification passes, decrypt the double-encrypted system internal data once according to the second hash characteristic value and the first private key in the first public-private key pair to obtain the decrypted system internal data and proceed to the next step. Otherwise, intercept the corresponding double-encrypted system internal data and end the data encryption storage, including the following steps: The signature data is sent to a trusted institution. Based on the trusted institution, the signature data is verified. If the signature verification is successful, a signature verification success signal is returned to the cloud storage center and the signature verification ends. Otherwise, a signature verification failure signal is returned to the cloud storage center and the signature verification ends. Based on the cloud storage center, if a signature verification pass signal is received, the second hash characteristic value and the first private key in the first public-private key pair are concatenated to obtain a first mixed decryption key, and the next step is entered; otherwise, the corresponding double-encrypted internal system data is intercepted, and the data encryption storage is terminated; According to the first mixed decryption key, the double-encrypted system internal data is decrypted once to obtain the once-decrypted system internal data, and then enter the data distributed storage step.

7. The data encryption storage method of an integrated system according to claim 1, characterized in that: The data classification model is built based on the BiLSTM algorithm.

8. The data encryption storage method of an integrated system according to claim 1, characterized in that: According to the data classification results, the blockchain network is used to reach a consensus on the data storage request. If the consensus is successful, the main node of the blockchain network is used to package the transaction data into data blocks, link the data blocks to the chain, and end the data encryption storage. Otherwise, a consensus failure signal is returned to the main node, and the data encryption storage is ended, including the following steps: Using a comprehensive hierarchical mechanism, all nodes in the blockchain network are divided into a classification consensus layer, a consensus confirmation layer, and a supervision layer; Taking the data classification type as the clustering target, all consensus nodes in the classification consensus layer are clustered to obtain several consensus node groups consistent with the data classification type; Conduct leader election for all consensus nodes in the consensus node group to obtain the corresponding leader nodes, and form a leader node group based on the leader nodes of all consensus node groups; According to the data classification results, the data storage request and transaction data are sent to the target consensus node group with the same data classification type, and the target leader node in the target consensus node group is used as the master node; Based on the target consensus node group, the PBFT consensus algorithm is used to conduct group consensus on the data storage request. If the consensus is successful, the data storage request is sent to other leader nodes in the leader node group and proceeds to the next step. Otherwise, a consensus failure signal is returned to the master node and the data encryption storage ends. Based on other leader nodes, use the PBFT consensus algorithm to conduct inter-group consensus in the corresponding other consensus node groups. If the consensus is successful, the data storage request is sent to the consensus confirmation layer and proceeds to the next step. Otherwise, a consensus failure signal is returned to the master node and data encryption storage ends; Based on the consensus confirmation layer, the PBFT consensus algorithm is used to conduct secondary consensus among all confirmation nodes in the consensus confirmation layer. If the consensus is successful, the next step is entered. Otherwise, a consensus failure signal is returned to the master node and data encryption storage is terminated. Based on the master node in the target consensus node group, the transaction data is packaged into data blocks, the data blocks are linked to the chain, and the data encrypted storage is completed.

9. The data encryption storage method of an integrated system according to claim 8, characterized in that: Taking the data classification type as the clustering target, the AP clustering algorithm is used to cluster all consensus nodes in the classification consensus layer to obtain several consensus node groups consistent with the data classification type.

10. A data encryption storage system of an integrated system, used to implement the data encryption storage method according to any one of claims 1 to 9, characterized in that: The system includes a cloud storage center, a trusted organization and several integrated systems. The cloud storage center and the trusted organization are respectively connected to the several integrated systems in communication, and the cloud storage center is connected to the trusted organization in communication.

Images