A storage medium security encryption system for computer software development

Abstract

The present invention discloses a storage medium security encryption system for computer software development, which relates to the technical field of encryption systems. A multiple obfuscation module complicates the storage structure and access logic of encrypted data blocks for code obfuscation, inserts random noise data between data blocks or changes the storage order of data blocks for data obfuscation, adds one or more layers of encryption with different algorithms for encryption obfuscation, and a user behavior evaluation module evaluates abnormal behavior of users in combination with the code obfuscation, data obfuscation and decryption process of encrypted data blocks, and divides users into monitoring levels according to the abnormal behavior evaluation results. The encryption system can perform multiple obfuscation processing on encrypted data blocks in the storage medium in combination with encryption algorithms, and analyzes abnormal behavior and divides monitoring levels on users during the user decryption process, which greatly ensures the security of data storage and the protection capability of the encryption system.

Description

Technical Field

[0001] The present invention relates to the technical field of encryption systems, and in particular to a storage medium security encryption system for computer software development. Background Art

[0002] With the rapid development of information technology, data has become an important asset for enterprises and individuals. Storage media include hard disk drives (HDD), solid-state drives (SSD), USB flash drives, cloud storage, and optical disks. These storage media are widely used in software development, but each medium faces different security challenges. Security encryption systems play a vital role in computer software development. By applying advanced encryption technology and strict security management measures, data security during the development process is guaranteed, legal and regulatory requirements are met, and the interests of enterprises and users are protected.

[0003] The prior art has the following defects:

[0004] 1. In traditional encryption systems, the key generation algorithm may lack sufficient randomness, making the key easy to predict or crack. In addition, in the data encryption process, the same random elements or the same encryption method are used, making the encrypted data easy to be pattern recognized and attacked.

[0005] 2. The data structure and access logic of the encryption system are relatively simple, easy to be reverse engineered and understood, and there is no abnormal analysis and monitoring of user behavior during the decryption of encrypted data blocks. When the user is abnormal but the decryption is successful, data leakage will still occur, making it impossible to identify potential security threats in a timely manner;

[0006] 3. The encryption system usually updates the session key and master key regularly according to the preset update cycle. If there is an abnormality in the encrypted data block storage environment before the session key and master key are updated, this will increase the risk of data leakage.

[0007] Based on this, the present invention proposes a storage medium security encryption system for computer software development, which can perform multiple obfuscation processes on encrypted data blocks in the storage medium in combination with encryption algorithms, and perform abnormal behavior analysis and monitoring level classification on users during the user decryption process, as well as regularly determine whether the session key and master key need to be updated, thereby greatly ensuring the security of data storage and the protection capabilities of the encryption system. Summary of the invention

[0008] The purpose of the present invention is to provide a storage medium security encryption system for computer software development to solve the shortcomings of the background technology.

[0009] In order to achieve the above-mentioned object, the present invention provides the following technical solutions: a storage medium security encryption system for computer software development, comprising an encrypted data block generation module, a multiple obfuscation module, a user behavior evaluation module, and a key update judgment module;

[0010] Encrypted data block generation module: Use a random number generator to generate a master key and session key of a fully regular cryptographic system, divide the data to be encrypted into data blocks of fixed size, use the session key to perform fully regular cryptographic encryption on each data block, and generate encrypted data blocks;

[0011] Multiple obfuscation modules: complicate the storage structure and access logic of encrypted data blocks for code obfuscation, insert random noise data between data blocks or change the storage order of data blocks for data obfuscation, add one or more layers of encryption with different algorithms for encryption obfuscation, and store the encrypted data blocks after multiple obfuscations on the storage medium;

[0012] User behavior assessment module: When a user decrypts an encrypted data block in a storage medium, the user's abnormal behavior is assessed based on the code obfuscation, data obfuscation, and decryption process of the encrypted data block. The user is divided into monitoring levels based on the abnormal behavior assessment results, and different management policies are generated for the user based on the monitoring level classification results;

[0013] Key update judgment module: After the user decrypts the encrypted data block in the storage medium, the security of the encrypted data block in the storage medium is analyzed based on the abnormal behavior assessment results of the user during the decryption process and the current network environment, and based on the analysis results, it is determined whether the session key and master key need to be updated.

[0014] In a preferred embodiment, the user behavior evaluation module obtains the comprehensive time anomaly index, variable restoration error rate, noise data filtering accuracy and verification success rate when the user decrypts the encrypted data block;

[0015] The user anomaly value of the user is obtained by comprehensively calculating the comprehensive time anomaly index, variable restoration error rate, noise data filtering accuracy and verification success rate. The expression is:

[0016] In the formula, outlier user is the user abnormal value, st is the comprehensive time abnormal index, and v error is the variable reduction error rate, o accurate is the noise data filtering accuracy, z success is the verification success rate, α, β, and γ are the proportional coefficients of variable restoration error rate, noise data filtering accuracy, and verification success rate, respectively, and α, β, and γ are all greater than 0.

[0017] In a preferred embodiment, the user behavior evaluation module compares the acquired user abnormal value with a preset first abnormal threshold and a second abnormal threshold, the first abnormal threshold is used to evaluate whether the user has abnormal behavior, and the second abnormal threshold is used to evaluate the severity of the user's abnormal behavior;

[0018] If the user's user abnormal value is less than or equal to the first abnormal threshold, it is assessed that the user has no abnormal behavior; if the user's user abnormal value is greater than the first abnormal threshold, and the user abnormal value is less than or equal to the second abnormal threshold, it is assessed that the user has slightly abnormal behavior, and the user is classified as the second monitoring level; if the user's user abnormal value is greater than the second abnormal threshold, it is assessed that the user has seriously abnormal behavior, and the user is classified as the first monitoring level;

[0019] The user information of the second-level monitoring level is sent to the administrator, who conducts manual monitoring and prohibits the users of the first-level monitoring level from reading the data in the storage medium.

[0020] In a preferred embodiment, after the key update judgment module obtains the network traffic deviation and the intrusion detection frequency of the current network environment, the network traffic deviation and the intrusion detection frequency are normalized to obtain a normalized traffic deviation value and a normalized detection frequency value, and the normalized traffic deviation value and the normalized detection frequency value are summed to obtain an environmental abnormality value;

[0021] The safety factor is obtained by weighting the environmental outliers and the user outliers. The expression is:

[0022] secure=ω1*outlier user +ω2*outlier vibe , where secure is the safety factor, outlier user Outlier is the user outlier. vibe is the environmental anomaly, ω1 and ω2 are weight coefficients, and ω1>ω2>0;

[0023] If the security factor is less than or equal to the security threshold, the security of the encrypted data blocks in the storage medium is analyzed to be high, and it is determined that there is no need to update the session key and the master key. If the security factor is greater than the security threshold, the security of the encrypted data blocks in the storage medium is analyzed to be low, and it is determined that the session key and the master key need to be updated.

[0024] In a preferred embodiment, the calculation logic of the comprehensive time anomaly index is: calculating the code parsing time anomaly assignment of the user during the code obfuscation step parsing, the expression is: In the formula, TPI1 is the abnormal value of code parsing time, T1 is the time taken by the user to parse the code structure, μ1 is the mean of the normal code parsing time, σ1 is the standard deviation of the normal code parsing time, and the abnormal value of data parsing time during the data obfuscation step is expressed as: Where TPI2 is the abnormal value of the data block parsing time, T2 is the time taken by the user to parse the data block structure, μ2 is the mean of the normal parsing time of the data block, σ2 is the standard deviation of the normal parsing time of the data block, and the abnormal value of the encryption parsing time during the encryption obfuscation step is expressed as: Where TPI3 is the abnormal value of encryption parsing time, T3 is the time taken by the user to parse the encrypted structure, μ3 is the mean of the normal encryption parsing time, σ3 is the standard deviation of the normal encryption parsing time, and the code parsing time abnormal value, parsing time abnormal value, and encryption parsing time abnormal value are summed to obtain the comprehensive time anomaly index.

[0025] In a preferred embodiment, the multiple obfuscation module uses an obfuscation tool to rename variables, functions and class names in the code, convert conditional branches and loop structures into nested conditional statements or state machine structures, insert false conditional branches and useless code, encrypt string constants, decrypt them at runtime, and insert obfuscated strings.

[0026] In a preferred embodiment, the multiple obfuscation modules use a random number generator to generate a storage order for data blocks, store the data blocks in the order generated by the random number generator, record the original order in the metadata, generate random noise data blocks, insert noise data blocks between actual data blocks, and record the positions of the noise data blocks in the metadata, insert false data access logic into the code, use conditional statements or random selection mechanisms to increase the obfuscation of the real access path, split a single data access process into multiple small steps, and insert obfuscation logic in each step.

[0027] In a preferred embodiment, the multiple obfuscation module selects other encryption algorithms to re-encrypt each encrypted data block, records each layer of encryption algorithm and key information in metadata, groups the data blocks, encrypts each group of data blocks, and re-encrypts the encrypted data blocks as a whole.

[0028] In a preferred embodiment, the encrypted data block generation module uses a random number generator to generate a master key of a completely regular cryptographic system, the master key is used to generate a session key, and the random number generator is used again based on the master key to generate a session key, each session key is used only for one encryption operation, the data to be encrypted is divided into data blocks of a fixed size, a unique random element is generated for each data block, the data block is fully regular cryptographically encrypted using the generated session key and random element, and the encrypted data block stores and records the relevant random element and session key information.

[0029] A storage medium security encryption method for computer software development, the encryption method comprising the following steps:

[0030] The encryption system uses a random number generator to generate a master key and a session key of a fully regular cryptographic system, divides the data to be encrypted into data blocks of a fixed size, and uses the session key to perform fully regular cryptographic encryption on each data block to generate encrypted data blocks;

[0031] Complicate the storage structure and access logic of encrypted data blocks for code obfuscation, insert random noise data between data blocks, or change the storage order of data blocks for data obfuscation, add one or more layers of encryption with different algorithms for encryption obfuscation, and store the encrypted data blocks after multiple obfuscations on the storage medium;

[0032] When the user decrypts the encrypted data block in the storage medium, the user's abnormal behavior is evaluated in combination with the user's code obfuscation, data obfuscation and encryption obfuscation decryption process of the encrypted data block, and the user is divided into monitoring levels according to the abnormal behavior evaluation results. Different management policies are generated for the user based on the monitoring level classification results. After the user decrypts the encrypted data block in the storage medium, the encryption system analyzes the security of the encrypted data block in the storage medium based on the decryption process and the abnormal behavior evaluation results of the user and the current network environment, and determines whether the session key and the master key need to be updated based on the analysis results.

[0033] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0034] 1. The present invention complicates the storage structure and access logic of the encrypted data block through multiple obfuscation modules to perform code obfuscation, inserts random noise data between data blocks, or changes the storage order of data blocks to perform data obfuscation, adds one or more layers of encryption with different algorithms to perform encryption obfuscation on the basis of the original encryption, and the user behavior evaluation module evaluates the abnormal behavior of the user in combination with the code obfuscation, data obfuscation and decryption process of the encrypted data block when the user decrypts the encrypted data block in the storage medium, divides the user into monitoring levels according to the abnormal behavior evaluation results, and generates different management strategies for the user based on the monitoring level division results. It can combine the encryption algorithm to perform multiple obfuscation processing on the encrypted data block in the storage medium, and perform abnormal behavior analysis and monitoring level division on the user during the user decryption process, and regularly judge whether the session key and the master key need to be updated, which greatly guarantees the security of data storage and the protection capability of the encryption system.

[0035] 2. The present invention uses a key update judgment module in combination with the decryption process to evaluate the abnormal behavior of users and the security of encrypted data blocks in the storage medium in the current network environment, and determines whether the session key and the master key need to be updated based on the analysis results, thereby reducing the risk of data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0037] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] Embodiment 1: A storage medium security encryption system for computer software development described in this embodiment includes an encrypted data block generation module, a multiple obfuscation module, a user behavior evaluation module, and a key update judgment module;

[0040] Encrypted data block generation module: Use a random number generator to generate the master key and session key of the fully regular cryptographic system to ensure the high randomness and unpredictability of the key, divide the data to be encrypted into data blocks of fixed size, use the session key to perform fully regular cryptographic encryption on each data block, generate encrypted data blocks, ensure that each data block uses different random elements, and send the encrypted data blocks to the multiple obfuscation modules;

[0041] Multiple obfuscation modules: complicate the storage structure and access logic of encrypted data blocks to perform code obfuscation, increase the difficulty of understanding and reverse engineering, insert random noise data between data blocks, or change the storage order of data blocks to perform data obfuscation. On the basis of the original encryption, add one or more layers of encryption with different algorithms to perform encryption obfuscation to further obfuscate the data. This step makes it difficult to understand the content even if the data is intercepted. The encrypted data blocks after multiple obfuscations are stored on the storage medium, and the obfuscated content is sent to the user behavior evaluation module;

[0042] User behavior evaluation module: when a user decrypts an encrypted data block in a storage medium, the user's abnormal behavior is evaluated in combination with the user's code obfuscation, data obfuscation, and decryption process of the encrypted data block. The user is divided into monitoring levels based on the abnormal behavior evaluation results, and different management strategies are generated for the user based on the monitoring level division results. The management strategies are sent to the key update judgment module;

[0043] Key update judgment module: After the user decrypts the encrypted data block in the storage medium, the security of the encrypted data block in the storage medium is analyzed based on the abnormal behavior assessment results of the user during the decryption process and the current network environment. Based on the analysis results, it is determined whether the session key and master key need to be updated to ensure the security of the key.

[0044] The present application complicates the storage structure and access logic of the encrypted data block through multiple obfuscation modules for code obfuscation, inserts random noise data between data blocks, or changes the storage order of data blocks for data obfuscation, adds one or more layers of encryption with different algorithms for encryption obfuscation on the basis of the original encryption, and the user behavior evaluation module evaluates the abnormal behavior of the user in combination with the code obfuscation, data obfuscation and decryption process of the encrypted data block when the user decrypts the encrypted data block in the storage medium, divides the user into monitoring levels according to the abnormal behavior evaluation results, generates different management strategies for the user based on the monitoring level division results, analyzes the security of the encrypted data block in the storage medium in combination with the abnormal behavior evaluation results of the user and the current network environment during the decryption process, and judges whether the session key and the master key need to be updated according to the analysis results. It can combine the encryption algorithm to perform multiple obfuscation processing on the encrypted data block in the storage medium, and analyze the abnormal behavior of the user and divide the monitoring level during the user decryption process, and regularly judge whether the session key and the master key need to be updated, which greatly guarantees the security of data storage and the protection capability of the encryption system.

[0045] See also Figure 1 As shown in the figure, the specific workflow of the encryption system is as follows:

[0046] The encryption system uses a random number generator to generate the master key and session key of a fully regular cryptographic system, ensuring the high randomness and unpredictability of the key. The data to be encrypted is divided into data blocks of fixed size, and each data block is fully regular encrypted using the session key to generate encrypted data blocks, ensuring that each data block uses a different random element. The storage structure and access logic of the encrypted data block are complicated to perform code obfuscation, increasing the difficulty of understanding and reverse engineering. Random noise data is inserted between data blocks, or the storage order of data blocks is changed to confuse the data. On the basis of the original encryption, one or more layers of encryption with different algorithms are added to encrypt and confuse the data, further confusing the data. This step makes it possible to The encrypted data blocks after multiple obfuscations are stored on the storage medium so that it is difficult to understand the content even if the data is intercepted. When the user decrypts the encrypted data blocks in the storage medium, the abnormal behavior of the user is evaluated in combination with the code obfuscation, data obfuscation and decryption process of the encrypted data blocks. The user is divided into monitoring levels according to the abnormal behavior evaluation results, and different management policies are generated for the user based on the monitoring level classification results. After the user decrypts the encrypted data blocks in the storage medium, the encryption system analyzes the security of the encrypted data blocks in the storage medium in combination with the decryption process, and determines whether the session key and the master key need to be updated according to the analysis results to ensure the security of the keys.

[0047] Embodiment 2: The encrypted data block generation module uses a random number generator to generate a master key and a session key of a completely regular cryptographic system, ensuring high randomness and unpredictability of the key, divides the data to be encrypted into data blocks of a fixed size, and uses the session key to perform a completely regular cryptographic encryption on each data block to generate an encrypted data block, ensuring that each data block uses a different random element;

[0048] The encryption data block generation module uses a high-quality random number generator (such as a hardware random number generator) to generate a master key for a completely regular cryptographic system. The master key is used to generate a session key and ensures its high randomness and unpredictability. Based on the master key, the random number generator is used again to generate a session key. Each session key is only used for one encryption operation to ensure the security of the encryption process.

[0049] Divide the data to be encrypted into fixed-size data blocks. For example, each data block is 4KB or other suitable size. The divided data blocks are encrypted independently for easy management and encryption.

[0050] Generate a unique random element (such as a random vector or a random number) for each data block to ensure that the encryption process of each data block is unique, read a data block from the data source, use the generated session key and random element to perform a full regular cipher encryption on the data block, store the encrypted data block in a specified location, and record the relevant random element and session key information.

[0051] Store the encrypted data blocks on a secure storage medium (such as a hard disk, SSD, cloud storage, etc.). Ensure the physical security of the storage medium to prevent unauthorized physical access, and generate indexes and metadata for each encrypted data block to facilitate subsequent data retrieval and decryption operations. The metadata includes the randomness element of the data block, session key information, etc.

[0052] The multiple obfuscation modules complicate the storage structure and access logic of the encrypted data blocks to perform code obfuscation, increase the difficulty of understanding and reverse engineering, insert random noise data between data blocks, or change the storage order of data blocks to perform data obfuscation. On the basis of the original encryption, one or more layers of encryption with different algorithms are added to perform encryption obfuscation to further obfuscate the data. This step makes it difficult to understand the content even if the data is intercepted. The encrypted data blocks after multiple obfuscation are stored on the storage medium;

[0053] Multiple obfuscation modules rename variable names, function names, class names, etc. into meaningless strings, making the code difficult to understand and track, convert the control flow structure of the code into a more complex form, making it difficult to analyze, and encrypt or obfuscate the strings in the code to prevent the strings from being directly read and understood. Specifically: use obfuscation tools to rename variables, functions, and class names in the code to ensure that all references are correctly updated, convert conditional branches and loop structures into nested conditional statements or state machine structures, insert false conditional branches and useless code, increase the difficulty of reverse engineering, encrypt string constants, decrypt them at runtime, insert obfuscated strings, and increase the complexity of the code;

[0054] The specific examples of code obfuscation are as follows:

[0055] Variable name renaming: Rename the variable names in the code to meaningless strings. For example, rename username to u1 and users to u2.

[0056] Function name renaming: Rename the function name to a meaningless string. For example, rename add_user to f1 and remove_user to f2.

[0057] Class Rename: Rename the class name to a meaningless string. For example, rename User-Manager to C1.

[0058] Ensure references are updated: Ensure that all references to renamed variables, functions, and classes are updated correctly to avoid reference errors caused by name changes.

[0059] Conditional branch conversion: Convert simple conditional branches into more complex nested conditional statements. For example, convert an if statement into a multi-layer nested if-else statement.

[0060] Loop structure conversion: Convert a simple loop structure into a complex state machine structure, making it difficult to understand. For example, convert a for loop into a while loop and insert an additional state variable to control the loop.

[0061] False conditions and useless code: Insert false conditional branches and useless code to increase the complexity of the code and make it difficult to reverse engineer. For example, insert some conditions that will never be triggered or invalid calculations in the judgment conditions.

[0062] String encryption: Encrypt string constants in the code and decrypt them at runtime. For example, encrypt "Useradded" into an unreadable string and decrypt it for output when the code is running.

[0063] Insert obfuscated strings: Insert some irrelevant obfuscated strings into the code to increase the complexity of the code. For example, insert some meaningless string variables and use these variables in irrelevant locations in the middle of the code.

[0064] Runtime decryption: Ensure that all encrypted strings can be correctly decrypted at runtime and that the original functions are not affected. For example, use the decryption function to decrypt the string where it is needed.

[0065] Automated tools: Use code obfuscation tools to automate the above steps to improve efficiency and consistency. For example, use tools such as ProGuard and Obfuscator-LLVM.

[0066] Manual verification: After the automated tool is processed, manual verification is performed to ensure that the obfuscated code functions are consistent with the original code and that the degree of obfuscation meets the expected requirements.

[0067] Multiple obfuscation modules randomize the storage order of data blocks to make data recovery more difficult, insert random noise data between actual data blocks to increase the degree of data obfuscation, create multiple false data access paths, increase the complexity of the actual data access path, split the data access process into multiple independent steps, each step adds different obfuscation, specifically: use a random number generator to generate the storage order of data blocks, store the data blocks in a new order when storing them, record the original order in metadata for restoration during decryption, generate random noise data blocks, insert noise data blocks between actual data blocks, record the position of noise data blocks in metadata for filtering during decryption, insert false data access logic in the code, use conditional statements or random selection mechanisms to increase the obfuscation of the real access path, split a single data access process into multiple small steps, and insert obfuscation logic in each step, such as false checks or processing;

[0068] The following are some specific examples of data obfuscation:

[0069] Use a random number generator to generate the order in which data blocks are stored:

[0070] Generate a random number sequence that represents the order in which the data blocks are stored.

[0071] The data blocks are rearranged and stored according to the generated random sequence.

[0072] The original order of the data blocks is recorded in the metadata so that it can be restored during decryption.

[0073] Example:

[0074] Suppose there are 5 data blocks and the original order is: A, B, C, D, E.

[0075] The random number generator generates the following sequence: 3, 1, 4, 5, 2.

[0076] The data blocks are stored in random order: C, A, D, E, B.

[0077] Metadata record: The original order is 1,2,3,4,5, and the current storage order is 3,1,4,5,2.

[0078] Generate a block of random noise data:

[0079] Generates random data blocks that contain no actual data and are used only for obfuscation.

[0080] Randomly select positions to insert noise data blocks between real data blocks.

[0081] Which data blocks are noise blocks are recorded in metadata so as to filter them out during decryption.

[0082] Example:

[0083] The actual data blocks are: A, B, C, D, E.

[0084] Randomly generate noise data blocks: N1, N2.

[0085] The order after inserting the noise data block is: A, N1, B, C, N2, D, E.

[0086] Metadata record: Noise data block position is 2,5.

[0087] Insert fake data access logic into the code:

[0088] Insert false data access paths to make the code structure more complex.

[0089] Use conditional statements or random selection mechanisms to increase obfuscation of the true access path, making it difficult for attackers to determine which path is correct.

[0090] Example:

[0091] The actual data access path is: read the data block location from the index file and then access the data block.

[0092] Insert false paths: Insert invalid index access paths in the code.

[0093] Use conditional statements to confuse: each time a data block is accessed, either the real path or the fake path is randomly selected.

[0094] Split the data access process into multiple steps

[0095] Break the data access process into small steps, with each step handling a small piece of logic.

[0096] Insert fake checks or processing logic at each small step to add confusion.

[0097] Example:

[0098] Original data access process: read index file -> access data block -> decrypt data block.

[0099] Break it down into small steps:

[0100] Step 1: Read the index file and insert a fake index check.

[0101] Step 2: Access the data block based on the index location and insert a fake data block check.

[0102] Step 3: Decrypt the data block and insert useless decryption operations.

[0103] Comprehensive example description

[0104] Assume that the original data blocks are: A, B, C, D, E.

[0105] Randomize the order of data blocks:

[0106] Random order generated: 2,5,3,1,4.

[0107] Storage order: B, E, C, A, D.

[0108] Metadata record: original order 1,2,3,4,5, current storage order 2,5,3,1,4.

[0109] Insert random noise data:

[0110] Noise data block: N1, N2.

[0111] The order after insertion is: B, N1, E, C, N2, A, D.

[0112] Metadata record: Noise data block position 2,5.

[0113] Fake data access path:

[0114] Insert false path: An attempt was made to access a data block from an invalid index location.

[0115] Use conditional statements: Randomly select a true path or a false path for data access.

[0116] Split the data access process:

[0117] Step 1: Read the index file and do a fake index check.

[0118] Step 2: Access the data block according to the index position and perform a false data block check.

[0119] Step 3: Decrypt the data block and insert useless decryption operations.

[0120] The multiple obfuscation module adds one or more layers of different encryption algorithms on the basis of existing encryption to further obfuscate the data and nest one encrypted data block in another data block, making the decryption process more complicated. Specifically, it selects other encryption algorithms (such as AES, RSA, etc.), re-encrypts each encrypted data block, records each layer of encryption algorithm and key information in the metadata, groups the data blocks, encrypts each group of data blocks, and encrypts the encrypted data blocks as a whole;

[0121] Specific examples of encryption obfuscation are as follows:

[0122] Select another encryption algorithm

[0123] Choose from a variety of different encryption algorithms, such as AES (symmetric encryption algorithm) and RSA (asymmetric encryption algorithm).

[0124] The encrypted data block is then encrypted using another encryption algorithm.

[0125] Record the algorithm and key information used for each layer of encryption so that they can be correctly restored during decryption.

[0126] The original data blocks are divided into several groups, each group contains multiple data blocks.

[0127] Encrypt each group of data blocks: encrypt each group of data blocks to generate group encrypted data.

[0128] Encrypt the encrypted data blocks as a whole: Encrypt each group of encrypted data blocks as a whole.

[0129] Example

[0130] Assume there are five data blocks, namely: D1, D2, D3, D4, D5.

[0131] Step 1: Basic Encryption

[0132] Initial encryption (such as AES):

[0133] Use AES to encrypt each data block and generate encrypted data blocks: E1_AES, E2_AES, E3_AES, E4_AES, E5_AES.

[0134] Step 2: Select another encryption algorithm for re-encryption

[0135] Second layer of encryption (such as RSA):

[0136] Use RSA to encrypt each AES-encrypted data block to generate secondary encrypted data blocks: E1_RSA, E2_RSA, E3_RSA, E4_RSA, E5_RSA.

[0137] Recorded in metadata: The first layer uses AES encryption, the second layer uses RSA encryption, and records relevant key information.

[0138] Step 3: Group data blocks and nest encryption

[0139] Divide the data blocks into two groups:

[0140] The first group: E1_RSA, E2_RSA, E3_RSA

[0141] The second group: E4_RSA, E5_RSA

[0142] Encrypt each group of data blocks:

[0143] Encrypt the first group using another encryption algorithm (such as Blowfish) to generate: Group1_Blowfish.

[0144] The second group is encrypted using another encryption algorithm (such as Twofish), generating: Group2_Twofish.

[0145] Encrypt each group of encrypted data blocks as a whole:

[0146] Use the ChaCha20 algorithm to encrypt Group1_Blowfish as a whole and generate the final encrypted data block: Final1_ChaCha20.

[0147] Use the Salsa20 algorithm to encrypt Group2_Twofish as a whole and generate the final encrypted data block: Final2_Salsa20.

[0148] Record the encryption algorithm and key information for each layer:

[0149] Record the key for the initial AES encryption.

[0150] Record the public key and private key of the second layer of RSA encryption.

[0151] Records the Blowfish and Twofish keys used for group encryption.

[0152] Records the ChaCha20 and Salsa20 keys used for overall encryption.

[0153] Example Summary

[0154] Through the above steps and examples, the multi-obfuscation module implements multi-layer and nested encryption of data blocks. The specific process includes:

[0155] Initial encryption: Each data block is encrypted using AES.

[0156] Re-encryption: The data block that has been AES encrypted is then encrypted using RSA.

[0157] Group encryption: The data blocks are grouped and encrypted using Blowfish and Twofish respectively.

[0158] Overall encryption: Each group of encrypted data blocks is encrypted as a whole using ChaCha20 and Salsa20 respectively.

[0159] Metadata recording: Detailed recording of the algorithm and key information used for each layer of encryption to ensure that the decryption process can be correctly restored.

[0160] Embodiment 3: When a user decrypts an encrypted data block in a storage medium, the user behavior assessment module performs abnormal behavior assessment on the user in combination with the code obfuscation, data obfuscation and decryption process of the encrypted data block, divides the user into monitoring levels according to the abnormal behavior assessment results, and generates different management strategies for the user based on the monitoring level division results;

[0161] The user behavior evaluation module obtains the comprehensive time anomaly index, variable restoration error rate, noise data filtering accuracy, and verification success rate when the user decrypts the encrypted data block;

[0162] The user anomaly value of the user is obtained by comprehensively calculating the comprehensive time anomaly index, variable restoration error rate, noise data filtering accuracy and verification success rate. The expression is:

[0163] In the formula, outlier user is the user abnormal value, st is the comprehensive time abnormal index, and v error is the variable reduction error rate, o accurate is the noise data filtering accuracy, z success is the verification success rate, α, β, and γ are the proportional coefficients of variable restoration error rate, noise data filtering accuracy, and verification success rate, respectively, and α, β, and γ are all greater than 0.

[0164] After the user decrypts the encrypted data block in the storage medium, the key update judgment module combines the abnormal behavior evaluation results of the user in the decryption process and the current network environment to analyze the security of the encrypted data block in the storage medium, and judges whether the session key and master key need to be updated based on the analysis results to ensure the security of the key;

[0165] The larger the user abnormal value is, the more abnormal the user's behavior is. The user behavior evaluation module compares the acquired user abnormal value with the preset first abnormal threshold and second abnormal threshold. The first abnormal threshold is used to evaluate whether the user has abnormal behavior, and the second abnormal threshold is used to evaluate the severity of the user's abnormal behavior.

[0166] If the user abnormal value of the user is less than or equal to the first abnormal threshold, it is evaluated that the user has no abnormal behavior;

[0167] If the user's user abnormal value is greater than the first abnormal threshold, and the user abnormal value is less than or equal to the second abnormal threshold, the user is evaluated to have slightly abnormal behavior and the user is classified into the second-level monitoring level;

[0168] If the user's abnormal value is greater than the second abnormal threshold, the user is assessed to have serious abnormal behavior and is classified as a first-level monitoring level;

[0169] The user information of the second-level monitoring level is sent to the administrator, who will conduct manual monitoring and prohibit the users of the first-level monitoring level from reading the data in the storage medium.

[0170] The calculation logic of the comprehensive time anomaly index is: calculate the code parsing time anomaly assignment when the user parses the code obfuscation step, and the expression is: In the formula, TPI1 is the abnormal value of code parsing time, T1 is the time taken by the user to parse the code structure, μ1 is the mean of the normal code parsing time, σ1 is the standard deviation of the normal code parsing time, and the abnormal value of data parsing time during the data obfuscation step is expressed as: Where TPI2 is the abnormal value of the data block parsing time, T2 is the time taken by the user to parse the data block structure, μ2 is the mean of the normal parsing time of the data block, σ2 is the standard deviation of the normal parsing time of the data block, and the abnormal value of the encryption parsing time during the encryption obfuscation step is expressed as: Where TPI3 is the abnormal value of encryption parsing time, T3 is the time taken by the user to parse the encrypted structure, μ3 is the mean of the normal encryption parsing time, σ3 is the standard deviation of the normal encryption parsing time, and the code parsing time abnormal value, parsing time abnormal value and encryption parsing time abnormal value are summed to obtain the comprehensive time anomaly index. The larger the comprehensive time anomaly index, the larger or smaller the parsing time of the user in the code obfuscation, data obfuscation and encryption obfuscation steps is, which indicates that the user has an abnormality, as follows:

[0171] 1. Parsing time is too long

[0172] If the parsing time for certain steps in the decryption process is abnormally long, it may indicate the following situations:

[0173] Attempting to bypass protection: If the user is intentionally taking too long to resolve, it could indicate that they are attempting to circumvent certain security measures or reverse engineer in order to bypass encryption protection. In this case, a long resolve time could be a cover-up attempt to hide unusual behavior.

[0174] Encountering complex problems: Some obfuscation methods may introduce more complex calculations and data processing requirements, resulting in increased parsing time. If this is not expected normal behavior, it may mean that the user is decrypting abnormally.

[0175] 2. Parsing time is too short

[0176] If the parsing time of certain steps in the decryption process is abnormally short, it may indicate the following situations:

[0177] Use of tools or automated scripts: The user may have used automated tools or scripts to quickly process obfuscated data. This may indicate that the user has a high level of knowledge of obfuscation techniques and is able to effectively bypass obfuscation steps. While this may be a sign of technical ability, it may also indicate that the user is attempting to circumvent security measures.

[0178] Evasion attempts: Fast parsing times may indicate that the user is attempting to circumvent encryption protections through unconventional methods such as direct decoding or brute force. This behavior may be an attempt to bypass security measures designed into the system.

[0179] The calculation logic of the variable restoration error rate is: the variable restoration error rate is obtained by dividing the number of errors when the user restores the variable and function name by the monitoring time. The larger the variable restoration error rate, the more errors the user has made when restoring the variable and function name during the monitoring time, and the user may have an abnormality, as follows:

[0180] Signs of malicious intent

[0181] Frequent errors may not only be a result of lack of technical ability, but may also be intentional on the part of the user. Here are some possible signs of malicious behavior:

[0182] Disguising behavior: Users may intentionally create errors to conceal their actual intentions. For example, users may try to hide their true goals in reverting obfuscated code, or try to confuse monitoring systems.

[0183] Attempts to circumvent detection: Users may be attempting to circumvent detection systems or security measures. In this case, frequent errors may be intentional to prevent the system from correctly identifying their behavior.

[0184] Identification of abnormal behavior

[0185] A high error rate is an important indicator for detecting anomalous behavior:

[0186] Abnormal behavior monitoring: The system can use the number of errors to monitor and identify abnormal behavior. If a user's number of errors in restoring variable and function names is significantly higher than normal, this may be a warning sign of abnormal behavior.

[0187] Analyze user behavior patterns: Combined with other behavioral data (such as decryption time, success rate, error rate, etc.), users' behavior patterns can be analyzed more comprehensively. If the number of errors is abnormally high, further investigation of user intentions and behaviors may be required.

[0188] The calculation logic of noise data filtering accuracy is: the number of noise data blocks successfully filtered by the user is divided by the total number of noise data blocks inserted to obtain the noise data filtering accuracy. The smaller the noise data filtering accuracy is, the smaller the number of noise data blocks successfully filtered by the user is, and the user may be abnormal, as follows:

[0189] Signs of unusual behavior

[0190] Intentional circumvention or omission: A low number of noisy data blocks that a user successfully filters may indicate that the user is intentionally circumventing or omitting noisy data blocks. This may be due to the user trying to bypass the processing of noisy data in order to access the real data more quickly. Such behavior may indicate that the user is intentionally circumventing the system's protection measures.

[0191] Abnormal processing patterns: If the user's performance in successfully filtering noisy data blocks is much lower than normal, it may be a sign of abnormal behavior. For example, the user may intentionally and selectively ignore noisy data blocks to avoid detection by the monitoring system.

[0192] The necessity of abnormal monitoring

[0193] Monitoring and alerting: A low number of successfully filtered noise blocks can be used as an indicator of abnormal user behavior. The monitoring system can set thresholds to identify situations where the number of successful filtering is far below normal levels and trigger alerts or further investigation.

[0194] Behavior pattern analysis: A comprehensive analysis of the user's performance in noise data processing and other behavioral data (such as decryption time, error rate, etc.) can more accurately identify whether the user has abnormal behavior. A small number of successfully filtered noise data blocks may be an important signal of abnormal behavior.

[0195] The calculation logic of the verification success rate is: the number of layers successfully decrypted by the user is divided by the total number of encryption layers to obtain the verification success rate. The smaller the verification success rate, the smaller the number of layers successfully decrypted by the user, and the user may be abnormal, as follows:

[0196] Signs of unusual behavior

[0197] Deliberately interrupting decryption: Users may intentionally decrypt only some layers, leaving others untouched to conceal their actual intentions. This behavior may be intended to circumvent monitoring systems or security measures, thereby hiding the true purpose of data access.

[0198] Bypassing security mechanisms: Failure to successfully decrypt more layers may indicate that the user is trying to bypass some of the protections of the encryption. By decrypting only some of the layers, the user may be trying to bypass or ignore certain security control points.

[0199] Abnormal monitoring and analysis

[0200] Monitoring indicators: The number of layers successfully decrypted is an important indicator for monitoring user behavior. If the number of layers a user decrypts is significantly lower than normal, it may be a sign of abnormal behavior and requires further analysis.

[0201] Behavioral patterns: A comprehensive analysis of the number of successful decryption layers and other behavioral data (such as decryption time, error rate, etc.) can help more accurately identify whether a user has abnormal behavior. For example, if the number of decryption layers is far below normal, it may indicate that the user has unintended behavior or technical difficulties during the decryption process.

[0202] After the user decrypts the encrypted data block in the storage medium, the key update judgment module combines the abnormal behavior evaluation results of the user in the decryption process and the current network environment to analyze the security of the encrypted data block in the storage medium, and judges whether the session key and master key need to be updated based on the analysis results to ensure the security of the key;

[0203] After the key update judgment module obtains the network traffic deviation and intrusion detection frequency of the current network environment, the network traffic deviation and the intrusion detection frequency are normalized to obtain a normalized traffic deviation value and a normalized detection frequency value, and the normalized traffic deviation value and the normalized detection frequency value are summed to obtain an environmental abnormality value;

[0204] The safety factor is obtained by weighting the environmental outliers and the user outliers. The expression is:

[0205] secure=ω1*outlier user +ω2*outlier vibe , where secure is the safety factor, outlien is userOutlier is the user outlier. vibe is the environmental anomaly, ω1 and ω2 are weight coefficients, and ω1>ω2>0;

[0206] If the security factor is less than or equal to the security threshold, the security of the encrypted data blocks in the storage medium is analyzed to be high, and it is determined that there is no need to update the session key and the master key. If the security factor is greater than the security threshold, the security of the encrypted data blocks in the storage medium is analyzed to be low, and it is determined that the session key and the master key need to be updated.

[0207] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0208] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0209] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A storage medium security encryption system for computer software development, characterized in that: It includes an encrypted data block generation module, a multiple obfuscation module, a user behavior evaluation module, and a key update judgment module; Encrypted data block generation module: Use a random number generator to generate a master key and session key of a fully regular cryptographic system, divide the data to be encrypted into data blocks of fixed size, use the session key to perform fully regular cryptographic encryption on each data block, and generate encrypted data blocks; Multiple obfuscation modules: complicate the storage structure and access logic of encrypted data blocks for code obfuscation, insert random noise data between data blocks or change the storage order of data blocks for data obfuscation, add one or more layers of encryption with different algorithms for encryption obfuscation, and store the encrypted data blocks after multiple obfuscations on the storage medium; User behavior assessment module: When a user decrypts an encrypted data block in a storage medium, the user's abnormal behavior is assessed based on the code obfuscation, data obfuscation, and decryption process of the encrypted data block. The user is divided into monitoring levels based on the abnormal behavior assessment results, and different management policies are generated for the user based on the monitoring level classification results; The user behavior evaluation module calculates the user anomaly value of the user by comprehensively calculating the time anomaly index, variable restoration error rate, noise data filtering accuracy and verification success rate. The expression is: , where is the user outlier, is the comprehensive temporal anomaly index, is the variable reduction error rate, is the noise data filtering accuracy, To verify the success rate, , , are the proportional coefficients of variable restoration error rate, noise data filtering accuracy and verification success rate, respectively, and , , All are greater than 0; Key update judgment module: After the user decrypts the encrypted data block in the storage medium, the security of the encrypted data block in the storage medium is analyzed based on the abnormal behavior assessment results of the user during the decryption process and the current network environment, and based on the analysis results, it is determined whether the session key and master key need to be updated.

2. A computer software development storage medium security encryption system according to claim 1, characterized in that: The user behavior evaluation module compares the acquired user abnormal value with a preset first abnormal threshold and a second abnormal threshold, wherein the first abnormal threshold is used to evaluate whether the user has abnormal behavior, and the second abnormal threshold is used to evaluate the severity of the user's abnormal behavior; If the user abnormal value of the user is less than or equal to the first abnormal threshold, it is evaluated that the user has no abnormal behavior; If the user's user abnormal value is greater than the first abnormal threshold, and the user abnormal value is less than or equal to the second abnormal threshold, the user is evaluated to have slightly abnormal behavior and the user is classified into the second-level monitoring level; If the user's abnormal value is greater than the second abnormal threshold, the user is assessed to have serious abnormal behavior and is classified as a first-level monitoring level; The user information of the second-level monitoring level is sent to the administrator, who conducts manual monitoring and prohibits the users of the first-level monitoring level from reading the data in the storage medium.

3. A computer software development storage medium security encryption system according to claim 2, characterized in that: After the key update judgment module obtains the network traffic deviation and the intrusion detection frequency of the current network environment, the network traffic deviation and the intrusion detection frequency are normalized to obtain a traffic deviation normalized value and a detection frequency normalized value, and the traffic deviation normalized value and the detection frequency normalized value are summed to obtain an environmental abnormality value; The safety factor is obtained by weighting the environmental outliers and the user outliers. The expression is: , where is the safety factor, is the user outlier, is an environmental outlier, , is the weight coefficient, and ; If the security factor is less than or equal to the security threshold, the security of the encrypted data blocks in the storage medium is analyzed to be high, and it is determined that there is no need to update the session key and the master key. If the security factor is greater than the security threshold, the security of the encrypted data blocks in the storage medium is analyzed to be low, and it is determined that the session key and the master key need to be updated.

4. A computer software development storage medium security encryption system according to claim 3, characterized in that: The calculation logic of the comprehensive time anomaly index is: calculate the code parsing time anomaly assignment when the user parses the code obfuscation step, and the expression is: , where Assign values ​​to code parsing time exceptions, The time spent parsing the code structure for the user, is the average of the normal parsing time of the code, is the standard deviation of the normal code parsing time, and the data parsing time is abnormally assigned during the data obfuscation step parsing. The expression is: , where Assign values ​​to data block parsing time anomalies, The time it takes to parse the data block structure for the user, is the average of the normal parsing time of the data block, is the standard deviation of the normal parsing time of the data block, and the abnormal encryption parsing time during the encryption obfuscation step is assigned a value. The expression is: , where Assign a value to the encryption parsing time exception, The time it takes to parse the encrypted structure for the user, is the average of the normal parsing time for encryption, To encrypt the standard deviation of normal parsing time, the code parsing time anomaly assignment, the parsing time anomaly assignment and the encrypted parsing time anomaly assignment are summed to obtain the comprehensive time anomaly index.

5. A storage medium security encryption system for computer software development according to claim 4, characterized in that: The multiple obfuscation module uses obfuscation tools to rename variables, functions and class names in the code, convert conditional branches and loop structures into nested conditional statements or state machine structures, insert false conditional branches and useless codes, encrypt string constants, decrypt them at runtime, and insert obfuscated strings.

6. A storage medium security encryption system for computer software development according to claim 5, characterized in that: The multiple obfuscation modules use a random number generator to generate a storage order for data blocks, store the data blocks in the order generated by the random number generator, record the original order in metadata, generate random noise data blocks, insert noise data blocks between actual data blocks, and record the positions of the noise data blocks in metadata, insert false data access logic into the code, use conditional statements or random selection mechanisms to increase the obfuscation of the real access path, split a single data access process into multiple small steps, and insert obfuscation logic in each step.

7. A storage medium security encryption system for computer software development according to claim 6, characterized in that: The multiple obfuscation module selects other encryption algorithms to re-encrypt each encrypted data block, records each layer of encryption algorithm and key information in metadata, groups the data blocks, encrypts each group of data blocks, and re-encrypts the encrypted data blocks as a whole.

8. A storage medium security encryption system for computer software development according to claim 7, characterized in that: The encrypted data block generation module uses a random number generator to generate a master key of a completely regular cryptographic system, the master key is used to generate a session key, and the random number generator is used again based on the master key to generate a session key, each session key is only used for one encryption operation, the data to be encrypted is divided into data blocks of a fixed size, a unique random element is generated for each data block, the data block is fully regular cryptographically encrypted using the generated session key and random element, and the encrypted data block is stored and the related random element and session key information is recorded.

9. A method for securely encrypting a storage medium for computer software development, implemented by the encryption system according to any one of claims 1 to 8, characterized in that: The encryption method comprises the following steps: The encryption system uses a random number generator to generate a master key and a session key of a fully regular cryptographic system, divides the data to be encrypted into data blocks of a fixed size, and uses the session key to perform fully regular cryptographic encryption on each data block to generate encrypted data blocks; Complicate the storage structure and access logic of encrypted data blocks for code obfuscation, insert random noise data between data blocks, or change the storage order of data blocks for data obfuscation, add one or more layers of encryption with different algorithms for encryption obfuscation, and store the encrypted data blocks after multiple obfuscations on the storage medium; When the user decrypts the encrypted data block in the storage medium, the user's abnormal behavior is evaluated in combination with the user's code obfuscation, data obfuscation and encryption obfuscation decryption process of the encrypted data block, and the user is divided into monitoring levels according to the abnormal behavior evaluation results. Different management policies are generated for the user based on the monitoring level classification results. After the user decrypts the encrypted data block in the storage medium, the encryption system analyzes the security of the encrypted data block in the storage medium based on the decryption process and the abnormal behavior evaluation results of the user and the current network environment, and determines whether the session key and the master key need to be updated based on the analysis results.

Images