Data security protection method

Abstract

The invention discloses a data security protection method, and relates to the technical field of data security. Comprising the following steps: step 1, checking the identity of a person entering and exiting a machine room, step 2, deploying a VPN client for a PC terminal, matching the VPN client with a security authentication gateway through the security authentication gateway, constructing a centralized operation and maintenance management channel, then logging in a bastion host, uniformly managing an application server and a database server by the bastion host, and carrying out centralized operation and maintenance management by the security authentication gateway. 3, performing data security transmission among the data systems; according to the invention, the security of an information system and a network is protected, and the confidentiality, integrity, availability and non-repudiation of data are ensured.

Description

Technical Field

[0001] The invention discloses a data security protection method, and relates to the technical field of data security. Background Art

[0002] Data centers are global collaborative networks of specific devices used to transmit, accelerate, display, calculate, and store data information on the internet network infrastructure. The computer rooms and data systems of data centers need to strengthen data encryption and data security. Current data encryption and data security methods cannot meet the needs of data centers. Summary of the invention

[0003] The present invention aims at solving the problems in the prior art and provides a data security protection method to protect the security of information systems and networks and ensure the confidentiality, integrity, availability and non-repudiation of data.

[0004] The specific scheme proposed by the present invention is:

[0005] The present invention provides a data security protection method, comprising:

[0006] Step 1: Check the identity of people entering and leaving the computer room.

[0007] Step 2: Deploy VPN clients for PC terminals, and connect VPN clients to the security authentication gateway through the security authentication gateway to build a centralized operation and maintenance management channel. Then log in to the bastion host, which manages application servers and database servers in a unified manner.

[0008] Step 3: Secure data transmission between data systems: The secure data transmission uses a domestic encryption algorithm for the communication handshake process, in which an SSL link is established through a client request, and a random number Clientrandom and an encryption suite supported by the client are sent to the server for plain text transmission.

[0009] The server responds with a cipher suite supported by the client, a random number Serverrandom, and the server public key certificate.

[0010] Generate a new random number Premaster secret through the client, encrypt it with the certificate public key and encryption method issued by the server, and send it to the server.

[0011] The server receives the client's reply and uses the server certificate private key to decrypt it. At the same time, it uses Clientrandom, Server random and Premaster secret to generate symmetric encryption key, iv and mac key for SSL data transmission through domestic encryption algorithms.

[0012] Subsequent SSL data transmission is encrypted using symmetric encryption, and integrity protection is performed using MAC to protect the integrity of network boundary access control information.

[0013] Furthermore, in step 1 of the data security protection method, the identity of the people entering and leaving the computer room is checked, including: swiping the card and verifying the personal password, recording the people entering and leaving the computer room and the events for reference, and using HMAC-SM3 to protect the integrity of the access control records, thereby ensuring the authenticity of the identities of the people entering and leaving the computer room and the integrity of the access control records.

[0014] Furthermore, in step 2 of the data security protection method, after connecting to the secure authentication gateway VPN client, the bastion host is accessed based on the non-national secret HTTPS protocol, and then the bastion host uniformly manages the application server and the database server through the SSH2.0 protocol.

[0015] Regularly back up the access control information of the bastion host, and use the smart password key to digitally sign the access control information using the SM2 algorithm based on the public key cryptography algorithm and digital signature mechanism to ensure the integrity of the system resource access control information.

[0016] Furthermore, the data security protection method also includes step 4 of integrating the encryption and decryption service interface of the cloud platform with the data system, encrypting the data with the SM4 algorithm when storing the data in the data system, and realizing storage confidentiality protection.

[0017] Furthermore, in step 4 of the data security protection method, an integrity verification service is called when data is stored to use the HMAC-SM3 algorithm to perform a hash integrity check on the data, thereby verifying the integrity requirements for business data storage.

[0018] The present invention also provides a data security protection device, including a verification module, a gateway management module and a communication management module.

[0019] The verification module verifies the identity of personnel entering and leaving the computer room.

[0020] The gateway management module deploys VPN clients for PC terminals, and connects with the security authentication gateway through the VPN client of the security authentication gateway to build a centralized operation and maintenance management channel, and then logs in to the bastion host, which uniformly manages application servers and database servers.

[0021] The communication management module performs secure data transmission between data systems: data security transmission uses domestic encryption algorithms for the communication handshake process, in which an SSL link is established through a client request, and a random number Client random and the encryption suite supported by the client are sent to the server for plain text transmission.

[0022] The server responds with a cipher suite supported by the client, a random number Serverrandom, and the server public key certificate.

[0023] Generate a new random number Premaster secret through the client, encrypt it with the certificate public key and encryption method issued by the server, and send it to the server.

[0024] The server receives the client's reply and uses the server certificate private key to decrypt it. At the same time, it uses Clientrandom, Server random and Premaster secret to generate symmetric encryption key, iv and mac key for SSL data transmission through domestic encryption algorithms.

[0025] Subsequent SSL data transmission is encrypted using symmetric encryption, and integrity protection is performed using MAC to protect the integrity of network boundary access control information.

[0026] Furthermore, the verification module of the data security protection device verifies the identity of people entering and leaving the computer room, including: swiping a card and verifying a personal password, recording people entering and leaving the computer room and keeping records of events for reference, and using HMAC-SM3 to perform integrity protection on access control records, thereby ensuring the authenticity of the identities of people entering and leaving the computer room and the integrity of access control records.

[0027] Furthermore, the gateway management module of the data security protection device described above accesses the bastion host based on the non-national secret HTTPS protocol after connecting to the security authentication gateway VPN client, and then the bastion host uniformly manages the application server and the database server through the SSH2.0 protocol.

[0028] Regularly back up the access control information of the bastion host, and use the smart password key to digitally sign the access control information using the SM2 algorithm based on the public key cryptography algorithm and digital signature mechanism to ensure the integrity of the system resource access control information.

[0029] Furthermore, the data security protection device also includes a storage management module, which integrates the encryption and decryption service interface of the cloud platform into the data system, encrypts the data using the SM4 algorithm when storing the data in the data system, and realizes storage confidentiality protection.

[0030] Furthermore, the storage management module of the data security protection device calls the integrity verification service when storing data and uses the HMAC-SM3 algorithm to perform hash integrity verification on the data, thereby realizing the verification of the business data storage integrity requirements.

[0031] The benefits of the present invention are:

[0032] Data confidentiality: Encryption technology is used to protect the confidentiality of data during transmission and storage to prevent unauthorized access and disclosure.

[0033] Data integrity: Use technologies such as hash functions and digital signatures to ensure that data is not tampered with during transmission and storage, and maintain data integrity and accuracy.

[0034] Authentication: Ensure the authenticity of system users and devices through passwords, two-factor authentication, biometrics, etc. to prevent identity impersonation and illegal access.

[0035] Data tamper-proofing: Use technologies such as digital signatures and timestamps to ensure data is tamper-proof during storage and transmission, making tampering detectable and traceable.

[0036] Trust management: Establish a trust system based on cryptographic technology to ensure the trust relationship among all parties in the system and prevent the break of the trust chain and trust crisis.

[0037] The organic combination of these technologies can greatly improve the security of information systems, ensure the confidentiality, integrity and availability of data, reduce security risks, and protect the information assets of users and organizations. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a schematic flow chart of the method of the present invention. DETAILED DESCRIPTION

[0039] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention.

[0040] Example 1

[0041] The present invention provides a data security protection method, comprising:

[0042] Step 1: Check the identity of the person entering and leaving the computer room. Specifically, it includes: swiping the card and verifying the personal password, recording the people entering and leaving the computer room and the events for reference, and using HMAC-SM3 to protect the integrity of the access control records, ensuring the authenticity of the identity of the people entering and leaving the computer room and the integrity of the access control records.

[0043] Step 2: Deploy a VPN client for the PC terminal, and connect the VPN client to the security authentication gateway through the security authentication gateway to build a centralized operation and maintenance management channel. Then log in to the bastion host, which uniformly manages application servers and database servers.

[0044] After connecting to the secure authentication gateway VPN client, the bastion host is accessed based on the non-national secret HTTPS protocol. The bastion host then manages the application server and database server uniformly through the SSH2.0 protocol.

[0045] Regularly back up the access control information of the bastion host, and use the smart password key to digitally sign the access control information using the SM2 algorithm based on the public key cryptography algorithm and digital signature mechanism to ensure the integrity of the system resource access control information.

[0046] Step 3: Secure data transmission between data systems: The secure data transmission uses a domestic encryption algorithm for the communication handshake process, in which an SSL link is established through a client request, and a random number Clientrandom and an encryption suite supported by the client are sent to the server for plain text transmission.

[0047] The server responds with a cipher suite supported by the client, a random number Serverrandom, and the server public key certificate.

[0048] Generate a new random number Premaster secret through the client, encrypt it with the certificate public key and encryption method issued by the server, and send it to the server.

[0049] The server receives the client's reply and uses the server certificate private key to decrypt it. At the same time, it uses Clientrandom, Server random and Premaster secret to generate symmetric encryption key, iv and mac key for SSL data transmission through domestic encryption algorithms.

[0050] Subsequent SSL data transmission is encrypted using symmetric encryption, and integrity protection is performed using MAC to protect the integrity of network boundary access control information.

[0051] Step 4 integrates the encryption and decryption service interface of the cloud platform into the data system, and encrypts the data with the SM4 algorithm when storing it in the data system to achieve storage confidentiality protection.

[0052] When storing data, the integrity verification service is called to use the HMAC-SM3 algorithm to perform hash integrity verification on the data to verify the integrity requirements of business data storage.

[0053] Example 2

[0054] The present invention also provides a data security protection device, including a verification module, a gateway management module and a communication management module.

[0055] The verification module verifies the identity of personnel entering and leaving the computer room.

[0056] The gateway management module deploys VPN clients for PC terminals, and connects with the security authentication gateway through the VPN client of the security authentication gateway to build a centralized operation and maintenance management channel, and then logs in to the bastion host, which uniformly manages application servers and database servers.

[0057] The communication management module performs secure data transmission between data systems: data security transmission uses domestic encryption algorithms for the communication handshake process, in which an SSL link is established through a client request, and a random number Client random and the encryption suite supported by the client are sent to the server for plain text transmission.

[0058] The server responds with a cipher suite supported by the client, a random number Serverrandom, and the server public key certificate.

[0059] Generate a new random number Premaster secret through the client, encrypt it with the certificate public key and encryption method issued by the server, and send it to the server.

[0060] The server receives the client's reply and uses the server certificate private key to decrypt it. At the same time, it uses Clientrandom, Server random and Premaster secret to generate symmetric encryption key, iv and mac key for SSL data transmission through domestic encryption algorithms.

[0061] Subsequent SSL data transmission is encrypted using symmetric encryption, and integrity protection is performed using MAC to protect the integrity of network boundary access control information.

[0062] As the information interaction and execution process between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention, the specific contents can be found in the description of the embodiment of the method of the present invention and will not be repeated here.

[0063] Likewise, the benefits of the device of the present invention are:

[0064] Data confidentiality: Encryption technology is used to protect the confidentiality of data during transmission and storage to prevent unauthorized access and disclosure.

[0065] Data integrity: Use technologies such as hash functions and digital signatures to ensure that data is not tampered with during transmission and storage, and maintain data integrity and accuracy.

[0066] Authentication: Ensure the authenticity of system users and devices through passwords, two-factor authentication, biometrics, etc. to prevent identity impersonation and illegal access.

[0067] Data tamper-proofing: Use technologies such as digital signatures and timestamps to ensure data is tamper-proof during storage and transmission, making tampering detectable and traceable.

[0068] Trust management: Establish a trust system based on cryptographic technology to ensure the trust relationship among all parties in the system and prevent the break of the trust chain and trust crisis.

[0069] The organic combination of these technologies can greatly improve the security of information systems, ensure the confidentiality, integrity and availability of data, reduce security risks, and protect the information assets of users and organizations.

[0070] It should be noted that not all steps and modules in the above-mentioned processes and device structures are necessary, and some steps or modules can be ignored according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or some components in multiple independent devices may be implemented together.

[0071] The above-described embodiments are only preferred embodiments for fully illustrating the present invention, and the protection scope of the present invention is not limited thereto. Equivalent substitutions or changes made by those skilled in the art based on the present invention are within the protection scope of the present invention. The protection scope of the present invention shall be subject to the claims.

Claims

1. A data security protection method, characterized in that include: Step 1: Check the identity of people entering and leaving the computer room. Step 2: Deploy VPN clients for PC terminals, and connect VPN clients to the security authentication gateway through the security authentication gateway to build a centralized operation and maintenance management channel. Then log in to the bastion host, which manages application servers and database servers in a unified manner. Step 3: Secure data transmission between data systems: The secure data transmission uses a domestic encryption algorithm for the communication handshake process, in which an SSL link is established through a client request, and a random number Client random and the encryption suite supported by the client are sent to the server for plain text transmission. The server responds with a cipher suite supported by the client, a random number Serverrandom, and the server public key certificate. Generate a new random number Premaster secret through the client, encrypt it with the certificate public key and encryption method issued by the server, and send it to the server. The server receives the client's reply and uses the server certificate private key to decrypt it. At the same time, it uses Clientrandom, Server random and Premaster secret to generate symmetric encryption key, iv and mac key for SSL data transmission through domestic encryption algorithms. Subsequent SSL data transmission is encrypted using symmetric encryption, and integrity protection is performed using MAC to protect the integrity of network boundary access control information.

2. A data security protection method according to claim 1, characterized in that In step 1, the identities of people entering and leaving the computer room are checked, including: swiping cards and verifying personal passwords, recording people entering and leaving the computer room and keeping records for reference, and using HMAC-SM3 to protect the integrity of access control records, ensuring the authenticity of the identities of people entering and leaving the computer room and the integrity of access control records.

3. A data security protection method according to claim 1, characterized in that In step 2, after connecting to the secure authentication gateway VPN client, access the bastion host based on the non-national secret HTTPS protocol. Then the bastion host manages the application server and database server uniformly through the SSH2.0 protocol. Regularly back up the access control information of the bastion host, and use the smart password key to digitally sign the access control information using the SM2 algorithm based on the public key cryptography algorithm and digital signature mechanism to ensure the integrity of the system resource access control information.

4. A data security protection method according to claim 1, characterized in that It also includes step 4 of integrating the encryption and decryption service interface of the cloud platform with the data system, encrypting the data with the SM4 algorithm when storing the data in the data system to achieve storage confidentiality protection.

5. A data security protection method according to claim 1, characterized in that in step 4, when the data is stored, the integrity verification service is called to use the HMAC-SM3 algorithm to perform a hash integrity check on the data to realize the business data storage integrity requirement verification.

6. A data security protection device, characterized in that Including inspection module, gateway management module and communication management module, The verification module verifies the identity of personnel entering and leaving the computer room. The gateway management module deploys VPN clients for PC terminals, and connects with the security authentication gateway through the VPN client of the security authentication gateway to build a centralized operation and maintenance management channel, and then logs in to the bastion host, which uniformly manages application servers and database servers. The communication management module performs secure data transmission between data systems: data security transmission uses domestic encryption algorithms for the communication handshake process, in which an SSL link is established through a client request, and a random number Clientrandom and an encryption suite supported by the client are sent to the server for plain text transmission. The server responds with a cipher suite supported by the client, a random number Serverrandom, and the server public key certificate. Generate a new random number Premaster secret through the client, encrypt it with the certificate public key and encryption method issued by the server, and send it to the server. The server receives the client's reply and uses the server certificate private key to decrypt it. At the same time, it uses Clientrandom, Server random and Premaster secret to generate symmetric encryption key, iv and mac key for SSL data transmission through domestic encryption algorithms. Subsequent SSL data transmission is encrypted using symmetric encryption, and integrity protection is performed using MAC to protect the integrity of network boundary access control information.

7. A data security protection device according to claim 6, characterized in that Inspection module Check the identity of people entering and leaving the computer room, including: swiping cards and verifying personal passwords, recording people entering and leaving the computer room and events for reference, and using HMAC-SM3 to protect the integrity of access control records, ensuring the authenticity of the identities of people entering and leaving the computer room and the integrity of access control records.

8. A data security protection device according to claim 1, characterized in that the gateway After the management module connects to the VPN client of the security authentication gateway, it accesses the bastion host based on the non-national secret HTTPS protocol. Then the bastion host manages the application server and database server uniformly through the SSH2.0 protocol. Regularly back up the access control information of the bastion host, and use the smart password key to digitally sign the access control information using the SM2 algorithm based on the public key cryptography algorithm and digital signature mechanism to ensure the integrity of the system resource access control information.

9. A data security protection device according to claim 6, characterized in that It also includes a storage management module, which integrates the encryption and decryption service interface of the cloud platform with the data system, encrypts the data using the SM4 algorithm when storing the data in the data system, and realizes storage confidentiality protection.

10. A data security protection device according to claim 6, characterized in that the storage When storing data, the management module calls the integrity check service and uses the HMAC-SM3 algorithm to perform hash integrity check on the data to verify the integrity requirements of business data storage.

Images