A data security storage and access system

Abstract

The present invention belongs to the technical field of network data security, and specifically discloses a data security storage and access system, comprising a storage device, an IP address and MAC address storage device, a management device and an access device, wherein the IP address and MAC address storage device is used to store the IP address and MAC address of the device allowed to access, and provide a random key for the management device; the management device is used to compare the IP and MAC addresses of the access device, provide a key for the access device, and also be used for virus processing; the storage device is used to identify viruses before data is stored, encrypt and store virus-free data, and provide a decrypted file for the access device; the access device needs to submit an access application to the management device before access, and obtain a key from the management device; after confirming the key, the management device submits the key to the IP address and MAC address storage device, exchanges internal data, and compares it with the access device. If the comparison fails, access is denied, otherwise access is allowed.

Description

Technical Field

[0001] The present invention relates to the technical field of network data security, and in particular to a data security storage and access system. Background Art

[0002] In computer science, data is the general term for all symbolic media that can be input into a computer and processed by a computer program. It refers to numbers, letters, symbols, and analog quantities that have a specific meaning and are used to be input into an electronic computer for processing. Computers store and process a wide range of objects, and the data representing these objects has become increasingly complex. Cybersecurity is a crucial aspect of this, helping city managers better protect city information security and prevent hacker attacks and data leaks.

[0003] With the rapid advancement of internet technology, network infrastructure and related projects are continuously expanding and deepening. The "Safe City" project is a key component of urbanization. However, data security issues are becoming increasingly prominent. Data storage and management have become particularly important. Due to the vast amount of information, it is inevitable that some data containing viruses or malware will be stored in the system. Once stored, this unsafe data can threaten the security and stability of the entire data system and even lead to the loss or corruption of important information. Data access is also a critical security factor. Data access must be strictly managed to prevent unauthorized access and data leakage. Improper data access may not only lead to data leakage but also affect the operational security of the entire system.

[0004] In short, data security products play a vital role in safe cities. With the continuous development of technology, data security products will be applied and promoted in more fields, providing more comprehensive security protection for safe cities. Summary of the Invention

[0005] The object of the present invention is to provide a data security storage and access system to solve the problems raised in the above background technology.

[0006] To achieve the above-mentioned object, the present invention provides the following technical solutions: a data security storage and access system, comprising a storage device, an IP address and MAC address storage device, a management device, and an access device;

[0007] The IP address and MAC address storage device is used to store the IP addresses and MAC addresses of the devices that are allowed to access, and provide the management device with an IP address database, MAC address data and random keys;

[0008] The management device is used to compare the IP and MAC address database with the IP and MAC addresses of the access device, and provide a key to the device that submits the access application, and is also used for virus processing;

[0009] The storage device needs to perform virus detection before storing new data. Once the data is virus-free, it will encrypt the data. The new data can then be stored in the storage device, and the decrypted file will be provided to the device that has passed the access application.

[0010] Before accessing the storage device, the access device needs to submit an access request to the management device and obtain a key from the management device. The key generation algorithm adopts an asymmetric algorithm, such as the RSA algorithm. Unlike the symmetric encryption algorithm, the RSA algorithm has two different keys, one is a public key and the other is a private key.

[0011] Preferably, after confirming that the key is correct, the management device needs to submit the key to the IP address and MAC address storage device. After confirming that the key is correct, the management device will exchange internal data with the management device. The management device extracts the IP address and MAC address database from the IP address and MAC address storage device and compares it with the IP address and MAC address of the access device. If the comparison fails, access is denied. If the comparison is successful, the storage device can be accessed. The management device performs dual authentication of the IP address and MAC address of the access device to ensure that unauthorized devices access the storage device.

[0012] The management device is also equipped with intrusion detection. By monitoring network data flows in real time, it identifies and records intrusions and destructive code flows, identifying patterns of network violations and unauthorized network access attempts. This provides boundary protection for the data access link of the boundary interaction platform and implements access control for data packets, ensuring that access devices can legally and effectively access resources within the storage device. This ensures that host addresses within the boundary interaction platform cannot be obtained by external terminals. This intrusion detection function ensures data security and achieves secure network isolation from public resource access networks.

[0013] Preferably, the connection between the management device and the IP address and MAC address storage device is a unique binding relationship to prevent others from using other devices to access the IP address and MAC address storage device, and the IP address and MAC address database stored in the IP address and MAC address storage device needs to enter the IP and MAC addresses of the authorized access devices in advance to facilitate comparison of the IP and MAC addresses of the access devices.

[0014] Preferably, the virus identification includes firewalls, intrusion detection, vulnerability scanning, etc., and is updated in real time to prevent new viruses from being unidentified, so as to ensure the stability and reliability of the customer's network security.

[0015] Preferably, the secret key is randomly generated by the management device and sent to the access device to prevent the secret key from being known by others.

[0016] Preferably, the secret key submitted by the management device when accessing the IP address and MAC address storage device is randomly generated by the IP address and MAC address storage device and sent to the management device to prevent others from using other devices to access the IP address and MAC address storage device.

[0017] Preferably, the management device needs to perform fingerprint authentication, face recognition, and password login before use to ensure that the management device is not used by others.

[0018] Preferably, the data is encrypted by the storage device. The encryption methods include symmetric encryption, asymmetric encryption, hash algorithm, etc. to ensure the security of the data during transmission and storage. After the access device passes the verification, the data is also decrypted by the storage device for the access device to read.

[0019] Preferably, the management device is configured with intrusion detection. By monitoring network data streams in real time, it identifies and records intrusion and destructive code streams, and searches for network violation patterns and unauthorized network access attempts.

[0020] Preferably, the specific algorithm description of the RSA algorithm is as follows:

[0021] (1) Randomly select two different large prime numbers p and q and calculate their product;

[0022] n = pq, ψ(n) = (p - 1)(q - 1)

[0023] (2) Randomly select a large integer e such that gcd(e, ψ(n)) = 1. The integer e is used as the encryption key (Note: The selection of e is very easy. For example, all prime numbers greater than p and q can be used;

[0024] (3) Determine the decryption key d such that (de) mod ψ(n) = 1, that is, de = kψ(n) + 1, where k ≥ 1 is an arbitrary integer; Therefore, if e and ψ(n) are known, it is very easy to calculate d;

[0025] (4) Publicize the integers n and e, and keep d secret;

[0026] (5) Encrypt the plaintext m (m < n is an integer) into the ciphertext c. The encryption algorithm is

[0027] c = E(m) = m e mod n

[0028] (6) Decrypt the ciphertext c into the plaintext m. The decryption algorithm is

[0029] m=D(c)=c d modn

[0030] However, it is impossible to calculate d based only on n and e (note: not p and q). Therefore, anyone can encrypt the plaintext, but only the authorized user (who knows d) can decrypt the ciphertext.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] This invention achieves secure data storage and access through IP and MAC address storage, virus detection, and data encryption. Data encryption, along with complex passwords and advanced encryption algorithms, effectively prevents unauthorized access. Furthermore, regular updates and maintenance of antivirus software ensure timely upgrades to combat emerging network threats and malware attacks. The combined application of these measures significantly reduces the risk of illegal data acquisition and ensures data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 Schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0034] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0035] See also Figure 1 ,The present invention provides a technical solution: a data security storage and access system, including a storage device, an IP address and MAC address storage device, a management device and an access device;

[0036] The IP address and MAC address storage device is used to store the IP addresses and MAC addresses of the devices that are allowed to access, and provide the management device with an IP address database, MAC address data and random keys;

[0037] The management device is used to compare the IP and MAC address database with the IP and MAC addresses of the access device, and provide a key to the device that submits the access application, and is also used for virus processing;

[0038] The storage device needs to perform virus detection before storing new data. Once the data is virus-free, it will encrypt the data. The new data can then be stored in the storage device, and the decrypted file will be provided to the device that has passed the access application.

[0039] Before accessing the storage device, the access device needs to submit an access request to the management device and obtain a key from the management device. The key generation algorithm adopts an asymmetric algorithm, such as the RSA algorithm. Unlike the symmetric encryption algorithm, the RSA algorithm has two different keys, one is a public key and the other is a private key.

[0040] Furthermore, after confirming that the key is correct, the management device needs to submit the key to the IP address and MAC address storage device. After confirming that the key is correct, it will exchange internal data with the management device. The management device extracts the IP address and MAC address database from the IP address and MAC address storage device and compares it with the IP address and MAC address of the access device. If the comparison fails, access is denied. If the comparison is successful, the storage device can be accessed. The management device performs dual authentication of the IP address and MAC address of the access device to ensure that unauthorized devices access the storage device.

[0041] The management device is also equipped with intrusion detection. By monitoring network data flows in real time, it identifies and records intrusions and destructive code flows, identifying network violation patterns and unauthorized network access attempts. This provides boundary protection for the data access link of the boundary interaction platform and implements access control for data packets, ensuring that access devices can legally and effectively access resources within the storage device. This ensures that host addresses within the boundary interaction platform cannot be obtained by external terminals. This intrusion detection function ensures data security and achieves secure network isolation from the public resource access network.

[0042] Furthermore, the connection between the management device and the IP address and MAC address storage device is a unique binding relationship to prevent others from using other devices to access the IP address and MAC address storage device, and the IP address and MAC address database stored in the IP address and MAC address storage device needs to enter the IP and MAC addresses of the authorized access devices in advance to facilitate comparison of the IP and MAC addresses of the access devices.

[0043] Furthermore, the virus identification includes firewalls, intrusion detection, vulnerability scanning, etc., and is updated in real time to prevent new viruses from being unidentified, so as to ensure the stability and reliability of customers' network security.

[0044] Furthermore, the key is randomly generated by the management device and sent to the access device to prevent the key from being known by others.

[0045] Furthermore, the key submitted by the management device when accessing the IP address and MAC address storage device is randomly generated by the IP address and MAC address storage device and sent to the management device to prevent others from using other devices to access the IP address and MAC address storage device.

[0046] Further, the data encryption is performed by the storage device, and the encryption methods include symmetric encryption, asymmetric encryption, hash algorithms, etc., to ensure the security of data during transmission and storage. After passing the verification, the access device is also decrypted by the storage device for the access device to read.

[0047] Further, before using the management device, fingerprint authentication, face recognition, and password login are required to use the management device, and multiple authentication is used to ensure that the management device is not used by others.

[0048] Further, the management device is configured with intrusion detection. By monitoring network data streams in real time, it identifies and records intrusion and destructive code streams, and searches for network violation patterns and unauthorized network access attempts.

[0049] Further, the specific algorithm description of the RSA algorithm is as follows:

[0050] (2) Arbitrarily select two different large prime numbers p and q and calculate their product;

[0051] n = pq, ψ(n) = (p - 1)(q - 1)

[0052] (2) Arbitrarily select a large integer e such that gcd(e, ψ(n)) = 1. The integer e is used as the encryption key (Note: The selection of e is very easy. For example, all prime numbers greater than p and q can be used;

[0053] (3) Determine the decryption key d such that (de) mod ψ(n) = 1, that is, de = kψ(n) + 1, where k ≥ 1 is an arbitrary integer; Therefore, if e and ψ(n) are known, it is very easy to calculate d;

[0054] (4) Publicize the integers n and e, and keep d secret;

[0055] (5) Encrypt the plaintext m (m < n is an integer) into the ciphertext c, and the encryption algorithm is

[0056] c = E(m) = m e mod n

[0057] (6) Decrypt the ciphertext c into the plaintext m, and the decryption algorithm is

[0058] m = D(c) = c d mod n

[0059] However, it is impossible to calculate d only based on n and e (Note: not p and q). Therefore, anyone can encrypt the plaintext, but only authorized users (who know d) can decrypt the ciphertext.

[0060] In summary, this system needs to perform virus identification before storing new data, including multiple protections such as firewalls, intrusion detection, and vulnerability scanning, which minimizes virus intrusion. If the data contains embedded viruses, it will be reported to the management device for administrator processing. If there is no virus, the data will be encrypted. The encryption methods include symmetric encryption, asymmetric encryption, hash algorithm, etc. After encryption, it will be stored in the storage device and wait for reading.

[0061] Before reading, the access device must submit an application to the management device. The management device then sends the generated random key to the access device. At the same time as the access device enters the random key, the management device submits an access application to the IP address and MAC address storage device. The IP address and MAC address storage device sends the random key to the management device. After the administrator enters the random key, the IP address and MAC address storage device sends the IP address database to the management device. The management device reads the IP address of the access device and compares it with the IP address database. If the comparison fails, access is denied. If the comparison succeeds, the IP address and MAC address storage device continues to send the MAC address database to the management device. The management device performs a MAC address comparison. If the comparison fails, access is denied. If the comparison succeeds, access to the storage device is allowed. We implement refined control over access devices to ensure that only authorized users can access data. In addition, for data backup and recovery, we provide a variety of data backup and recovery technologies to ensure that data on storage devices can be protected and restored in a timely and effective manner under various circumstances.

[0062] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A data security storage and access system, characterized by: Including storage devices, IP address and MAC address storage devices, management devices and access devices; The IP address and MAC address storage device is used to store the IP addresses and MAC addresses of the devices that are allowed to access, and provide the management device with an IP address database, MAC address data and random keys; The management device is used to compare the IP and MAC address database with the IP and MAC addresses of the access device, and provide a key to the device that submits the access application, and is also used for virus processing; The storage device needs to perform virus detection before storing new data. Once the data is virus-free, it will encrypt the data. The new data can then be stored in the storage device, and the decrypted file will be provided to the device that has passed the access application. The access device needs to submit an access application to the management device before accessing the storage device and obtain a key from the management device; Among them, after the management device confirms that the key is correct, the management device needs to submit the key to the IP address and MAC address storage device. After confirming that the key is correct, it will exchange internal data with the management device. The management device extracts the IP address and MAC address database from the IP address and MAC address storage device and compares it with the IP address and MAC address of the access device. If the comparison fails, access is denied. If the comparison is successful, access to the storage device is allowed; At the same time, the management device is equipped with intrusion detection, which monitors network data flows in real time, identifies and records intrusions and destructive code flows, protects the data access link of the boundary interaction platform, and controls access to data packets. The management device is connected to the IP address and MAC address storage device as a unique binding relationship, and the IP address and MAC address database stored in the IP address and MAC address storage device needs to enter the IP and MAC addresses of the authorized access devices in advance.

2. A data security storage and access system according to claim 1, characterized in that: The virus identification includes firewall, intrusion detection, vulnerability scanning, etc., and is updated in real time.

3. A data security storage and access system according to claim 1, characterized in that: The key is randomly generated by the management device and sent to the access device.

4. A data security storage and access system according to claim 1, characterized in that: The key submitted by the management device when accessing the IP address and MAC address storage device is randomly generated by the IP address and MAC address storage device and sent to the management device.

5. A data security storage and access system according to claim 1, characterized in that: Before using the management device, fingerprint authentication, face recognition and password login are required.

6. A data security storage and access system according to claim 1, characterized in that: The data encryption is performed by the storage device, and the encryption method includes symmetric encryption, asymmetric encryption, hash algorithm, etc. After the access device passes the verification, it is also decrypted by the storage device and then read by the access device.

7. A data security storage and access system according to claim 1, characterized in that: The management device is configured with intrusion detection, which identifies and records intrusions and destructive code flows by monitoring network data flows in real time.

8. A data security storage and access system according to claim 1, characterized in that: The specific algorithm description of the RSA algorithm is as follows: (1) Arbitrarily select two different large prime numbers p and q to calculate the product; n=pq,ψ(n)=(p-1)(q-1) (2) Choose any large integer e that satisfies gcd(e,ψ(n))=1. The integer e used as the encryption key is any prime number greater than p and q. (3) The determined solution key d satisfies (de) mod ψ(n) = 1, that is, de = kψ(n) + 1, where k ≥ 1 is an arbitrary integer; therefore, if e and ψ(n) are known, d can be calculated; (4) Publicize the integers n and e, and secretly store d; (5) Encrypt the plaintext m into the ciphertext c, where m < n is an integer, and the encryption algorithm is c=E(m)=m e modern (6) Decrypt the ciphertext c into the plaintext m, and the decryption algorithm is: m=D(c)=c d modn。

Images