Data security storage and access system

Abstract

The invention belongs to the technical field of network data security, and particularly discloses a data security storage and access system, which comprises a storage device, an IP address and MAC address storage device, a management device and an access device, and is characterized in that the IP address and MAC address storage device is used for storing an IP address and an MAC address of an allowed access device and providing a random key for the management device; the management equipment is used for comparing the IP address and the MAC address of the access equipment, providing a secret key for the access equipment, and also used for virus processing; the storage device is used for identifying viruses before data storage, encrypting and storing non-toxic data, and providing a decryption file for the access device; the access device needs to submit an access application to the management device before access, and obtains a secret key from the management device; and after the management equipment confirms the secret key, the management equipment submits the secret key to the IP address and MAC address storage equipment, exchanges internal data, compares the internal data with the access equipment, denies access if the comparison fails, and permits access if the comparison fails.

Description

Technical Field

[0001] The present invention relates to the technical field of network data security, and in particular to a data security storage and access system. Background Art

[0002] In computer science, data is the general term for all media that can be input into a computer and processed by a computer program. It is a general term for numbers, letters, symbols, and analog quantities that have a certain meaning and are used to be input into an electronic computer for processing. Computers store and process a wide range of objects, and the data representing these objects has become increasingly complex. Among them, network security is the most important aspect, which can help city managers better protect the city's information security and prevent problems such as hacker attacks and data leaks.

[0003] With the rapid advancement of Internet technology, network infrastructure and related projects are also expanding and deepening. Among them, the "Safe City" project is a key component in the urbanization process. However, the resulting data security issues are becoming increasingly prominent. Data storage and management have become particularly important. Due to the huge amount of information, it is inevitable that some data with viruses or malware will be stored in the system. Once these unsafe data are stored, they may threaten the security and stability of the entire data system, and may even cause the loss or damage of important information. In addition, data access is also an important security link. Data access needs to be strictly managed to prevent unauthorized access or data leakage. Improper data access may not only lead to data leakage, but also affect the operational security of the entire system.

[0004] In short, data security products play a vital role in safe cities. With the continuous development of technology, data security products will be applied and promoted in more fields, providing more comprehensive security protection for safe cities. Summary of the invention

[0005] The object of the present invention is to provide a data security storage and access system to solve the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions: a data security storage and access system, comprising a storage device, an IP address and MAC address storage device, a management device and an access device;

[0007] The IP address and MAC address storage device is used to store the IP address and MAC address of the device that is allowed to access, and provide the management device with an IP address database, MAC address data and a random key;

[0008] The management device is used to compare the IP and MAC address database with the IP and MAC address of the access device, and provide a key to the device submitting the access application, and is also used for virus processing;

[0009] The storage device needs to perform virus identification before storing new data. After the data is identified as virus-free, the data is encrypted. Then the new data can be stored in the storage device, and the decrypted file is provided to the device that has passed the access application;

[0010] The access device needs to submit an access application to the management device before accessing the storage device and obtain a key from the management device. The key generation algorithm adopts the RSA algorithm, which is an asymmetric algorithm. Unlike the symmetric encryption algorithm, the RSA algorithm has two different keys, one is a public key and the other is a private key.

[0011] Preferably, after confirming that the key is correct, the management device needs to submit the key to the IP address and MAC address storage device. After confirming that the key is correct, the management device will exchange internal data with the management device. The management device extracts the IP address and MAC address database from the IP address and MAC address storage device and compares it with the IP address and MAC address of the access device. If the comparison fails, access is denied. If the comparison is successful, the storage device can be accessed. The management device performs dual authentication of the IP address and MAC address of the access device to ensure that unauthorized devices access the storage device.

[0012] At the same time, the management device is equipped with intrusion detection, which monitors the network data flow in real time, identifies and records intrusions and destructive code flows, and looks for network violation patterns and unauthorized network access attempts. It provides boundary protection for the data access link of the boundary interaction platform and performs access control on data packets to ensure that the access device can legally and effectively access the resources in the storage device, and ensure that the host address in the boundary interaction platform cannot be obtained by external terminals. It realizes the intrusion detection function, ensures data security, and realizes secure network isolation from the social resource access network.

[0013] Preferably, the connection between the management device and the IP address and MAC address storage device is a unique binding relationship to prevent others from accessing the IP address and MAC address storage device using other devices, and the IP address and MAC address database stored in the IP address and MAC address storage device needs to enter the IP and MAC addresses of the authorized access devices in advance to facilitate comparison of the IP and MAC addresses of the access devices.

[0014] Preferably, the virus identification includes firewalls, intrusion detection, vulnerability scanning, etc., and is updated in real time to prevent new viruses from being unidentified, so as to ensure the stability and reliability of the customer's network security.

[0015] Preferably, the secret key is randomly generated by the management device and sent to the access device to prevent the secret key from being known by others.

[0016] Preferably, the secret key submitted by the management device when accessing the IP address and MAC address storage device is randomly generated by the IP address and MAC address storage device and sent to the management device to prevent others from using other devices to access the IP address and MAC address storage device.

[0017] Preferably, the management device needs to perform fingerprint authentication, face recognition, and password login before use to ensure that the management device is not used by others.

[0018] Preferably, the data is encrypted by the storage device. The encryption methods include symmetric encryption, asymmetric encryption, hash algorithm, etc. to ensure the security of the data during transmission and storage. After the access device passes the verification, the data is also decrypted by the storage device for the access device to read.

[0019] Preferably, the management device is configured with intrusion detection. By real-time monitoring of network data streams, it can identify, record intrusion and destructive code streams, and find network violation patterns and unauthorized network access attempts.

[0020] Preferably, the specific algorithm description of the RSA algorithm is as follows:

[0021] (1) Arbitrarily select two different large prime numbers p and q and calculate their product;

[0022] n = pq, ψ(n) = (p - 1)(q - 1)

[0023] (2) Arbitrarily select a large integer e such that gcd(e, ψ(n)) = 1. The integer e is used as the encryption key (note: the selection of e is very easy. For example, all prime numbers greater than p and q can be used;

[0024] (3) Determine the decryption key d such that (de) mod ψ(n) = 1, that is, de = kψ(n) + 1, where k ≥ 1 is an arbitrary integer; therefore, if e and ψ(n) are known, it is very easy to calculate d;

[0025] (4) Publicize the integers n and e, and secretly store d;

[0026] (5) Encrypt the plaintext m (m < n is an integer) into the ciphertext c. The encryption algorithm is

[0027] c = E(m) = m e mod n

[0028] (6) Decrypt the ciphertext c into the plaintext m. The decryption algorithm is

[0029] m=D(c)=c d modn

[0030] However, it is impossible to calculate d based only on n and e (note: not p and q). Therefore, anyone can encrypt the plaintext, but only the authorized user (who knows d) can decrypt the ciphertext.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] The present invention achieves the purpose of secure data storage and access through IP address and MAC address storage devices, virus identification and data encryption, encrypts the data, and effectively prevents unauthorized access by setting complex passwords or using advanced encryption algorithms. Secondly, regularly update and maintain the timely upgrade of anti-virus software to combat new network threats and malware attacks. Through the comprehensive application of the above measures, the risk of illegal data acquisition can be greatly reduced, and the security of data can be guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] See also Figure 1 ,The present invention provides a technical solution: a data security storage and access system, including a storage device, an IP address and MAC address storage device, a management device and an access device;

[0036] The IP address and MAC address storage device is used to store the IP address and MAC address of the device that is allowed to access, and provide the management device with an IP address database, MAC address data and a random key;

[0037] The management device is used to compare the IP and MAC address database with the IP and MAC address of the access device, and provide a key to the device submitting the access application, and is also used for virus processing;

[0038] The storage device needs to perform virus identification before storing new data. After the data is identified as virus-free, the data is encrypted. Then the new data can be stored in the storage device, and the decrypted file is provided to the device that has passed the access application;

[0039] The access device needs to submit an access application to the management device before accessing the storage device and obtain a key from the management device. The key generation algorithm adopts the RSA algorithm, which is an asymmetric algorithm. Unlike the symmetric encryption algorithm, the RSA algorithm has two different keys, one is a public key and the other is a private key.

[0040] Furthermore, after confirming that the key is correct, the management device needs to submit the key to the IP address and MAC address storage device. After confirming that the key is correct, it will exchange internal data with the management device. The management device extracts the IP address and MAC address database from the IP address and MAC address storage device and compares it with the IP address and MAC address of the access device. If the comparison fails, access is denied. If the comparison is successful, the storage device can be accessed. The management device performs dual authentication of the IP address and MAC address of the access device to ensure that unauthorized devices access the storage device.

[0041] At the same time, the management device is equipped with intrusion detection, which monitors the network data flow in real time, identifies and records intrusions and destructive code flows, and looks for network violation patterns and unauthorized network access attempts. It provides boundary protection for the data access link of the boundary interaction platform and performs access control on data packets to ensure that the access device can legally and effectively access the resources in the storage device, and ensure that the host address in the boundary interaction platform is not obtained by external terminals. It realizes the intrusion detection function, ensures data security, and realizes secure network isolation from the social resource access network.

[0042] Furthermore, the connection between the management device and the IP address and MAC address storage device is a unique binding relationship to prevent others from accessing the IP address and MAC address storage device using other devices, and the IP address and MAC address database stored in the IP address and MAC address storage device needs to enter the IP and MAC addresses of the authorized access devices in advance to facilitate comparison of the IP and MAC addresses of the access devices.

[0043] Furthermore, the virus identification includes firewalls, intrusion detection, vulnerability scanning, etc., and is updated in real time to prevent new viruses from being unidentified, so as to ensure the stability and reliability of customers' network security.

[0044] Furthermore, the key is randomly generated by the management device and sent to the access device to prevent the key from being known by others.

[0045] Furthermore, the key submitted by the management device when accessing the IP address and MAC address storage device is randomly generated by the IP address and MAC address storage device and sent to the management device, thereby preventing others from accessing the IP address and MAC address storage device using other devices.

[0046] Furthermore, the data is encrypted by the storage device, and the encryption methods include symmetric encryption, asymmetric encryption, hash algorithms, etc., to ensure the security of data during transmission and storage. After passing the verification, the access device is also decrypted by the storage device for the access device to read.

[0047] Furthermore, before using the management device, fingerprint authentication, face recognition, and password login are required to use the management device, and multiple authentications are used to ensure that the management device is not used by others.

[0048] Furthermore, the management device is configured with intrusion detection. By listening to network data streams in real time, it identifies and records intrusion and destructive code streams, and searches for network violation patterns and unauthorized network access attempts.

[0049] Furthermore, the specific algorithm description of the RSA algorithm is as follows:

[0050] (2) Arbitrarily select two different large prime numbers p and q and calculate their product;

[0051] n = pq, ψ(n) = (p - 1)(q - 1)

[0052] (2) Arbitrarily select a large integer e such that gcd(e, ψ(n)) = 1. The integer e is used as the encryption key (Note: The selection of e is very easy. For example, all prime numbers greater than p and q can be used;

[0053] (3) Determine the decryption key d such that (de) mod ψ(n) = 1, that is, de = kψ(n) + 1, where k ≥ 1 is an arbitrary integer; therefore, if e and ψ(n) are known, it is very easy to calculate d;

[0054] (4) Make the integers n and e public and keep d secret;

[0055] (5) Encrypt the plaintext m (m < n is an integer) into the ciphertext c, and the encryption algorithm is

[0056] c = E(m) = m e mod n

[0057] (6) Decrypt the ciphertext c into the plaintext m, and the decryption algorithm is

[0058] m = D(c) = c d mod n

[0059] However, it is impossible to calculate d only based on n and e (Note: not p and q). Therefore, anyone can encrypt the plaintext, but only authorized users (who know d) can decrypt the ciphertext.

[0060] To summarize, this system needs to perform virus identification before storing new data, including multiple protections such as firewalls, intrusion detection, and vulnerability scanning, which minimizes virus intrusion. If the data contains implanted viruses, it will be reported to the management device for processing by the administrator. If there is no virus, the data will be encrypted. The encryption methods include symmetric encryption, asymmetric encryption, hash algorithms, etc. After encryption, it will be stored in the storage device waiting to be read.

[0061] Before reading, the access device needs to submit an application to the management device, and then the management device will send the generated random key to the access device. When the access device enters the random key, the management device submits an access application to the IP address and MAC address storage device, and the IP address and MAC address storage device sends the random key to the management device. After the administrator enters the random key, the IP address and MAC address storage device sends the IP address database to the management device. The management device reads the IP address of the access device and compares it with the IP address database. If the comparison fails, access is denied. If the comparison succeeds, the IP address and MAC address storage device continues to send the MAC address database to the management device. The management device performs a MAC address comparison. If the comparison fails, access is denied. If the comparison succeeds, access to the storage device is allowed. Fine-grained control is performed on access devices to ensure that only authorized users can access data. In addition, for data backup and recovery, we provide a variety of data backup and recovery technologies to ensure that the data of storage devices can be protected and restored in a timely and effective manner under various circumstances.

[0062] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A data security storage and access system, characterized in that: Including storage devices, IP address and MAC address storage devices, management devices and access devices; The IP address and MAC address storage device is used to store the IP address and MAC address of the device that is allowed to access, and provide the management device with an IP address database, MAC address data and a random key; The management device is used to compare the IP and MAC address database with the IP and MAC address of the access device, and provide a key to the device submitting the access application, and is also used for virus processing; The storage device needs to perform virus identification before storing new data. After the data is identified as virus-free, the data is encrypted. Then the new data can be stored in the storage device, and the decrypted file is provided to the device that has passed the access application; The access device needs to submit an access application to the management device before accessing the storage device, and obtain a key from the management device.

2. A data security storage and access system according to claim 1, characterized in that: After confirming that the key is correct, the management device needs to submit the key to the IP address and MAC address storage device. After confirming that the key is correct, it will exchange internal data with the management device. The management device extracts the IP address and MAC address database from the IP address and MAC address storage device and compares it with the IP address and MAC address of the access device. If the comparison fails, access is denied. If the comparison is successful, the storage device can be accessed. At the same time, the management device is configured with intrusion detection, which monitors network data flows in real time, identifies and records intrusions and destructive code flows, performs boundary protection on the data access link of the boundary interaction platform, and performs access control on data packets.

3. A data security storage and access system according to claim 1, characterized in that: The management device is connected to the IP address and MAC address storage device as a unique binding relationship, and the IP address and MAC address database stored in the IP address and MAC address storage device needs to enter the IP and MAC addresses of the authorized access devices in advance.

4. A data security storage and access system according to claim 1, characterized in that: The virus identification includes firewall, intrusion detection, vulnerability scanning, etc., and is updated in real time.

5. A data security storage and access system according to claim 1, characterized in that: The key is randomly generated by the management device and sent to the access device.

6. A data security storage and access system according to claim 1, characterized in that: The key submitted by the management device when accessing the IP address and MAC address storage device is randomly generated by the IP address and MAC address storage device and sent to the management device.

7. A data security storage and access system according to claim 1, characterized in that: Before using the management device, fingerprint authentication, face recognition and password login are required.

8. A data security storage and access system according to claim 1, characterized in that: The data encryption is performed by the storage device, and the encryption method includes symmetric encryption, asymmetric encryption, hash algorithm, etc. After the access device passes the verification, it is also decrypted by the storage device and read by the access device.

9. A data security storage and access system according to claim 1, characterized in that: The management device is configured with intrusion detection, which identifies and records intrusions and destructive code flows by monitoring network data flows in real time.

10. A data security storage and access system according to claim 1, characterized in that: The specific algorithm of the RSA algorithm is described as follows: (1) Arbitrarily select two different large prime numbers p and q to calculate the product; n=pq,ψ(n)=(p-1)(q-1) (2) Choose any large integer e that satisfies gcd(e,ψ(n))=1, and use the integer e as the encryption key (Note: the selection of e is easy, for example, all prime numbers greater than p and q can be used; (3) The determined solution key d satisfies (de) mod ψ(n) = 1, that is, de = kψ(n) + 1, where k ≥ 1 is an arbitrary integer; therefore, if e and ψ(n) are known, it is easy to calculate d; (4) Publicize the integers n and e, and keep d secret; (5) Encrypt the plaintext m (m < n is an integer) into the ciphertext c, and the encryption algorithm is c=E(m)=m e modern (6) Decrypt the ciphertext c into the plaintext m, and the decryption algorithm is m=D(c)=c d modn However, it is impossible to calculate d only based on n and e (note: not p and q). Therefore, anyone can encrypt the plaintext, but only authorized users (who know d) can decrypt the ciphertext.

Images