Data protection method and protection system in cloud computing environment

Abstract

The invention provides a data protection method and system in a cloud computing environment, and relates to the technical field of cloud computing, the protection method comprises the following steps: receiving a cloud hard disk application and to-be-stored data sent by a user side, and generating a logic disk according to the cloud hard disk application; classifying the to-be-stored data by using a pre-trained classification model, and generating first encryption strength according to a classification result; second encryption strength is calculated according to the data activeness of the to-be-stored data; performing weighted fusion on the first encryption strength and the second encryption strength to obtain a third reinforcement density, and setting encryption parameters according to the third reinforcement density, the encryption parameters including an encryption algorithm and a key length; the to-be-stored data is encrypted based on the encryption parameters and written into the physical disk corresponding to the logic disk, dynamic and flexible encryption of the data can be achieved, the encryption strategy can be automatically adjusted according to the actual situation of the data, and therefore the data protection effect and efficiency are improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a data protection method and a protection system in a cloud computing environment. Background Art

[0002] With the rapid development of cloud computing technology, cloud storage, as an efficient and flexible data storage solution, has been widely used in enterprises, individuals and all walks of life. However, data protection issues in cloud computing environments have become increasingly prominent, and how to ensure the security, integrity and privacy of data stored in the cloud has become a key issue that needs to be addressed.

[0003] Traditional data protection methods often use a single encryption method, such as fixed encryption algorithms and key lengths, which are difficult to adapt to the diversity and dynamics of data in cloud computing environments. On the one hand, different types of data have different sensitivities and values, requiring encryption protection of different strengths; on the other hand, the frequency of data use and update (i.e., data activity) also directly affects the security needs of data. Data that is accessed and updated frequently may require stricter encryption measures to prevent unauthorized access and tampering.

[0004] Therefore, it is necessary to provide a data protection method and protection system in a cloud computing environment to solve the above technical problems. Summary of the invention

[0005] In order to solve the above technical problems, the present invention provides a data protection method and protection system in a cloud computing environment, which can not only realize dynamic and flexible encryption of data, but also automatically adjust the encryption strategy according to the actual situation of the data, thereby improving the effect and efficiency of data protection.

[0006] The present invention provides a data protection method in a cloud computing environment, the protection method comprising the following steps:

[0007] Receive a cloud hard disk application and data to be stored from a user, and generate a logical disk according to the cloud hard disk application;

[0008] Using a pre-trained classification model to classify the data to be stored, and generating a first encryption strength based on the classification result;

[0009] Calculating a second encryption strength according to the data activity of the data to be stored;

[0010] Performing weighted fusion on the first encryption strength and the second encryption strength to obtain a third enhancement density, and setting encryption parameters according to the third enhancement density, wherein the encryption parameters include an encryption algorithm and a key length;

[0011] The data to be stored is encrypted based on the encryption parameter and written into a physical disk corresponding to the logical disk.

[0012] Preferably, the receiving of a cloud hard disk application and data to be stored from a user terminal, and generating a logical disk according to the cloud hard disk application, includes:

[0013] Receive and parse the cloud hard disk application request and the data to be stored from the user, and obtain the request parameters, wherein the request parameters include the cloud hard disk size, performance requirements and data protection level specified by the user;

[0014] Allocating physical storage resources in the cloud storage system according to the request parameters;

[0015] According to the allocated physical storage resources, at least one logical disk is created in the cloud platform using virtualization technology, and each logical disk is mapped to at least one corresponding physical disk.

[0016] Preferably, the method of using a pre-trained classification model to classify the data to be stored and generating a first encryption strength based on the classification result includes:

[0017] Extracting data features of the data to be stored, and inputting the data features into a pre-trained classification model to obtain category probabilities, wherein the classification model is a neural network model trained based on a data set containing multiple types of data;

[0018] Determining the category of the data to be stored based on the category probability;

[0019] According to a pre-constructed first mapping table, a first encryption strength of the data to be stored is searched and determined, wherein the first mapping table contains a correspondence between different data categories and encryption strengths.

[0020] Preferably, the step of calculating the second encryption strength according to the data activity of the data to be stored includes:

[0021] Obtaining a data activity level according to a historical access frequency and a historical update frequency of the data to be stored;

[0022] Based on a preset second mapping table, the data activity level is converted into a second encryption strength, wherein the second mapping table contains a correspondence between different data activity levels and encryption strengths.

[0023] Preferably, performing weighted fusion on the first encryption strength and the second encryption strength to obtain a third enhancement density, and setting encryption parameters according to the third enhancement density includes:

[0024] Determine a first weight and a second weight of the first encryption strength and the second encryption strength respectively according to the category of the data to be stored and the data activity level;

[0025] Performing weighted fusion on the first encryption strength and the second encryption strength based on the first weight and the second weight to obtain a third enhancement density;

[0026] Based on a preset third mapping table, the encryption algorithm and key length of the data to be stored are determined according to the third enhancement density, wherein the third mapping table includes a correspondence between different enhancement densities and encryption parameters.

[0027] Preferably, the determining the first weight and the second weight of the first encryption strength and the second encryption strength respectively according to the category of the data to be stored and the data activity level includes:

[0028] Searching a pre-constructed first mapping table, and determining a first initial weight of the first encryption strength according to the category of the data to be stored;

[0029] Searching a preset second mapping table, and determining a second initial weight of the second encryption strength according to the data activity level of the data to be stored;

[0030] The first initial weight and the second initial weight are normalized to obtain a first weight and a second weight.

[0031] Preferably, encrypting the data to be stored based on the encryption parameter and writing it into a physical disk corresponding to the logical disk includes:

[0032] Generate an encryption key according to the key length corresponding to the third enhanced density, and encrypt the data to be stored using the encryption algorithm and the encryption key;

[0033] The encrypted data to be stored is dispersedly stored in at least one physical disk corresponding to the logical disk.

[0034] The present invention also provides a data protection system in a cloud computing environment, which is used to execute a data protection method in a cloud computing environment. The protection system includes:

[0035] The application and generation module is used to receive the cloud hard disk application and the data to be stored from the user end, and generate a logical disk according to the cloud hard disk application;

[0036] A classification and encryption module, used to classify the data to be stored using a pre-trained classification model, and generate a first encryption strength based on the classification result;

[0037] An activity analysis module, configured to calculate a second encryption strength according to the data activity of the data to be stored;

[0038] a fusion and setting module, configured to perform weighted fusion on the first encryption strength and the second encryption strength to obtain a third enhancement density, and set encryption parameters according to the third enhancement density, wherein the encryption parameters include an encryption algorithm and a key length;

[0039] The encryption and writing module is used to encrypt the data to be stored based on the encryption parameters and write the data into the physical disk corresponding to the logical disk.

[0040] Compared with the related art, the data protection method and protection system in a cloud computing environment provided by the present invention have the following beneficial effects:

[0041] The present invention receives a cloud hard disk application and data to be stored from a user terminal, and generates a logical disk according to the cloud hard disk application; uses a pre-trained classification model to classify the data to be stored, and calculates a first encryption strength and a second encryption strength according to the classification result and the data activity; then weightedly fuses the two to obtain a third enhanced density, and sets encryption parameters accordingly; finally, based on the encryption parameters, encrypts the data to be stored and writes it to a physical disk corresponding to the logical disk; this method can not only realize dynamic and flexible encryption of data, but also automatically adjust the encryption strategy according to the actual situation of the data, thereby improving the effect and efficiency of data protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A flow chart of a data protection method in a cloud computing environment provided by the present invention;

[0043] Figure 2 A module structure diagram of a data protection system in a cloud computing environment provided by the present invention. DETAILED DESCRIPTION

[0044] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only the parts related to the present invention, rather than all structures, are shown in the accompanying drawings. In addition, the embodiments of the present invention and the features in the embodiments may be combined with each other without conflict.

[0045] It should also be noted that, for ease of description, only the part relevant to the present invention but not all the content is shown in the accompanying drawings. It should be mentioned before discussing the exemplary embodiments in more detail that some exemplary embodiments are described as the processing or method described as a flow chart. Although the flow chart describes each operation (or step) as being processed sequentially, many operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of each operation can be rearranged. When its operation is completed, the processing can be terminated, but it can also have additional steps not included in the accompanying drawings. The processing can correspond to a method, a function, a procedure, a subroutine, a subprogram, etc.

[0046] Embodiment 1

[0047] The present invention provides a data protection method in a cloud computing environment, the protection method comprising the following steps:

[0048] S1: receiving a cloud hard disk application and data to be stored from a user, and generating a logical disk according to the cloud hard disk application.

[0049] Specifically, step S1 includes the following steps:

[0050] S11: receiving and parsing a cloud hard disk application request and data to be stored from a user, and obtaining request parameters, wherein the request parameters include a cloud hard disk size, performance requirements, and data protection level specified by the user.

[0051] In a cloud computing environment, users need to apply for cloud disk resources from cloud service providers to store data. When applying, users provide a series of parameters, including the required cloud disk size, performance requirements (such as IOPS, throughput, etc.), and data protection level (such as RAID level). These parameters are crucial for subsequent resource allocation and logical disk creation.

[0052] When working, the front-end system of the cloud service provider receives a cloud hard disk application request from the user, which contains relevant information about the cloud hard disk that the user wants to create; the back-end system parses the received request and extracts key parameters such as the cloud hard disk size, performance requirements and data protection level specified by the user; the parsed parameters are verified to ensure that they conform to the expected format and range, so as to correctly allocate physical storage resources later.

[0053] By carefully parsing and verifying the received cloud hard disk application requests, it ensures that the key parameters required in the cloud hard disk creation process are obtained correctly, thereby improving the accuracy and reliability of logical disk creation.

[0054] S12: Allocate physical storage resources in the cloud storage system according to the request parameters.

[0055] After receiving and verifying the user's application request, the cloud service provider needs to allocate the corresponding physical storage resources in the cloud storage system according to the parameters specified by the user. These resources will be used to create logical disks and ensure that the user's data can be stored according to the specified performance requirements.

[0056] When working, query the available physical storage resources in the current cloud storage system to ensure that there is enough space and performance to meet the user's request; allocate the corresponding physical storage space according to the user's cloud hard disk size, performance requirements and data protection level, and reserve sufficient capacity to meet possible future growth needs.

[0057] In addition, information about the allocated physical storage resources is recorded for subsequent management and tracking.

[0058] This step ensures that the cloud hard disk requested by the user can be met in terms of performance and capacity through effective allocation of physical storage resources, and also provides the necessary physical foundation for subsequent logical disk creation.

[0059] S13: at least one logical disk is created in the cloud platform using virtualization technology according to the allocated physical storage resources, and each logical disk is mapped to at least one corresponding physical disk.

[0060] After allocating physical storage resources, cloud service providers need to use virtualization technology to create logical disks in the cloud platform. Logical disks are user-visible storage devices that are virtualized from the space on multiple physical disks and can provide better flexibility and reliability.

[0061] When working, virtualization technology is used to create logical disks based on the allocated physical storage resources, where the size and performance of the logical disks meet the requirements specified by the user when applying; each logical disk is mapped to at least one corresponding physical disk to ensure that the distribution and redundancy of data achieve the expected data protection level; after creation, the logical disk is initialized to make it ready to receive user data.

[0062] This step creates a logical disk through virtualization technology and maps it to a physical disk, achieving efficient management and utilization of storage resources while also providing users with a reliable and easy-to-manage storage solution.

[0063] S2: Classify the data to be stored using a pre-trained classification model, and generate a first encryption strength based on the classification result.

[0064] Specifically, step S2 includes the following steps:

[0065] S21: extracting data features of the data to be stored, and inputting the data features into a pre-trained classification model to obtain category probabilities, wherein the classification model is a neural network model trained based on a data set containing multiple types of data.

[0066] In a cloud computing environment, in order to improve data security, it is necessary to determine the appropriate encryption strength based on the different characteristics of the data. To this end, the data must first be classified to distinguish the sensitivity of different types of data. This step relies on a pre-trained classification model that can identify different features of the data and classify it accordingly.

[0067] When working, important features are extracted from the data to be stored, including keywords, file type, file size, and data format; the extracted data features are input into a pre-trained classification model, which is usually a neural network model trained based on a large number of labeled data sets and can effectively identify data of different categories; the model outputs the probability distribution of each category, and these probability values ​​reflect the possibility of the data belonging to a certain category.

[0068] By extracting data features and inputting them into pre-trained classification models, the probability distribution of data belonging to different categories can be obtained, providing a basis for further classification and encryption strength determination.

[0069] S22: Determine the category of the data to be stored based on the category probability.

[0070] In this embodiment, after the probability distribution of each category is obtained, the actual category of the data to be stored needs to be determined according to these probability values. This is a key step in the classification process, because the subsequent encryption strength determination will be based on the determined data category.

[0071] When working, the category with the highest probability is selected as the main category of the data to be stored; if the highest probability value exceeds a certain threshold (for example, more than 50%), the classification result is considered credible; otherwise, further manual review or retraining of the model may be required.

[0072] By determining the data category based on category probability, the accuracy of classification is ensured, providing a reliable basis for subsequent encryption strength determination.

[0073] S23: According to a pre-constructed first mapping table, searching and determining a first encryption strength of the data to be stored, wherein the first mapping table contains a correspondence between different data categories and encryption strengths.

[0074] In this embodiment, after determining the data category, the next step is to determine the first encryption strength based on a pre-constructed first mapping table. The first mapping table defines the correspondence between different data categories and encryption strengths to ensure that data of different sensitivities are protected with appropriate encryption strengths.

[0075] During operation, the encryption strength corresponding to the determined data category is searched in the pre-constructed first mapping table; and the first encryption strength of the data to be stored is determined according to the corresponding relationship in the mapping table.

[0076] Through the pre-built first mapping table, the appropriate encryption strength can be automatically determined according to the data category, thereby ensuring that the data is protected at an appropriate level when stored.

[0077] S3: Calculate a second encryption strength according to the data activity of the data to be stored.

[0078] Specifically, step S3 includes the following steps:

[0079] S31: Obtaining a data activity level according to the historical access frequency and the historical update frequency of the data to be stored.

[0080] In the cloud computing environment, data activity is another important factor in measuring the importance and sensitivity of data. Highly active data usually means higher access and update frequencies, and such data often requires higher security protection. Therefore, it is necessary to determine the activity level of the data based on its historical access frequency and historical update frequency.

[0081] When working, collect the access records of the data to be stored in the past period of time, including the number of accesses, access time and other information, and calculate the access frequency of the data based on the collected access records. The access frequency can be calculated by dividing the number of accesses by the time span;

[0082] Similarly, the update records of the data to be stored in the past period of time are collected, including the number of updates, update time and other information, and the update frequency of the data is calculated based on the collected update records. The update frequency can be calculated by dividing the number of updates by the time span.

[0083] The activity level of the data is comprehensively evaluated based on the access frequency and update frequency. The activity level is divided into multiple levels including but not limited to high, medium, and low.

[0084] By calculating the historical access frequency and update frequency of the data, the activity level of the data can be accurately assessed, thus providing a basis for the subsequent determination of encryption strength.

[0085] S32: Based on a preset second mapping table, convert the data activity level into a second encryption strength, wherein the second mapping table includes a correspondence between different data activity levels and encryption strengths.

[0086] In this embodiment, after determining the activity level of the data, it is necessary to convert the activity level into a second encryption strength according to a preset second mapping table. The second mapping table defines the correspondence between different activity levels and encryption strengths, ensuring that data with high activity is protected by encryption with higher strength.

[0087] When working, the encryption strength corresponding to the determined data activity level is searched in the preset second mapping table; the second encryption strength of the data to be stored is determined according to the corresponding relationship in the mapping table; the determined second encryption strength is recorded for subsequent weighted fusion processing.

[0088] Through the preset second mapping table, the appropriate encryption strength can be automatically determined according to the activity level of the data, thereby ensuring that data with high activity is fully protected.

[0089] S4: Perform weighted fusion on the first encryption strength and the second encryption strength to obtain a third enhancement density, and set encryption parameters according to the third enhancement density, wherein the encryption parameters include an encryption algorithm and a key length.

[0090] Specifically, step S4 includes the following steps:

[0091] S41: Determine a first weight and a second weight of the first encryption strength and the second encryption strength respectively according to the category of the data to be stored and the data activity level.

[0092] Wherein, step S41 includes the following steps:

[0093] S41a: Searching a pre-constructed first mapping table, and determining a first initial weight of the first encryption strength according to the category of the data to be stored.

[0094] After determining the category of the data to be stored, it is necessary to determine the first initial weight of the first encryption strength according to the category. This weight reflects the importance of the data category in determining the final encryption strength. The pre-constructed first mapping table contains the correspondence between different data categories and encryption strengths.

[0095] During operation, the category to which the data to be stored belongs is found according to the pre-constructed first mapping table, and the first initial weight of the first encryption strength is determined according to the encryption strength of the category in the mapping table. This weight represents the importance of the data category in the final encryption strength.

[0096] By searching the pre-constructed first mapping table, the first initial weight can be automatically determined according to the data category, ensuring that the influence of the data category on the final encryption strength is reasonably reflected.

[0097] S41b: Searching a preset second mapping table, and determining a second initial weight of the second encryption strength according to the data activity level of the data to be stored.

[0098] In this embodiment, after the data activity level is determined, a second initial weight of the second encryption strength needs to be determined according to the activity level. This weight reflects the importance of data activity in determining the final encryption strength. The preset second mapping table contains the correspondence between different data activity levels and encryption strengths.

[0099] During operation, the data activity level of the data to be stored is found according to the preset second mapping table, and the second initial weight of the second encryption strength is determined according to the encryption strength of the activity level in the mapping table. This weight represents the importance of the data activity in the final encryption strength.

[0100] By searching the preset second mapping table, the second initial weight can be automatically determined according to the data activity level, ensuring that the impact of the data activity on the final encryption strength is reasonably reflected.

[0101] S41c: Normalize the first initial weight and the second initial weight to obtain a first weight and a second weight.

[0102] In this embodiment, after the first initial weight and the second initial weight are determined, the two initial weights need to be normalized so that their sum is equal to 1. The normalization process is to ensure that in the subsequent weighted fusion process, the two weights can reasonably reflect their respective importance and will not cause deviation due to numerical differences.

[0103] When working, the sum of the first initial weight and the second initial weight is calculated, and the first initial weight and the second initial weight are divided by the sum respectively to obtain the normalized first weight and the second weight.

[0104] By normalizing the first initial weight and the second initial weight, it is ensured that the sum of the two weights is 1, so that the importance of each weight can be fairly reflected during weighted fusion, avoiding the deviation caused by the difference in the size of the initial weights.

[0105] S42: Perform weighted fusion on the first encryption strength and the second encryption strength based on the first weight and the second weight to obtain a third enhancement density.

[0106] In the data protection process, the first encryption strength is based on the data category, while the second encryption strength is based on the data activity. In order to comprehensively consider these two factors, they need to be weighted and integrated to obtain a comprehensive encryption strength - the third enhanced density. This ensures that when storing data, both the importance of its category and the impact of its activity are taken into account.

[0107] During operation, the first encryption strength and the second encryption strength are weightedly fused using the first weight and the second weight according to the first initial weight and the second initial weight determined in step S41 and the first weight and the second weight obtained after normalization.

[0108] Through weighted fusion, the first encryption strength and the second encryption strength are combined to obtain a comprehensive encryption strength that can reflect the data category and activity, thereby ensuring that the encryption strategy takes into account both the importance of the data and its activity.

[0109] S43: Based on a preset third mapping table, determine the encryption algorithm and key length of the data to be stored according to the third enhancement density, wherein the third mapping table includes a correspondence between different enhancement densities and encryption parameters.

[0110] In this embodiment, after the third enhanced density is obtained, specific encryption parameters, including encryption algorithm and key length, need to be determined according to the comprehensive encryption strength. This step is completed by a preset third mapping table, ensuring that the selection of encryption parameters matches the third enhanced density, thereby achieving the best data protection effect.

[0111] When working, the encryption parameters corresponding to the third enhancement density are searched in the preset third mapping table, the encryption algorithm and key length of the data to be stored are determined according to the corresponding relationship in the third mapping table, and the determined encryption algorithm and key length are configured as the encryption parameters to be used.

[0112] Through the preset third mapping table, the appropriate encryption algorithm and key length can be automatically determined according to the third reinforcement density to ensure that the data is properly protected when stored. This mechanism enables the encryption strategy to adapt to both the sensitivity of the data and the changes in its activity.

[0113] S5: Encrypt the data to be stored based on the encryption parameter, and write the data into the physical disk corresponding to the logical disk.

[0114] Specifically, step S5 includes the following steps:

[0115] S51: Generate an encryption key according to the key length corresponding to the third enhanced density, and use the encryption algorithm and the encryption key to encrypt the data to be stored.

[0116] In this embodiment, after the encryption parameters (including encryption algorithm and key length) are determined, the data to be stored needs to be encrypted according to these parameters. Encryption is one of the important means to protect data security. By using a suitable encryption algorithm and key length, it can be ensured that the data will not be easily accessed by unauthorized persons during the storage process.

[0117] When working, the corresponding encryption key is generated according to the key length determined by the third enhanced density. The third enhanced density determines the strength of encryption, and thus determines the length of the key. The encryption key is generated using the key generation mechanism supported by the encryption algorithm. The key must be long enough and random to ensure the security of encryption. According to the encryption algorithm determined by the third enhanced density, a suitable encryption algorithm is selected for data encryption, including but not limited to AES (Advanced Encryption Standard) and RSA (Public Key Encryption Algorithm). The selected encryption algorithm and the generated encryption key are used to encrypt the data to be stored. The encryption process converts plaintext data into ciphertext data to ensure that the data is not easily cracked during transmission and storage.

[0118] By using encryption algorithms and keys to encrypt data, the security of data during storage is ensured. The length of the encryption key is associated with the third reinforcement density, so that the encryption strength can adapt to the importance and sensitivity of different data.

[0119] S52: Distribute and store the encrypted data to be stored in at least one physical disk corresponding to the logical disk.

[0120] The encrypted data needs to be stored securely. In order to improve the reliability and availability of data, the data is usually stored in multiple physical disks. This not only prevents single point failures, but also improves the performance of data reading and writing.

[0121] When working, the encrypted data is divided into multiple data blocks for dispersed storage. According to the configuration of the logical disk, at least one physical disk corresponding to the logical disk is selected as the storage location, and the encrypted data blocks are dispersedly stored in the selected physical disks. Each data block will be written to a different physical disk to ensure the distribution and redundancy of the data, and the specific storage location of each data block on the physical disk is recorded for subsequent reading and management.

[0122] By distributing the encrypted data across multiple physical disks, data reliability and availability are improved. Even if a physical disk fails, the data can still be found on other disks, thus ensuring the overall security of the data.

[0123] The working principle of a data protection method in a cloud computing environment provided by the present invention is as follows:

[0124] The user sends a cloud hard disk request to the cloud platform through the user terminal, including the specified cloud hard disk size, performance requirements and data protection level. After receiving and parsing these request parameters, the cloud platform allocates the corresponding physical storage resources in the cloud storage system. Subsequently, virtualization technology is used to create logical disks in the cloud platform, and each logical disk is mapped to at least one physical disk, forming a mapping relationship between logical and physical storage.

[0125] For the data to be stored, firstly extract its data features and input these features into a pre-trained classification model. The classification model is trained based on a data set containing multiple types of data and can output the probability that the data to be stored belongs to each category. After determining the specific category of the data according to the category probability, the first encryption strength corresponding to the category data is determined by searching the pre-constructed first mapping table.

[0126] In order to more carefully reflect the security requirements of the data, the data activity level is evaluated according to the historical access frequency and historical update frequency of the data to be stored. Based on the preset second mapping table, the activity level is converted into the second encryption strength. This step takes into account the dynamic use of the data, so that the encryption strength can be adjusted as the data activity changes.

[0127] Next, the weights of the first encryption strength and the second encryption strength are determined according to the data category and the data activity level. Through normalization, the sum of the two weights is ensured to be 1. Then, the first encryption strength and the second encryption strength are weighted and fused based on the two weights to obtain a third enhanced density. Finally, according to the preset third mapping table, the third enhanced density is converted into a specific encryption algorithm and key length to complete the setting of encryption parameters.

[0128] The encryption algorithm and key length corresponding to the third enhanced density are used to encrypt the data to be stored. The encrypted data is dispersedly stored in at least one physical disk corresponding to the logical disk, realizing physically dispersed storage of data and further improving data security.

[0129] In summary, this method provides a flexible and efficient protection mechanism for data in a cloud computing environment by intelligently combining data classification, activity assessment, and encryption strength fusion, ensuring the security and compliance of data in different usage scenarios.

[0130] Embodiment 2

[0131] The present invention also provides a data protection system in a cloud computing environment, which is used to execute a data protection method in a cloud computing environment. Figure 2 As shown, the protection system comprises:

[0132] The application and generation module 100 is used to receive a cloud hard disk application and data to be stored from a user terminal, and generate a logical disk according to the cloud hard disk application.

[0133] The classification and encryption module 200 is used to classify the data to be stored using a pre-trained classification model, and generate a first encryption strength based on the classification result.

[0134] The activity analysis module 300 is used to calculate the second encryption strength according to the data activity of the data to be stored.

[0135] The fusion and setting module 400 is used to perform weighted fusion on the first encryption strength and the second encryption strength to obtain a third enhancement density, and set encryption parameters according to the third enhancement density, wherein the encryption parameters include an encryption algorithm and a key length.

[0136] The encryption and writing module 500 is used to encrypt the data to be stored based on the encryption parameters and write the data into the physical disk corresponding to the logical disk.

[0137] The present application is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0138] A person skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0139] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device that includes a series of elements includes not only those elements, but also other elements that are not explicitly listed, or includes elements that are inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device that includes the elements.

Claims

1. A data protection method in a cloud computing environment, characterized in that: The protection method comprises the following steps: Receive a cloud hard disk application and data to be stored from a user, and generate a logical disk according to the cloud hard disk application; Using a pre-trained classification model to classify the data to be stored, and generating a first encryption strength based on the classification result; Calculating a second encryption strength according to the data activity of the data to be stored; Performing weighted fusion on the first encryption strength and the second encryption strength to obtain a third enhancement density, and setting encryption parameters according to the third enhancement density, wherein the encryption parameters include an encryption algorithm and a key length; The data to be stored is encrypted based on the encryption parameter and written into a physical disk corresponding to the logical disk.

2. The data protection method in a cloud computing environment according to claim 1, characterized in that: The receiving of a cloud hard disk application and data to be stored from a user terminal, and generating a logical disk according to the cloud hard disk application, includes: Receive and parse the cloud hard disk application request and the data to be stored from the user, and obtain the request parameters, wherein the request parameters include the cloud hard disk size, performance requirements and data protection level specified by the user; Allocating physical storage resources in the cloud storage system according to the request parameters; According to the allocated physical storage resources, at least one logical disk is created in the cloud platform using virtualization technology, and each logical disk is mapped to at least one corresponding physical disk.

3. The data protection method in a cloud computing environment according to claim 2, characterized in that: The method of using a pre-trained classification model to classify the data to be stored and generating a first encryption strength based on the classification result includes: Extracting data features of the data to be stored, and inputting the data features into a pre-trained classification model to obtain category probabilities, wherein the classification model is a neural network model trained based on a data set containing multiple types of data; Determining the category of the data to be stored based on the category probability; According to a pre-constructed first mapping table, a first encryption strength of the data to be stored is searched and determined, wherein the first mapping table contains a correspondence between different data categories and encryption strengths.

4. The data protection method in a cloud computing environment according to claim 3, characterized in that: The calculating the second encryption strength according to the data activity of the data to be stored includes: Obtaining a data activity level according to a historical access frequency and a historical update frequency of the data to be stored; Based on a preset second mapping table, the data activity level is converted into a second encryption strength, wherein the second mapping table contains a correspondence between different data activity levels and encryption strengths.

5. The data protection method in a cloud computing environment according to claim 4, characterized in that: The step of weighting and fusing the first encryption strength and the second encryption strength to obtain a third enhancement density, and setting encryption parameters according to the third enhancement density includes: Determine a first weight and a second weight of the first encryption strength and the second encryption strength respectively according to the category of the data to be stored and the data activity level; Performing weighted fusion on the first encryption strength and the second encryption strength based on the first weight and the second weight to obtain a third enhancement density; Based on a preset third mapping table, the encryption algorithm and key length of the data to be stored are determined according to the third enhancement density, wherein the third mapping table contains a correspondence between different enhancement densities and encryption parameters.

6. The data protection method in a cloud computing environment according to claim 5, characterized in that: The determining the first weight and the second weight of the first encryption strength and the second encryption strength respectively according to the category of the data to be stored and the data activity level includes: Searching a pre-constructed first mapping table, and determining a first initial weight of the first encryption strength according to the category of the data to be stored; Searching a preset second mapping table, and determining a second initial weight of the second encryption strength according to the data activity level of the data to be stored; The first initial weight and the second initial weight are normalized to obtain a first weight and a second weight.

7. The data protection method in a cloud computing environment according to claim 6, characterized in that: The step of encrypting the data to be stored based on the encryption parameter and writing the data to a physical disk corresponding to the logical disk includes: Generate an encryption key according to the key length corresponding to the third enhanced density, and encrypt the data to be stored using the encryption algorithm and the encryption key; The encrypted data to be stored is dispersedly stored in at least one physical disk corresponding to the logical disk.

8. A data protection system in a cloud computing environment, used to execute a data protection method in a cloud computing environment as claimed in any one of claims 1 to 7, characterized in that: The protection system comprises: The application and generation module is used to receive the cloud hard disk application and the data to be stored from the user end, and generate a logical disk according to the cloud hard disk application; A classification and encryption module, used to classify the data to be stored using a pre-trained classification model, and generate a first encryption strength based on the classification result; An activity analysis module, configured to calculate a second encryption strength according to the data activity of the data to be stored; a fusion and setting module, configured to perform weighted fusion on the first encryption strength and the second encryption strength to obtain a third enhancement density, and set encryption parameters according to the third enhancement density, wherein the encryption parameters include an encryption algorithm and a key length; The encryption and writing module is used to encrypt the data to be stored based on the encryption parameters and write the data into the physical disk corresponding to the logical disk.

Images