Database security and confidentiality system based on storage encryption

Abstract

The present invention discloses a database security and confidentiality system based on storage encryption, relates to the field of information security technology, and includes a database encryption platform, wherein the database encryption platform is communicatively connected with a key management module, an encryption and decryption management module, a performance monitoring module, a burden assessment module, a distributed storage optimization module, an early warning analysis module, and an audit log module. The present invention combines the burden assessment of encryption and decryption performance and security vulnerability detection through the early warning analysis module, comprehensively analyzes the abnormality of the encryption and decryption process, sets the early warning level, analyzes potential abnormal situations and issues early warning information, so that the system administrator can respond in time, and the pre-positioned risk management strategy enables the system administrator to take corresponding countermeasures before the risk actually occurs, thereby effectively reducing the impact of security threats, and at the same time, can flexibly adjust the countermeasures according to different early warning levels to ensure that resources are reasonably allocated.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a database security and confidentiality system based on storage encryption. Background Art

[0002] With the rapid development of information technology, data leakage incidents occur frequently. Personal privacy, corporate secrets and even national security are facing severe challenges. Malicious intrusion, internal leakage, third-party service risks and other factors may lead to the leakage of sensitive data. Encrypting the data in the database through storage encryption technology to ensure the confidentiality of the data during storage is the main measure to ensure the security and confidentiality of the database. Even if the data is illegally obtained, it cannot be directly interpreted.

[0003] For example, Chinese patent publication number: CN101639882A is a database security and confidentiality system based on storage encryption. The system includes a database encryption server, a database encryption extension component, a secure database access interface and a management tool. The database encryption service system encrypts and decrypts all data in the database security and confidentiality system, and implements security control and management in a centralized manner.

[0004] In the prior art, in order to achieve the encapsulation and isolation of application systems by security functions and realize transparent access of application systems to encrypted data, a secure database access interface is added between the application system and the database management system, the operations between the application system and the database management system are taken over, and then data encryption, access control, auditing and other security processing are performed according to the semantics of the operations. However, the encryption and decryption process will increase the processing burden of the database system, affect the performance of the database, and further limit the functions of the database, resulting in a loss of system performance. Therefore, how to estimate the processing burden generated by the encryption and decryption process and optimize the system performance is a problem we need to solve. To this end, a database security and confidentiality system based on storage encryption is proposed. Summary of the invention

[0005] The purpose of the present invention is to provide a database security and confidentiality system based on storage encryption to solve the problems raised in the above background technology.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] A database security and confidentiality system based on storage encryption includes a database encryption platform, wherein the database encryption platform is communicatively connected with a key management module, an encryption and decryption management module, a performance monitoring module, a burden assessment module, a distributed storage optimization module, an early warning analysis module, and an audit log module, wherein the modules are connected by electrical signals;

[0008] The performance monitoring module is used to monitor the performance of the system, collect performance indicator data related to encryption and decryption operations, and pre-process the collected performance indicator data to provide data support for subsequent burden assessment;

[0009] The burden assessment module uses machine learning technology to analyze performance indicator data in the encryption and decryption process, build a performance burden assessment model, evaluate the impact of encryption and decryption operations on system performance, and divide the burden levels to help identify performance bottlenecks and improve the response speed and stability of the system;

[0010] The distributed storage optimization module is used to adjust resource allocation and optimize data storage layout according to the burden assessment results and the determined burden level, in combination with distributed storage technology, to improve the concurrent processing capability of the system, and to achieve load balancing through technical means of data sharding and replica mechanism, thereby improving the response speed and throughput of the system under high load conditions;

[0011] The warning analysis module is used to combine the burden assessment of encryption and decryption performance and the security vulnerabilities detected, comprehensively analyze the abnormality of the encryption and decryption process, set the warning level, and issue warning information to respond to the impact of abnormal situations and risks, while considering the execution of access control;

[0012] The audit log module is used to record all access and operation records of the database to facilitate post-audit and tracking, provide traceable evidence, support compliance requirements, and help discover potential security threats.

[0013] A further improvement of the technical solution of the present invention is that: the key management module is used to generate, store, distribute, update and revoke the keys required for database encryption;

[0014] Among them, in the key management module, the process of generating, storing, distributing, updating and revoking the keys required for database encryption is:

[0015] Use reliable random number generators and proven security algorithms to create high-strength keys, where the keys are symmetric or asymmetric, supporting keys of different lengths and complexities to meet the needs of different security levels, ensuring that the generated keys are sufficiently complex and random to resist cracking attempts;

[0016] The generated keys are stored in encrypted form in a secure key vault to prevent unauthorized access, and the generated keys are stored with an additional layer of security through physical isolation and access control to prevent the keys from being stolen or tampered with;

[0017] Implement role-based access control strategies, assign appropriate permissions to each user or system, only authorize users or systems to have the permission to access or operate keys, and take authentication and permission management measures to prevent unauthorized access;

[0018] Distribute the key to relevant applications or users through an encrypted transmission protocol based on the user's identity and permissions, ensuring the confidentiality of the key during transmission and preventing it from being intercepted or tampered with by unauthorized parties;

[0019] Update and rotate keys regularly to replace outdated or potentially leaked keys. The update process should ensure that the generation and distribution of new keys do not affect the normal operation of the system to ensure a smooth transition of the system;

[0020] When a key expires, is stolen, or is no longer needed, the key's usage rights are revoked and the key is securely destroyed. The destruction process must ensure that the key cannot be recovered to avoid potential security risks. The revocation process includes updating key storage and notifying related systems to stop using the key.

[0021] Back up keys regularly to prevent key loss due to failure or disaster. Encrypt and store the backed up keys in a secure environment. Implement a key recovery mechanism to deal with key loss or system failure. The key recovery process should strictly verify user identity and record detailed logs of recovery operations.

[0022] A further improvement of the technical solution of the present invention is that: the encryption and decryption management module is used to encrypt the data according to a preset encryption strategy before the application data is written into the database, to ensure that the data exists in ciphertext form during the storage process, to prevent unauthorized access, to protect data privacy, and to decrypt the data before the data is read from the database to the application layer, to restore it to the original plaintext data, to achieve transparent access of the data to the application system, and to ensure that the application can process the data normally;

[0023] Among them, in the encryption and decryption management module, the process of restoring the original plaintext data is:

[0024] In the data encryption phase, the data to be stored is collected, and the corresponding encryption algorithm and key are selected according to the preset symmetric encryption or asymmetric encryption strategy;

[0025] Before writing data into the database, identify the data fields or data sets that need to be encrypted, and use the selected encryption algorithm and key to encrypt the identified data, generate ciphertext, and write the ciphertext into the database to ensure that the data remains encrypted during storage to prevent unauthorized access;

[0026] Record relevant information about encryption operations, including time, operator, and encrypted data identifier, to facilitate future audits and troubleshooting, and monitor the impact of the encryption process on system performance and optimize it when necessary;

[0027] In the data decryption phase, when the application layer needs to access data, it performs normal database query operations, retrieves ciphertext from the database, and identifies the encrypted data fields in the query results;

[0028] Decrypt the encrypted data using the same algorithm and corresponding key as used during encryption to ensure the security of the decryption process and prevent the plaintext data from being exposed in memory or temporary storage. After decryption, restore the ciphertext data to the original plaintext data;

[0029] The decrypted plaintext data is passed to the application layer for processing to ensure that the application can access and process the data normally.

[0030] A further improvement of the technical solution of the present invention is that in the performance monitoring module, the collection and preprocessing process of the performance indicator data is as follows:

[0031] Deploy performance monitoring tools such as Prometheus, Grafana, New Relic, and Datadog to collect raw performance indicator data related to encryption and decryption operations, and obtain operation logs, including timestamps, operation types, and data volume information, for in-depth analysis. Performance indicators include encryption and decryption time, CPU usage, memory usage, throughput, latency, and error rate.

[0032] Preprocess the collected raw performance indicator data, including cleaning and data normalization, and summarize the preprocessed data. Clean the data to remove outliers and noise to ensure data quality. Data normalization converts data from different sources and formats into a unified standard for comparison and analysis;

[0033] Analyze the preprocessed performance indicator data, identify the impact of encryption and decryption operations on system performance, and establish a performance baseline based on historical performance indicator data to determine the benchmark value of each performance indicator for comparison with current performance data to quickly identify performance degradation or anomalies.

[0034] A further improvement of the technical solution of the present invention is that: in the burden assessment module, the process of assessing the degree of influence of encryption and decryption operations on system performance is:

[0035] Extract the preprocessed performance indicator data from the performance monitoring module, label the data, construct a feature data set, and divide the feature data set into a training set and a test set;

[0036] Based on the performance indicator data of the training set combined with the machine learning algorithm of the neural network, a performance burden evaluation model is constructed to evaluate the burden of encryption and decryption operations on the system, and the performance burden evaluation model is tested and evaluated using the test set data;

[0037] Combining the performance burden evaluation model, the preprocessed performance indicator data and the determined benchmark value of each performance indicator, a comprehensive analysis is performed to obtain the performance burden evaluation index, which quantifies the impact trend of encryption and decryption operations on system performance;

[0038] Deploy the trained performance burden assessment model to the production environment, and divide the performance burden into different burden levels based on the performance burden assessment index, namely, light burden level, medium burden level, and heavy burden level, and match the corresponding assessment threshold for each burden level;

[0039] The performance burden assessment model is used to assess the specific impact of encryption and decryption operations on system performance, determine the specific burden level, and identify system performance bottlenecks and high-burden areas based on the assessment results and the determined burden level.

[0040] A further improvement of the technical solution of the present invention is that the calculation formula of the performance burden evaluation index is:

[0041] ;

[0042] ;

[0043] in, is the performance burden assessment index, It is The actual measured value of the performance indicator, It is The benchmark value of the performance indicator, and are the maximum and minimum values ​​of all performance indicator measurements, is the total number of performance indicators, It is The error value of the performance index exceeding the benchmark value is The value increases, indicating that the system performance burden increases. A decrease in value indicates a reduction in the burden on system performance;

[0044] A plurality of the burden levels correspond to a plurality of the evaluation thresholds, wherein the evaluation thresholds include an upper threshold and a lower threshold;

[0045] The plurality of burden levels and the plurality of evaluation thresholds satisfy the following relationship:

[0046] Light burden level ;

[0047] Moderate burden level ;

[0048] Heavy Burden Level ;

[0049] in, is the performance burden evaluation index, The lower threshold corresponding to the moderate burden level and the upper threshold corresponding to the light burden level, The lower threshold corresponding to the severe burden level and the upper threshold corresponding to the moderate burden level.

[0050] A further improvement of the technical solution of the present invention is that in the distributed storage optimization module, the process of adjusting resource allocation is:

[0051] Use the results of the load assessment module to determine the current system load level and performance bottlenecks, and identify storage and resource allocation issues that need to be optimized based on the load assessment results and resource analysis, such as increasing CPU resources, memory, or storage capacity;

[0052] Evaluate the resource usage of the current distributed storage system and dynamically adjust the resource allocation of each node. For high-load nodes, increase resource allocation, and for low-load nodes, appropriately reduce resource allocation to improve overall resource utilization, optimize the layout of data in the distributed storage system, ensure uniform data distribution, and avoid hot spots.

[0053] Data sharding technology is used to divide data into multiple fragments and store them on different nodes. A replication mechanism is also configured to create multiple copies of key data to improve data availability and fault tolerance.

[0054] Use polling, random or minimum number of connections load balancing algorithm to evenly distribute requests to each node, and dynamically adjust the load balancing strategy according to the real-time load of the node to achieve more efficient resource utilization and load balancing.

[0055] A further improvement of the technical solution of the present invention is that in the early warning analysis module, the process of comprehensively analyzing the abnormality of the encryption and decryption processes is:

[0056] Extract the performance indicator data of encryption and decryption operations from the performance monitoring module, scan and detect security vulnerabilities in the system, conduct risk assessment on the detected security vulnerabilities, and determine their degree of harm and scope of impact;

[0057] Combine the encryption and decryption performance burden assessment results and security vulnerability detection results to comprehensively analyze the degree of abnormality in the encryption and decryption process. Based on the performance burden assessment index and security vulnerability detection results, calculate the abnormality warning coefficient and comprehensively analyze the degree of abnormality in the encryption and decryption process.

[0058] Different warning levels are pre-set according to the degree of abnormality, namely low warning level, medium warning level and high warning level, reflecting the degree of risk faced by the system, and matching corresponding warning thresholds for each warning level;

[0059] Real-time monitoring: when the detected anomaly reaches the corresponding warning threshold, the warning level is determined, and the corresponding warning mechanism is triggered to issue a warning message. The warning message includes a description of the abnormal situation, warning level, possible impact, and recommended response measures. The warning information is sent to relevant personnel in a timely manner through email, SMS, and system notification.

[0060] A further improvement of the technical solution of the present invention is that the calculation formula of the abnormal warning coefficient is:

[0061] ;

[0062] ;

[0063] ;

[0064] ;

[0065] in, is the abnormal warning coefficient, It is performance indicators value, yes The average of the values, yes The standard deviation of is the total number of performance indicators, It is The severity value of the security vulnerability. is the number of security vulnerabilities detected, Is the basic severity indicator, reflecting the potential impact of the vulnerability, It is an exploitability indicator, which reflects the difficulty of exploiting the vulnerability. It is an impact indicator, reflecting the impact of the vulnerability on the system. The value increases, indicating that the system abnormality increases. A decrease in value indicates a decrease in system abnormality.

[0066] A further improvement of the technical solution of the present invention is that: the multiple warning levels correspond to multiple warning thresholds, wherein the warning thresholds include an upper threshold and a lower threshold;

[0067] The multiple warning levels and the multiple warning thresholds satisfy the following relationship:

[0068] Low warning level ;

[0069] Medium warning level ;

[0070] High alert level ;

[0071] in, is the abnormal warning coefficient, is the lower threshold corresponding to the medium warning level and the upper threshold corresponding to the low warning level, It is the lower threshold corresponding to the high warning level and the upper threshold corresponding to the medium warning level.

[0072] Due to the adoption of the above technical solution, the present invention has the following technical advances compared with the prior art:

[0073] 1. The present invention provides a database security and confidentiality system based on storage encryption. Through the early warning analysis module, the burden assessment of encryption and decryption performance and security vulnerability detection are combined to comprehensively analyze the abnormality of the encryption and decryption process, and set the early warning level. The potential abnormal situation is analyzed and early warning information is issued, so that the system administrator can respond in time. The proactive risk management strategy enables the system administrator to take corresponding countermeasures before the risk actually occurs, thereby effectively reducing the impact of security threats. At the same time, the response strategy can be flexibly adjusted according to different early warning levels to ensure that resources are reasonably allocated.

[0074] 2. The present invention provides a database security and confidentiality system based on storage encryption. Through the collaborative work of the performance monitoring module and the burden assessment module, the system can monitor and optimize performance in real time, collect performance indicator data related to encryption and decryption operations, and evaluate the impact on performance. Resource allocation and data storage layout are adjusted accordingly. Machine learning technology is used to predict performance trends, identify bottlenecks, and take automated optimization measures. The distributed storage optimization module further improves the system's concurrent processing capabilities, achieves load balancing through data sharding and replica mechanism technical means, and ensures the system's response speed and throughput under high load conditions. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0076] Figure 1 It is a module diagram of the present invention;

[0077] Figure 2 A flow chart for evaluating the impact of encryption and decryption operations on system performance according to the present invention;

[0078] Figure 3 The flowchart of the present invention comprehensively analyzes the abnormality degree of encryption and decryption process. DETAILED DESCRIPTION

[0079] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0080] Embodiment 1, as Figure 1 , Figure 2 As shown, the present invention provides a database security and confidentiality system based on storage encryption, including a database encryption platform, the database encryption platform is communicatively connected with a key management module, an encryption and decryption management module, a performance monitoring module, a burden assessment module, a distributed storage optimization module, an early warning analysis module and an audit log module, wherein the modules are connected by electrical signals;

[0081] The key management module is used to generate, store, distribute, update and revoke the keys required for database encryption, ensure the security and validity of the keys, avoid key leakage or theft, provide a strong key management mechanism, ensure the security of encryption operations, ensure the reliability of data encryption and decryption processes, use reliable random number generators and proven security algorithms to create high-strength keys, where the keys are symmetric keys or asymmetric keys, support keys of different lengths and complexities to meet the needs of different security levels, ensure that the generated keys are complex and random enough to resist cracking attempts, store the generated keys in encrypted form in a secure key library to prevent unauthorized access, and provide an additional security layer to store the generated keys with physical isolation and access control to prevent the keys from being stolen or tampered with, implement role-based access control policies, assign appropriate permissions to each user or system, and only authorize users or systems to have access or operation permissions for keys, and adopt authentication and permission management. Management measures prevent unauthorized access. According to the user's identity and authority, keys are distributed to relevant applications or users through encrypted transmission protocols to ensure the confidentiality of keys during transmission and to ensure that keys are not intercepted or tampered with by unauthorized parties during transmission. Keys are regularly updated and rotated to replace outdated or potentially leaked keys. The update process should ensure that the generation and distribution of new keys do not affect the normal operation of the system to ensure a smooth transition of the system. When keys expire, are stolen or no longer needed, the key usage rights are revoked and they are securely destroyed. The destruction process must ensure that the keys cannot be recovered to avoid potential security risks. The revocation process includes updating key storage and notifying relevant systems to stop using keys. Keys are regularly backed up to prevent key loss due to failures or disasters. Backed-up keys are encrypted and stored in a secure environment. A key recovery mechanism is implemented to deal with key loss or system failures. The key recovery process should strictly verify user identities and record detailed logs of recovery operations.

[0082] The encryption and decryption management module is used to encrypt the data according to the preset encryption strategy before the application data is written to the database, ensure that the data exists in ciphertext during the storage process, prevent unauthorized access, protect data privacy, and decrypt the data before reading it from the database to the application layer, restore it to the original plaintext data, realize transparent access of the data to the application system, and ensure that the application can process the data normally. In the data encryption stage, the data to be stored is collected, and the corresponding encryption algorithm and key are selected according to the preset symmetric encryption or asymmetric encryption strategy. Before the data is written to the database, the data field or data set to be encrypted is identified, and the identified data is encrypted using the selected encryption algorithm and key to generate ciphertext, and the ciphertext is written to the database to ensure data Keep the encryption status during the storage process to prevent unauthorized access, record the relevant information of the encryption operation, including time, operator, and encrypted data identification, for future audit and troubleshooting, and monitor the impact of the encryption process on system performance, and optimize when necessary. In the data decryption stage, when the application layer needs to access the data, perform normal database query operations, retrieve the ciphertext from the database, and identify the encrypted data fields in the query results. Use the same algorithm and corresponding key as used for encryption to decrypt the encrypted data to ensure the security of the decryption process and avoid exposure of plaintext data in memory or temporary storage. After decryption, restore the ciphertext data to the original plaintext data, and pass the decrypted plaintext data to the application layer for processing to ensure that the application can access and process the data normally.

[0083] Performance monitoring module, used to monitor system performance, collect performance indicator data related to encryption and decryption operations, and pre-process the collected performance indicator data to provide data support for subsequent burden assessment, deploy performance monitoring tools (such as Prometheus, Grafana, New Relic, Datadog, etc.), collect raw performance indicator data related to encryption and decryption operations, and obtain operation logs, including timestamps, operation types, and data volume information, for in-depth analysis. Performance indicators include encryption and decryption time, CPU usage, memory usage, throughput, latency, and error rate. The collected raw performance indicator data is pre-processed, including cleaning and data normalization, and the pre-processed data is summarized. The data is cleaned to remove outliers and noise to ensure data quality. Data normalization converts data from different sources and formats into a unified standard for comparison and analysis. The pre-processed performance indicator data is analyzed to identify the impact of encryption and decryption operations on system performance, and a performance baseline is established based on historical performance indicator data. The baseline value of each performance indicator is determined for comparison with current performance data to quickly identify performance degradation or anomalies.

[0084] The burden assessment module uses machine learning technology to analyze the performance indicator data in the encryption and decryption process, build a performance burden assessment model, evaluate the impact of encryption and decryption operations on system performance, and divide the burden levels to help identify performance bottlenecks and improve the response speed and stability of the system. It extracts pre-processed performance indicator data from the performance monitoring module, labels the data, builds a feature data set, and divides the feature data set into a training set and a test set. Based on the performance indicator data of the training set and the machine learning algorithm of the neural network, a performance burden assessment model is built to evaluate the burden of encryption and decryption operations on the system, and the performance burden assessment model is tested and evaluated using the test set data. Combine the performance burden evaluation model, the preprocessed performance indicator data and the determined benchmark value of each performance indicator, and comprehensively analyze to obtain the performance burden evaluation index, quantify the impact trend of encryption and decryption operations on system performance, deploy the trained performance burden evaluation model to the production environment, and divide the performance burden into different burden levels, namely, light burden level, medium burden level and heavy burden level, in combination with the performance burden evaluation index, and match the corresponding evaluation threshold for each burden level. Use the performance burden evaluation model to evaluate the specific impact of encryption and decryption operations on system performance, determine the specific burden level, and identify system performance bottlenecks and high-burden areas based on the evaluation results and the determined burden level.

[0085] Furthermore, the calculation formula of the performance burden evaluation index is:

[0086] ;

[0087] ;

[0088] in, is the performance burden assessment index, It is The actual measured value of the performance indicator, It is The benchmark value of the performance indicator, and are the maximum and minimum values ​​of all performance indicator measurements, is the total number of performance indicators, It is The error value of the performance indicator exceeding the benchmark value is Represents a standardized performance indicator, ranging from 0 to 1, to facilitate comparison between different indicators. It means squaring the standardized value and increasing the weight of the performance index that deviates greatly from the baseline value. It means summing the squared normalized values ​​of all performance indicators and dividing by Normalize to make the index independent of the number of performance indicators, It means taking the logarithm of the error value and further increasing the weight of the larger error. It means calculating the average of the logarithmic sum of all errors, and then subtracting it from 1 to get the comprehensive impact factor of the error. It should be noted that The value range of is 0 to 0, where 0 means that all performance indicators are equal to their baseline values ​​and the system is not burdened; 1 means that the performance indicators deviate greatly from the baseline values ​​and the system is burdened. As the deviation of the performance indicators from the baseline values ​​increases, The value increases, indicating that the system performance burden increases; when the performance index is close to or equal to the benchmark value, A decrease in value indicates a reduction in the burden on system performance;

[0089] Multiple burden levels correspond to multiple assessment thresholds, where the assessment thresholds include an upper threshold and a lower threshold;

[0090] Multiple burden levels and multiple assessment thresholds satisfy the following relationship:

[0091] Light burden level ; System performance is close to ideal, most performance indicators are at or close to the benchmark value, and the system runs smoothly;

[0092] Moderate burden level ; There is a certain burden on system performance, and some performance indicators have large deviations, which may affect user experience and require attention and optimization;

[0093] Heavy Burden Level ; The system performance burden is heavy, most performance indicators deviate significantly from the baseline value, the system may run slowly or unstable, and optimization is urgently needed;

[0094] in, is the performance burden evaluation index, The lower threshold corresponding to the moderate burden level and the upper threshold corresponding to the light burden level, The lower threshold corresponding to the severe burden level and the upper threshold corresponding to the moderate burden level;

[0095] The distributed storage optimization module is used to adjust resource allocation, optimize data storage layout, and improve the system's concurrent processing capabilities based on the burden assessment results and the determined burden level, combined with distributed storage technology. It achieves load balancing through technical means such as data sharding and replication mechanisms, and improves the system's response speed and throughput under high load conditions. The results of the burden assessment module are used to determine the burden level and performance bottleneck of the current system, and based on the burden assessment results and resource analysis, identify storage and resource allocation issues that need to be optimized, such as increasing CPU resources, memory or storage capacity, evaluate the resource usage of the current distributed storage system, and dynamically adjust the resource allocation of each node. , for high-load nodes, increase resource allocation, and for low-load nodes, appropriately reduce resource allocation to improve overall resource utilization, optimize the layout of data in the distributed storage system, ensure uniform data distribution, avoid hot spots, use data sharding technology to divide data into multiple fragments, store them on different nodes, and configure a copy mechanism to create multiple copies of key data to improve data availability and fault tolerance, use polling, random or minimum number of connections load balancing algorithm to evenly distribute requests to each node, and dynamically adjust the load balancing strategy according to the real-time load of the node to achieve more efficient resource utilization and load balancing;

[0096] The early warning analysis module is used to combine the burden assessment of encryption and decryption performance and the security vulnerabilities detected, comprehensively analyze the abnormality of the encryption and decryption process, set the early warning level, and issue early warning information to respond to the impact of abnormal situations and risks, while considering the execution of access control;

[0097] The audit log module is used to record all access and operation records of the database to facilitate post-audit and tracking, provide traceable evidence, support compliance requirements, and help discover potential security threats.

[0098] Embodiment 2, as Figure 3 As shown, based on Example 1, the present invention provides a technical solution: Preferably, in the early warning analysis module, the process of comprehensively analyzing the abnormality of the encryption and decryption processes is:

[0099] Extract the performance index data of encryption and decryption operations from the performance monitoring module, scan and detect security vulnerabilities in the system, conduct risk assessment on the detected security vulnerabilities, determine their degree of harm and scope of impact, combine the encryption and decryption performance burden assessment results and security vulnerability detection results, comprehensively analyze the abnormality of the encryption and decryption process, calculate the abnormality warning coefficient based on the performance burden assessment index and security vulnerability detection results, comprehensively analyze the abnormality of the encryption and decryption process, and pre-set different warning levels according to the degree of abnormality, namely low warning level, medium warning level and high warning level, reflecting the risk level faced by the system, and match the corresponding warning threshold for each warning level, monitor in real time, and when the detected abnormality reaches the corresponding warning threshold, determine the corresponding warning level, trigger the corresponding warning mechanism, and issue a warning message. The warning message contains a description of the abnormal situation, warning level, possible impact and recommended countermeasures. Use email, text message, system notification and multiple methods to send the warning information to relevant personnel in a timely manner;

[0100] Furthermore, the calculation formula of the abnormal warning coefficient is:

[0101] ;

[0102] ;

[0103] ;

[0104] ;

[0105] in, is the abnormal warning coefficient, It is performance indicators value, yes The average of the values, yes The standard deviation of is the total number of performance indicators, It is The severity value of the security vulnerability. is the number of security vulnerabilities detected, Is the basic severity indicator, reflecting the potential impact of the vulnerability, It is an exploitability indicator, which reflects the difficulty of exploiting the vulnerability. It is an impact indicator, reflecting the impact of the vulnerability on the system. The product of provides an indicator that takes into account impact, exploitability, and scope, divided by The purpose is to avoid the final score being too large so as to facilitate comparison with other performance indicators. The root formula is to further reduce the value and make the distribution of severity values ​​more compact to facilitate subsequent logarithmic operations. Indicates that The values ​​are standardized to have zero mean and unit variance to facilitate comparison between different indicators. It means to square the standardized value and increase the deviation from the mean value. The weight of the value, It means summing the squared normalized values ​​of all performance indicators and dividing by Normalize to make the index independent of the number of performance indicators, It means taking the logarithm of the severity value of the security vulnerability and further increasing the weight of the vulnerability with greater severity. It means calculating the average of the logarithm and the severity value of all vulnerabilities, and then subtracting it from 1 to get the comprehensive impact factor of the security vulnerability. It should be noted that The value range is from 0 to 1, where 0 means that all performance indicators are in an ideal state and there are no security vulnerabilities, and the system is normal; 1 means that the performance indicators deviate greatly from the ideal state and there are multiple serious vulnerabilities, and the system is highly abnormal. As the performance indicators deviate from the ideal state and the severity of the security vulnerabilities increases, As the value increases, it means that the system abnormality increases; when the performance index is close to the ideal state and there are fewer security vulnerabilities, A decrease in value indicates a decrease in system abnormality;

[0106] Furthermore, the multiple warning levels correspond to multiple warning thresholds, wherein the warning thresholds include an upper threshold and a lower threshold;

[0107] Multiple warning levels and multiple warning thresholds satisfy the following relationship:

[0108] Low warning level ; The system runs basically normally, but there are some minor performance deviations or security vulnerabilities. It is recommended to conduct regular inspections and optimizations to maintain good system performance and security;

[0109] Medium warning level ; There is a moderate deviation in system performance, or some security vulnerabilities are found, requiring a detailed review of the system to identify performance bottlenecks and security risks, and to take corresponding optimization and repair measures;

[0110] High alert level ; System performance has significantly declined, or there are serious security vulnerabilities, which may affect the normal operation of the system and data security. Immediate action must be taken to perform system maintenance and security reinforcement to prevent potential system failures or security incidents;

[0111] in, is the abnormal warning coefficient, is the lower threshold corresponding to the medium warning level and the upper threshold corresponding to the low warning level, It is the lower threshold corresponding to the high warning level and the upper threshold corresponding to the medium warning level.

[0112] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A database security and confidentiality system based on storage encryption, including a database encryption platform, characterized in that: The database encryption platform is communicatively connected with a key management module, an encryption and decryption management module, a performance monitoring module, a burden assessment module, a distributed storage optimization module, an early warning analysis module, and an audit log module, wherein the modules are electrically connected with each other; The performance monitoring module is used to monitor the performance of the system, collect performance indicator data related to encryption and decryption operations, pre-process the collected performance indicator data, analyze the pre-processed performance indicator data, identify the impact of encryption and decryption operations on system performance, and establish a performance baseline based on historical performance indicator data to determine the baseline value of each performance indicator; The burden assessment module uses machine learning technology to analyze performance indicator data in the encryption and decryption process, builds a performance burden assessment model, assesses the impact of encryption and decryption operations on system performance, and divides the burden levels. In the burden assessment module, the process of assessing the impact of encryption and decryption operations on system performance is as follows: Extract the preprocessed performance indicator data from the performance monitoring module, label the data, construct a feature data set, and divide the feature data set into a training set and a test set; Based on the performance indicator data of the training set combined with the machine learning algorithm of the neural network, a performance burden evaluation model is constructed to evaluate the burden of encryption and decryption operations on the system, and the performance burden evaluation model is tested and evaluated using the test set data; Combining the performance burden evaluation model, the preprocessed performance indicator data and the determined benchmark value of each performance indicator, a comprehensive analysis is performed to obtain the performance burden evaluation index, which quantifies the impact trend of encryption and decryption operations on system performance; Deploy the trained performance burden assessment model to the production environment, and divide the performance burden into different burden levels based on the performance burden assessment index, namely, light burden level, medium burden level, and heavy burden level, and match the corresponding assessment threshold for each burden level; Use the performance burden assessment model to assess the specific impact of encryption and decryption operations on system performance, determine the specific burden level, and identify system performance bottlenecks and high-burden areas based on the assessment results and the determined burden level; The calculation formula of the performance burden evaluation index is: ； ； in, is the performance burden assessment index, It is The actual measured value of the performance indicator, It is The benchmark value of the performance indicator, and are the maximum and minimum values ​​of all performance indicator measurements, is the total number of performance indicators, It is The error value of the performance index exceeding the benchmark value is The value increases, indicating that the system performance burden increases. A decrease in value indicates a reduction in the burden on system performance; The distributed storage optimization module is used to adjust resource allocation based on the burden assessment results and the determined burden level in combination with distributed storage technology; The warning analysis module is used to combine the burden assessment of encryption and decryption performance and the security vulnerabilities detected, comprehensively analyze the abnormality of the encryption and decryption process, set the warning level, and issue warning information; The audit log module is used to record all access and operation records of the database.

2. The database security and confidentiality system based on storage encryption according to claim 1 is characterized in that: The key management module is used to generate, store, distribute, update and revoke the keys required for database encryption; Among them, in the key management module, the process of generating, storing, distributing, updating and revoking the keys required for database encryption is: Creating a key using a random number generator and a proven security algorithm, wherein the key is a symmetric key or an asymmetric key; The generated keys are stored in encrypted form in a secure key vault and stored with an additional layer of security provided by physical isolation and access control measures; Implement role-based access control policies to assign permissions to each user or system; Distribute the key to relevant applications or users through an encrypted transmission protocol based on the user's identity and permissions; Update and rotate keys regularly to replace outdated or potentially leaked keys; When a key expires, is stolen, or is no longer needed, the key's usage rights are revoked and the key is destroyed. The revocation process includes updating key storage and notifying related systems to stop using the key. Back up keys regularly, encrypt and store the backed up keys in a secure environment, implement a key recovery mechanism, and record detailed logs of recovery operations.

3. The database security and confidentiality system based on storage encryption according to claim 2 is characterized in that: The encryption and decryption management module is used to encrypt the application data before writing it into the database, and to decrypt the data before reading it from the database to the application layer; Among them, in the encryption and decryption management module, the process of restoring the original plaintext data is: In the data encryption phase, the data to be stored is collected, and the corresponding encryption algorithm and key are selected according to the preset symmetric encryption or asymmetric encryption strategy; Before writing data into the database, identify the data field or data set to be encrypted, encrypt the identified data using the selected encryption algorithm and key, generate ciphertext, and write the ciphertext into the database; Record relevant information about encryption operations, including time, operator, and encrypted data identification, and monitor the impact of the encryption process on system performance; In the data decryption phase, when the application layer needs to access data, it performs normal database query operations, retrieves ciphertext from the database, and identifies the encrypted data fields in the query results; Decrypt the encrypted data using the same algorithm and corresponding key as used during encryption. After decryption, the ciphertext data is restored to the original plaintext data; The decrypted plaintext data is passed to the application layer for processing.

4. The database security and confidentiality system based on storage encryption according to claim 3 is characterized in that: In the performance monitoring module, the collection and preprocessing process of performance indicator data is as follows: Deploy performance monitoring tools to collect raw performance indicator data related to encryption and decryption operations, and obtain operation logs, including timestamps, operation types, and data volume information. Performance indicators include encryption and decryption time, CPU usage, memory usage, throughput, latency, and error rate. Preprocess the collected raw performance indicator data.

5. The database security and confidentiality system based on storage encryption according to claim 4 is characterized in that: A plurality of the burden levels correspond to a plurality of the evaluation thresholds, wherein the evaluation thresholds include an upper threshold and a lower threshold; The plurality of burden levels and the plurality of evaluation thresholds satisfy the following relationship: Light burden level ; Moderate burden level ; Heavy Burden Level ; in, is the performance burden evaluation index, The lower threshold corresponding to the moderate burden level and the upper threshold corresponding to the light burden level, The lower threshold corresponding to the severe burden level and the upper threshold corresponding to the moderate burden level.

6. The database security and confidentiality system based on storage encryption according to claim 5 is characterized in that: In the distributed storage optimization module, the process of adjusting resource allocation is as follows: Use the results of the load assessment module to determine the current system load level and performance bottlenecks, and identify storage and resource allocation issues that need to be optimized based on the load assessment results and resource analysis; Evaluate the resource usage of the current distributed storage system and dynamically adjust the resource allocation of each node; Use data sharding technology to divide data into multiple fragments, distribute and store them on different nodes, and configure a copy mechanism to create multiple copies of key data; Use polling, random or minimum number of connections load balancing algorithm to evenly distribute requests to each node, and dynamically adjust the load balancing strategy according to the real-time load of the node.

7. The database security and confidentiality system based on storage encryption according to claim 6 is characterized in that: In the early warning analysis module, the process of comprehensively analyzing the abnormality of the encryption and decryption processes is as follows: Extract the performance indicator data of encryption and decryption operations from the performance monitoring module, scan and detect security vulnerabilities in the system, conduct risk assessment on the detected security vulnerabilities, and determine their degree of harm and scope of impact; Combine the encryption and decryption performance burden assessment results and security vulnerability detection results to comprehensively analyze the abnormality of the encryption and decryption process. Based on the performance burden assessment index and security vulnerability detection results, calculate the abnormality warning coefficient and comprehensively analyze the abnormality of the encryption and decryption process. Different warning levels are pre-set according to the degree of abnormality, namely low warning level, medium warning level and high warning level, reflecting the degree of risk faced by the system, and matching corresponding warning thresholds for each warning level; Real-time monitoring: when the detected anomaly reaches the corresponding warning threshold, the warning level is determined, and the corresponding warning mechanism is triggered to issue a warning message. The warning message is sent to relevant personnel in a timely manner through email, SMS, and system notification.

8. The database security and confidentiality system based on storage encryption according to claim 7 is characterized in that: The calculation formula of the abnormal warning coefficient is: ； ； in, is the abnormal warning coefficient, It is performance indicators value, yes The average of the values, yes The standard deviation of is the total number of performance indicators, It is The severity value of the security vulnerability. is the number of security vulnerabilities detected, Is the basic severity indicator, reflecting the potential impact of the vulnerability, It is an exploitability indicator, which reflects the difficulty of exploiting the vulnerability. It is an impact indicator, reflecting the impact of the vulnerability on the system. The value increases, indicating that the system abnormality increases. A decrease in value indicates a decrease in system abnormality.

9. The database security and confidentiality system based on storage encryption according to claim 8 is characterized in that: A plurality of the warning levels correspond to a plurality of the warning thresholds, wherein the warning thresholds include an upper threshold and a lower threshold; The multiple warning levels and the multiple warning thresholds satisfy the following relationship: Low warning level ; Medium warning level ; High alert level ; in, is the abnormal warning coefficient, is the lower threshold corresponding to the medium warning level and the upper threshold corresponding to the low warning level, It is the lower threshold corresponding to the high warning level and the upper threshold corresponding to the medium warning level.

Images