A data encryption storage system for Internet security

Abstract

The present invention belongs to the technical field of data encryption storage, and discloses a data encryption storage system for Internet security; the method comprises: constructing a distributed storage network, and collecting Internet data to be encrypted; dynamically dividing the Internet data to be encrypted into a plurality of data blocks; encrypting each data block to obtain a corresponding encrypted data block; combining all the encrypted data blocks into an encrypted data stream; and allocating an optimal transmission path and an optimal storage position for the encrypted data stream in the distributed storage network, so as to improve the security of data transmission and storage.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption storage, and more specifically, to a data encryption storage system oriented to Internet security. Background Art

[0002] A patent application with application publication number CN114817962A discloses an industrial Internet data encryption storage system, which relates to the field of data storage technology, including a data classification module, a data transfer module and a storage allocation module; the data classification module is connected to a private cloud, and is used to perform storage level analysis on the industrial Internet data stored in the private cloud. If the storage level value is ≥ the storage threshold, the corresponding industrial Internet data is marked as core data, and encrypted transfer of the corresponding core data is initiated; the data transfer module is used to randomly split the corresponding core data into a corresponding number of data blocks according to the storage level value, and encrypt the corresponding data blocks and store them in a distributed manner in the blockchain module; the blockchain module includes a number of storage blocks, which are used to screen out a corresponding number of storage blocks as selected blocks according to the size of the storage allocation value, and perform distributed storage of the data blocks; effectively reducing the possibility of data blocks being cleared, facilitating other users to query and improving data storage efficiency.

[0003] However, in the current digital age, data storage and transmission technology still exposes many weak links and hidden dangers. First, data faces serious risks of leakage and theft during storage and transmission. Traditional encryption measures can no longer provide effective protection. Once confidential data is captured, it may be cracked and stolen, causing huge losses to enterprises and individuals. Secondly, the existing centralized storage system has huge hidden dangers of single point failure and single point attack. These systems usually store data in a few central nodes. Once a hardware failure or attack occurs, the entire system will be paralyzed, resulting in inaccessible and lost data. Furthermore, the existing technology also has obvious deficiencies in data backup and fault tolerance. Although simple data redundancy backup is adopted, the number and distribution of backup copies are relatively limited, which cannot fully cope with various abnormal situations. Once a serious failure occurs, it may still cause complete loss of data. In addition, the existing technology is also relatively backward in the selection of data transmission paths. Traditional routing algorithms are usually static or based on simple congestion control, and cannot dynamically adjust the optimal transmission path according to the real-time status of the network, resulting in low data transmission efficiency and serious delays.

[0004] In view of this, the present invention proposes an Internet-oriented data encryption storage system to solve the above problems. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solutions: a data encryption storage system for Internet security, comprising: a network construction module, used to construct a distributed storage network and collect Internet data to be encrypted;

[0006] A data segmentation module is used to dynamically segment the Internet data to be encrypted into several data blocks;

[0007] A data encryption module is used to encrypt each data block to obtain a corresponding encrypted data block;

[0008] A data combining module, used for combining all encrypted data blocks into an encrypted data stream;

[0009] The dynamic storage module is used to allocate the optimal transmission path and the optimal storage location for the encrypted data stream in the distributed storage network; each module is connected by wired and / or wireless means.

[0010] Furthermore, the method of constructing a distributed storage network includes:

[0011] Preliminarily define the number of nodes and the connection relationship between nodes; each node represents an independent storage device or server; and optimize the connection relationship between nodes, that is, add backup connections to the nodes; according to the optimized connection relationship, select any node as the root node, and define the number of child nodes m for each non-leaf node; starting from the root node, create m child nodes for the root node, and these child nodes will serve as non-leaf nodes of the next layer; for each newly created non-leaf node, repeat creating m child nodes for it until the preset network depth is reached; and obtain a distributed storage network.

[0012] Furthermore, the method of adding a backup connection to a node includes:

[0013] The nodes in the distributed storage network are represented as vertices in an undirected connected graph. If there is a direct connection between two nodes in the distributed storage network, an undirected edge is added between the corresponding vertices. A depth-first search or a breadth-first search is performed on the undirected connected graph. During the depth-first search or breadth-first search, the discovery time and the completion time of each vertex are marked. If the completion times of two vertices connected by an undirected edge are not connected after the undirected edge is removed, the undirected edge is defined as an important edge.

[0014] Continue to perform depth-first search or breadth-first search on the undirected connected graph. For each vertex v, calculate the number of vertices that cannot be reached from v, recorded as n_v. If there is an undirected edge connected to vertex v, such that n_v is greater than or equal to 2, then define the corresponding undirected edge as a split edge; for the defined important edges and split edges, set the corresponding number of backup connections.

[0015] Furthermore, the method of setting a corresponding number of backup connections for the defined important edges and split edges includes:

[0016] For important edge e, calculate its importance index , the value range is [0, 1];

[0017] ;in, is the betweenness centrality of the important edge e, is the comprehensive connectivity of important edge e, is the flow of important edge e, is the bandwidth of the important edge e, is the maximum betweenness centrality of all undirected edges in an undirected connected graph, is the maximum flow of all undirected edges in an undirected connected graph, is the maximum bandwidth of all undirected edges in an undirected connected graph;

[0018] The comprehensive connectivity can be obtained by:

[0019] Add source point s and sink point t to the undirected connected graph, and connect all vertices in the undirected connected graph with source point s and sink point t to construct a flow network G'; for all edges in the flow network G' that are not directly connected to source point s and sink point t, set their capacity to 1, and for all edges in the flow network G' that are directly connected to source point s and sink point t, set their capacity to infinity;

[0020] On the flow network G', the network flow algorithm is used to calculate the maximum flow value from the source point s to the sink point t, and the maximum flow value is used as the comprehensive connectivity of the important edge e;

[0021] For important edges e, based on the calculated importance index ,set up backup connections; ;in, Represents the total number of vertices in an undirected connected graph; represents the ceiling function;

[0022] For the split edge q, it is defined that after removing the split edge q, the undirected connected graph is divided into two subgraphs and ; Based on two subgraphs and Calculate its split degree index ;

[0023] ;in, For subgraph The number of vertices, For subgraph The number of vertices; It is the maximum subgraph size difference caused by all split edges in the undirected connected graph; For two subgraphs and The shortest distance between is the maximum distance between any two vertices in an undirected connected graph; and is the weight coefficient, and the sum is 1; for the split edge q, based on the calculated split degree index ,set up backup connections; .

[0024] Furthermore, the method of dynamically dividing the Internet data to be encrypted into a plurality of data blocks includes:

[0025] The Internet data to be encrypted is defined as a binary bit stream of length n; and data features of the Internet data to be encrypted are extracted, the data features including data type, metadata information, sensitivity and creation time; and the extracted data features are converted into a fixed-length feature vector;

[0026] Use the first 64 bits of the feature vector as the initial seed value; perform a shift operation on the initial seed value to obtain a shift result, perform an XOR operation on the shift result and the initial seed value to obtain an XOR result, perform an XOR operation on the XOR result and the initial seed value, that is, iterate once to obtain a new pseudo-random number seed; repeat the iteration N1 times, connect the new pseudo-random number seeds obtained in each iteration to form a fixed-length seed vector;

[0027] Based on the formed seed vector, the binary bit stream is preliminarily segmented to obtain a number of coding blocks; these coding blocks are data blocks.

[0028] Furthermore, the method of performing preliminary segmentation processing on the binary bit stream includes:

[0029] Define a generating polynomial ;in, is an algebraic variable used to construct the algebraic expression of the generating polynomial; and are mutually prime numbers; is a preset prime number; To take the modulus; use the obtained seed vector and pseudo-random number generation algorithm to generate two prime numbers less than the preset of and ; Use the generating polynomial to split the binary bit stream into a number of preliminary data blocks of length k, where k is a preset parameter;

[0030] For each preliminary data block of length k, the generated and , construct a generating polynomial; convert the preliminary data block into a coefficient polynomial f(x); that is, each binary bit of the preliminary data block is used as a coefficient of the coefficient polynomial f(x); substitute f(x) into the generating polynomial, take the modulus p to obtain the remainder r(x), and the coefficient of r(x) is a number of check bits; concatenate the preliminary data block and the check bits to form a coding block; repeatedly divide the entire binary bit stream into a number of coding blocks.

[0031] Furthermore, the method of encrypting each data block using the improved lattice encryption algorithm includes:

[0032] Get the real-time timestamp and construct the timestamp into a bit string; use the encrypted hash function to perform hash operation on the bit string to obtain a random seed; use the pseudo-random number generation algorithm to generate two prime numbers p1 and q1 based on the random seed, calculate a large integer n1=p1×q1 based on the two prime numbers p1 and q1, and fit an Euler function φ(n1)=(p1-1)×(q1-1) based on this, and select an integer e1 that is coprime with the Euler function φ(n1) as the public key exponent; based on the public key exponent and the Euler function φ(n1), calculate a private key exponent d1 such that (d1×e1)%φ(n1)=1;

[0033] Represent the data block as a bit string m1, calculate the bit length l of m1; select a random bit string r, define its length as k1-l-8, where k1 is the block size, construct padding data D1, that is, add a single 1 after m1, and then add r;

[0034] Divide the padding data D1 into a bit string group consisting of a number of small bit strings of equal bit length; divide each small bit string D1_h in the bit string group into V equal sub-blocks; V is an integer greater than 1; where h is the index of the small bit string;

[0035] Perform encryption operation on each sub-block to obtain the corresponding V block encryption results, perform XOR operation on the V block encryption results to obtain an encryption group, and concatenate all the obtained encryption groups to form an encrypted data block;

[0036] The formula for encryption operation is:

[0037] ;in, Indicates the first The block encryption result obtained after encrypting the sub-blocks is After dividing the small bit string D1_h into V equal sub-blocks, The large integer value corresponding to the sub-blocks; is a random number seed; is the bitwise exclusive OR operator, is a cryptographic hash function, is an integer coprime with the Euler function φ(n1), is a random integer.

[0038] Furthermore, the method of combining all encrypted data blocks into an encrypted data stream includes:

[0039] All encrypted data blocks are sorted according to the corresponding formation time to obtain sorted encrypted data blocks, and the sorted encrypted data blocks are concatenated into a long string, which is recorded as pattern string P1; the pattern string P1 is divided into a number of sub-pattern strings according to a fixed length;

[0040] Add a special start mark character before each sub-pattern string; add a special end mark character after each sub-pattern string; the special start mark character and the special end mark character are different; construct the target string T1; for each sub-pattern string, calculate its skip table; the elements in the skip table are the maximum distance to the right that needs to be moved when the character in the target string T1 does not match the last character of the sub-pattern string; use the skip table to simultaneously search for all occurrences of each sub-pattern string in the target string T1, and compare the characters from right to left to obtain the matching positions; for each sub-pattern string, obtain the set Pof of all matching positions in the target string T1; merge all sets Pof to obtain a set Hof containing all matching positions; sort the matching positions in Hof to obtain the sorted matching set;

[0041] A special separator character is inserted before each matching position in the sorted matching set; that is, the target string T1 is divided into several substrings, and each substring corresponds to an encrypted data block; all substrings are concatenated in order to obtain the final encrypted data stream.

[0042] Furthermore, the method of allocating the optimal transmission path and the optimal storage location includes:

[0043] Randomly select a leaf node in the distributed storage network as the starting node s1, and randomly select a leaf node in the distributed storage network as the target node t1; generate N3 turtles, randomly distributed on the leaf nodes in the distributed storage network, and each turtle carries a storage pool;

[0044] All turtles walk on the leaf nodes of the distributed storage network according to the random walk strategy. For the leaf node u1 where the turtle is currently located, the turtle randomly selects a leaf node v1 connected to u1; walking to the leaf node v1 in parallel is called walking one step; after each turtle walks one step, it pauses for one time unit and performs storage operations and acquisition operations; the acquisition operation is performed when the turtle is about to leave the leaf node v1;

[0045] When each turtle walks to a leaf node, it will check whether there are other turtles on the leaf node. If other turtles are found, they will establish an interactive connection with them. After the interactive connection is established, the two turtles exchange the timestamps of the copies of the encrypted data stream in their respective storage pools and the number of steps they have walked. The two interactively connected turtles compare the timestamps of the copies of the encrypted data stream in their respective storage pools. The copy with the earlier timestamp is considered to be more fresh; the copy with the later timestamp is considered to be less fresh.

[0046] The turtle with higher freshness makes a copy of the encrypted data stream in its storage pool to obtain a new copy, updates the timestamp of the new copy to the current time, and transmits the new copy to the turtle with lower freshness; the turtle with lower freshness replaces the copy in its own storage pool with the new copy;

[0047] Preset propagation threshold , count the number of replicas stored on each leaf node, and calculate the sum of the number of replicas of all leaf nodes su;

[0048] like ,in, is the total number of leaf nodes in the distributed storage network, and the turtle stops walking; at this time, for each leaf node g1, count the number of copies stored on it; record it as the number of node copies; find the leaf node g1_max with the largest number of node copies; determine g1_max as the optimal storage location for the encrypted data stream;

[0049] For each turtle, trace back its walking path, and find the shortest path pat with g1_max as the end point among all the walking paths; determine pat as the optimal transmission path from the starting node s1 to the optimal storage location.

[0050] Furthermore, the storage operation is as follows: checking the available storage space of the leaf node v1, if the available storage space is sufficient to store the encrypted data stream, taking a copy of the encrypted data stream from the turtle's storage pool, storing the copy on the leaf node v1, and updating its timestamp, if the available storage space is insufficient to store the encrypted data stream, not performing the storage operation;

[0051] The acquisition operation is: check whether a copy of the encrypted data stream is stored on the leaf node v1. If a copy of the encrypted data stream is stored, obtain a copy from the leaf node v1 and store the obtained copy in the turtle's storage pool. If no copy of the encrypted data stream is stored on the leaf node v1, the turtle's storage pool remains unchanged.

[0052] The technical effects and advantages of the data encryption storage system for Internet security of the present invention are as follows:

[0053] The present invention solves the potential security risks in the process of data storage and transmission, and effectively prevents the risks of data leakage, theft and tampering; by adopting an innovative encryption storage solution, even if the data is intercepted, it cannot be decrypted and obtained, thereby protecting the confidentiality and integrity of Internet data; at the same time, the distributed redundant storage mechanism ensures the high availability of data, greatly reduces the risk of single point failure and attack, and improves the fault tolerance and reliability of the system; secondly, the efficiency of data transmission and storage is optimized; the intelligent path selection algorithm can dynamically discover the optimal transmission path in the network, avoid congestion and delay, and ensure efficient data transmission; at the same time, through adaptive storage location selection, Internet data can be stored in the optimal location in the network, which can be conveniently and quickly accessed and retrieved, thereby improving storage efficiency; furthermore, a high degree of automation and intelligence of data backup is achieved; through the distributed backup propagation mechanism, data copies can be autonomously and efficiently propagated in the network, ensuring the timeliness and freshness of the backup, thereby effectively reducing the risk of data loss and damage; at the same time, obsolete backups can also be automatically removed, saving storage space and improving storage utilization. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A schematic diagram of a data encryption storage system for Internet security according to the present invention;

[0055] Figure 2 A schematic diagram of a data encryption storage method for Internet security according to the present invention. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] Example 1, please refer to Figure 1 As shown, the data encryption storage system for Internet security described in this embodiment includes:

[0058] The network construction module is used to build a distributed storage network and collect data to be encrypted on the Internet;

[0059] A data segmentation module is used to dynamically segment the Internet data to be encrypted into several data blocks;

[0060] A data encryption module is used to encrypt each data block to obtain a corresponding encrypted data block;

[0061] A data combining module, used for combining all encrypted data blocks into an encrypted data stream;

[0062] The dynamic storage module is used to allocate the optimal transmission path and optimal storage location for the encrypted data stream in the distributed storage network to improve the security of data transmission and storage; each module is connected by wired and / or wireless means to achieve data transmission between modules.

[0063] Ways to build a distributed storage network include:

[0064] Preliminarily define the number of nodes and the connection relationship between nodes; each node represents an independent storage device or server; specifically, scan the entire network and collect information about all available nodes, including IP addresses, hardware configurations, geographic locations, etc.; use network mapping tools or protocols (such as SNMP) to automatically discover storage devices and links (connection relationships) in the network; and optimize the connection relationship between nodes, that is, add backup connections to nodes; specifically, represent the nodes in the distributed storage network as vertices in an undirected connected graph. If there is a direct connection (link) between two nodes in the distributed storage network, add an undirected edge between the corresponding vertices, and perform a depth-first search (DFS) or breadth-first search (BFS) on the undirected connected graph. During the depth-first search (DFS) or breadth-first search (BFS) process, mark the discovery time and completion time of each vertex. If the completion times of two vertices connected by an undirected edge are not connected after removing the undirected edge, define the undirected edge as an important edge; the existence of important edges keeps the graph connected.

[0065] Continue to perform depth-first search (DFS) or breadth-first search (BFS) on the undirected connected graph. For each vertex v, calculate the number of vertices that cannot be reached from v, recorded as n_v. If there is an undirected edge connected to vertex v, such that n_v is greater than or equal to 2, then define the corresponding undirected edge as a split edge; the existence of a split edge will cause the graph to be divided into two or more disconnected subgraphs; for the defined important edges and split edges, set the corresponding number of backup connections.

[0066] For the defined important edge e, calculate its importance index , the value range is [0, 1];

[0067] ;in, is the betweenness centrality of the important edge e, is the comprehensive connectivity of important edge e, is the flow of important edge e, is the bandwidth of the important edge e, is the maximum betweenness centrality of all undirected edges in an undirected connected graph, is the maximum flow of all undirected edges in an undirected connected graph, is the maximum bandwidth of all undirected edges in an undirected connected graph; when the values ​​of all factors are the maximum, will be close to 1; when the value of any factor is 0, will be close to 0, which can well quantify and distinguish the importance of different edges; traffic refers to the data flow through the edge (link), which can be measured by the number of bits or bytes transmitted per second; the larger the traffic of an edge, the heavier the communication load of the link, and the more important it is to the network; bandwidth refers to the maximum data transmission capacity that the edge can provide, usually measured by bit rate; the larger the bandwidth, the wider the link is and can carry more data traffic.

[0068] The comprehensive connectivity can be obtained by:

[0069] Add source point s and sink point t to the undirected connected graph, and connect all vertices in the undirected connected graph with source point s and sink point t to construct a flow network G'; for all edges in the flow network G' that are not directly connected to source point s and sink point t, set their capacity to 1, and for all edges in the flow network G' that are directly connected to source point s and sink point t, set their capacity to infinity; on the flow network G', use a network flow algorithm (such as the Ford-Fulkerson algorithm or the Edmonds-Karp algorithm) to calculate the maximum flow value from source point s to sink point t, and use the maximum flow value as the comprehensive connectivity of important edges e; the maximum flow value is actually the maximum number of edges that can be removed without destroying the connectivity of the graph.

[0070] For important edges e, based on the importance index calculated ,set up backup connections; ;in, Represents the total number of vertices in an undirected connected graph; represents the rounding up function; the number of backup connections is between 1 and 3; for the defined split edge q, it is defined that after removing the split edge q, the undirected connected graph is divided into two subgraphs and ; Based on two subgraphs and Calculate its split degree index ;

[0071] ;in, For subgraph The number of vertices, For subgraph The number of vertices; It is the maximum subgraph size difference caused by all split edges in the undirected connected graph (the absolute value of the difference in the number of vertices); For two subgraphs and The shortest distance between nodes. is the maximum distance between any two vertices in an undirected connected graph; and is the weight coefficient, and the sum is 1; it is used to adjust the importance of each factor;

[0072] For the split edge q, based on the calculated split degree index ,set up backup connections; .

[0073] According to the optimized connection relationship, update the routing table and firewall rules of each node; establish or remove the corresponding physical connection in the actual network; select any node as the root node to build a distributed storage network; specifically, define the number of child nodes m for each non-leaf node; usually set to 2 or more; starting from the root node, create m child nodes for the root node, and these child nodes will serve as non-leaf nodes of the next layer; for each newly created non-leaf node, repeatedly create m child nodes for it until the preset network depth is reached; when storing data subsequently, store the data in a dispersed manner on the leaf nodes of the distributed storage network; each leaf node stores a part of the data, and a leaf node is a node without any child nodes.

[0074] The process of collecting Internet data to be encrypted includes:

[0075] Establish a data collector, obtain raw data from the data source according to the preset collection method, filter the collected raw data, and remove unnecessary data; the filtering conditions can be data size, format, keywords, etc.; mark the raw data after filtering and add metadata information; for example, metadata includes data source, collection time, data type, sensitivity, etc.; store the marked data in a temporary storage medium, such as a memory buffer or disk; the data storage format can be a file, database, etc.

[0076] Methods for dynamically dividing Internet data to be encrypted into several data blocks include:

[0077] The Internet data to be encrypted is defined as a binary bit stream of length n; and data features of the Internet data to be encrypted are extracted, the data features including data type, metadata information, sensitivity and creation time; the data type is determined according to the file extension, MIME type or internal structure of the data, such as text file, image, video, audio, compressed file, etc.; different types of data have different features; metadata information such as file name, modification time, copyright information, geographic location information, etc.; the extracted data features are converted into a fixed-length feature vector, for example, it is hashed into a binary string of a fixed length (such as 256 bits); the first 64 bits of the feature vector are used as the initial seed value; the initial seed value is shifted to obtain a shift result, the shift result is XORed with the initial seed value to obtain an XOR result, the XOR result is XORed with the initial seed value, that is, iterated once to obtain a new pseudo-random number seed; the iteration is repeated N1 times (N1 is the required seed length, such as 256 bits), and the new pseudo-random number seeds obtained in each iteration are connected to form a fixed-length seed vector; based on the formed seed vector, the binary bit stream is preliminarily segmented to obtain a number of coding blocks.

[0078] It should be explained that the shift operation is to shift the binary bits of the initial seed value 13 bits to the left; the XOR operation is for two binary bits, if they are the same, the result is 0, if they are different, the result is 1; the sensitivity is filtered and matched through a pre-defined vocabulary, if it contains sensitive words, it will be marked as highly sensitive data, or based on a large number of labeled data samples, the machine learning model is trained to automatically determine the sensitivity of the data.

[0079] Specifically, define a generating polynomial ;in, is an algebraic variable used to construct the algebraic expression of the generating polynomial; and are coprime numbers (binomial coefficient and constant); is a preset prime number; To take the modulus.

[0080] Use the obtained seed vector and a pseudo-random number generation algorithm (such as the Blum Blum Shub algorithm) to generate two prime numbers less than the preset value. of and ; Use the generating polynomial to split the binary bit stream into a number of preliminary data blocks of length k, where k is a preset parameter, usually 8 or greater.

[0081] For each preliminary data block of length k, the generated and , construct a generating polynomial; convert the preliminary data block into a coefficient polynomial f(x); that is, each binary bit of the preliminary data block is used as a coefficient of the coefficient polynomial f(x); substitute f(x) into the generating polynomial, take the modulus p to obtain the remainder r(x), and the coefficient of r(x) is a number of check bits; concatenate the preliminary data block and the check bits to form a coding block; repeatedly divide the entire binary bit stream into a number of coding blocks; these coding blocks are data blocks.

[0082] The methods of encrypting each data block using the improved lattice encryption algorithm include:

[0083] Get a real-time timestamp accurate to milliseconds or smaller time units; construct the timestamp into a bit string; use a cryptographic hash function (such as SHA-256) to hash the bit string to obtain a random seed; use a pseudo-random number generation algorithm (such as the Blum Blum Shub algorithm) to generate two prime numbers p1 and q1 based on the random seed, and calculate a large integer n1=p1×q1 based on the two prime numbers p1 and q1, and fit an Euler function φ(n1)=(p1-1)×(q1-1) based on this, and select an integer e1 that is coprime with the Euler function φ(n1) as a public key exponent; based on the public key exponent and the Euler function φ(n1), calculate a private key exponent d1 such that (d1×e1)%φ(n1)=1.

[0084] Represent the data block as a bit string m1, calculate the bit length l of m1; select a random bit string r, define its length as k1-l-8, where k1 is the block size (usually 1024 bits), construct the padding data D1, that is, add a single 1 after m1, and then add r.

[0085] Divide the padding data D1 into a bit string group consisting of several small bit strings of equal bit length; divide each small bit string D1_h in the bit string group into V equal sub-blocks; V is an integer greater than 1; where h is the index of the small bit string; perform encryption operation on each sub-block to obtain the corresponding V block encryption results, perform XOR operation on the V block encryption results to obtain an encryption group, and concatenate all the obtained encryption groups to form an encrypted data block.

[0086] The formula for encryption operation is:

[0087] ;in, Indicates the first The block encryption result obtained after encrypting the sub-blocks is After dividing the small bit string D1_h into V equal sub-blocks, The large integer value corresponding to the sub-blocks; is a random number seed used to generate a different mask for each sub-block; is the bitwise exclusive OR operator, It is a cryptographic hash function, such as SHA-256. Modular operations can limit the power calculation of very large integers to a certain range of values, thereby achieving encryption. is an integer coprime with the Euler function φ(n1), is a random integer; at the same time, it is known , and , but it is difficult to Deduction , which ensures the security of encryption.

[0088] The way to combine all encrypted data blocks into an encrypted data stream includes:

[0089] All encrypted data blocks are sorted according to the corresponding formation time to obtain sorted encrypted data blocks, and the sorted encrypted data blocks are concatenated into a long string, recorded as pattern string P1; the pattern string P1 is divided into several sub-pattern strings according to a fixed length.

[0090] Add a special start mark character, such as #, before each sub-pattern string; add a special end mark character, such as $, after each sub-pattern string; the special start mark character and the special end mark character are different; construct the target string T1; for each sub-pattern string, calculate its skip table; the elements in the skip table are the maximum distance to the right that needs to be moved when the character in the target string T1 does not match the last character of the sub-pattern string.

[0091] Use a skip table to search for all occurrences of each sub-pattern string in the target string T1 at the same time, and compare characters from right to left to obtain matching positions; for each sub-pattern string, obtain a set Pof of all matching positions in the target string T1; merge all sets Pof to obtain a set Hof containing all matching positions; sort the matching positions in Hof to ensure the orderliness of the matching positions, and obtain a sorted matching set.

[0092] Before each matching position in the sorted matching set, a special separator character, such as &, is inserted; that is, the target string T1 is divided into several substrings, and each substring corresponds to an encrypted data block; all substrings are concatenated in order to obtain the final encrypted data stream.

[0093] Ways to allocate the optimal transmission path and the optimal storage location include:

[0094] A leaf node is randomly selected in the distributed storage network as the starting node s1, and a leaf node is randomly selected in the distributed storage network as the target node t1; N3 turtles are generated and randomly distributed on the leaf nodes in the distributed storage network, and each turtle carries a storage pool for temporarily storing a copy of the encrypted data stream.

[0095] All turtles walk on the leaf nodes of the distributed storage network according to the Random Walk strategy. For the leaf node u1 where the turtle is currently located, the turtle randomly selects a leaf node v1 connected to u1; walking to the leaf node v1 in parallel is considered a step; after each turtle walks a step, it pauses for one time unit and performs storage and retrieval operations; the retrieval operation is performed when the turtle is about to leave the leaf node v1.

[0096] The storage operation is: check the available storage space of the leaf node v1. If the available storage space is sufficient to store the encrypted data stream, take a copy of the encrypted data stream from the turtle's storage pool, store the copy on the leaf node v1, and update its timestamp. If the available storage space is insufficient to store the encrypted data stream, no storage operation is performed.

[0097] The acquisition operation is: check whether a copy of the encrypted data stream is stored on the leaf node v1. If a copy of the encrypted data stream is stored, obtain a copy from the leaf node v1 and store the obtained copy in the turtle's storage pool. If no copy of the encrypted data stream is stored on the leaf node v1, the turtle's storage pool remains unchanged.

[0098] It should be noted that the storage pool of each turtle is limited in size and is used to temporarily store data stream copies. When the storage pool is full, if a new data stream copy is needed, the oldest copy in the storage pool is deleted. When the storage pool is empty, if a new data stream copy needs to be stored, the copy is obtained from other nodes and then stored. Each time a data stream copy is stored or obtained, the timestamp of the copy is updated. The timestamp is used to determine the freshness of the copy, and copies with high freshness will be propagated first.

[0099] When each turtle walks to a leaf node, it will check whether there are other turtles on the leaf node. If other turtles are found, an interactive connection will be established with them. After the interactive connection is established, the two turtles exchange the timestamps of the copies of the encrypted data streams in their respective storage pools and the lengths (number of steps) of their respective walks, that is, exchange information.

[0100] The two interactively connected turtles compare the timestamps of the copies of the encrypted data stream in their respective storage pools. The copy with an earlier timestamp is considered to be fresher; the copy with a later timestamp is considered to be less fresh; the turtle with a higher freshness makes a copy of the encrypted data stream in its storage pool to obtain a new copy, updates the timestamp of the new copy to the current time, and transmits the new copy to the turtle with a lower freshness; the turtle with a lower freshness replaces the copy in its own storage pool with the new copy.

[0101] It should be noted that when exchanging information, the two turtles will also compare the lengths of their respective walking paths. The turtle with the shorter path is considered to be closer to the optimal path; the turtle with the longer path will adjust its next walking direction to walk towards the turtle with the shorter path.

[0102] Preset propagation threshold , count the number of replicas stored on each leaf node, and calculate the sum of the number of replicas of all leaf nodes su;

[0103] like ,in, is the total number of leaf nodes in the distributed storage network, the turtle stops walking; at this time, for each leaf node g1, count the number of copies stored on it; record it as the number of node copies; find the leaf node g1_max with the largest number of node copies; determine g1_max as the optimal storage location for the encrypted data stream; for each turtle, backtrack its walking path, and find the shortest path pat with g1_max as the end point among all the walking paths; determine pat as the optimal transmission path from the starting node s1 to the optimal storage location.

[0104] This embodiment solves the security risks in the process of data storage and transmission, and effectively prevents the risks of data leakage, theft and tampering; by adopting an innovative encryption storage solution, even if the data is intercepted, it cannot be decrypted and obtained, thereby protecting the confidentiality and integrity of Internet data; at the same time, the distributed redundant storage mechanism ensures the high availability of data, greatly reduces the risk of single point failure and attack, and improves the fault tolerance and reliability of the system; secondly, the efficiency of data transmission and storage is optimized; the intelligent path selection algorithm can dynamically discover the optimal transmission path in the network, avoid congestion and delay, and ensure efficient data transmission; at the same time, through adaptive storage location selection, Internet data can be stored in the optimal location in the network, which can be accessed and retrieved conveniently and quickly, thereby improving storage efficiency; furthermore, a high degree of automation and intelligence of data backup is achieved; through the distributed backup propagation mechanism, data copies can be autonomously and efficiently propagated in the network, ensuring the timeliness and freshness of the backup, thereby effectively reducing the risk of data loss and damage; at the same time, old backups can also be automatically removed, saving storage space and improving storage utilization.

[0105] Example 2, please refer to Figure 2 As shown, the part not described in detail in this embodiment is described in Example 1, which provides a data encryption storage method for Internet security, including:

[0106] Step 1: Build a distributed storage network and collect data to be encrypted from the Internet;

[0107] Step 2, dynamically dividing the Internet data to be encrypted into several data blocks;

[0108] Step 3: Encrypt each data block to obtain a corresponding encrypted data block;

[0109] Step 4: combine all encrypted data blocks into an encrypted data stream;

[0110] Step 5: Allocate an optimal transmission path and an optimal storage location for the encrypted data stream in the distributed storage network to improve the security of data transmission and storage.

[0111] Embodiment 3, this embodiment discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the operation mode of the above-mentioned Internet-oriented security data encryption storage method is implemented.

[0112] Since the electronic device introduced in this embodiment is an electronic device used to implement a data encryption storage method for Internet security in the embodiment of this application, based on the data encryption storage method for Internet security introduced in the embodiment of this application, the technical personnel of this field can understand the specific implementation of the electronic device of this embodiment and its various variations, so how the electronic device implements the method in the embodiment of this application is not described in detail here. As long as the technical personnel of this field implement the electronic device used in the data encryption storage method for Internet security in the embodiment of this application, it belongs to the scope of protection of this application.

[0113] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0114] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technical users in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A data encryption storage system for Internet security, characterized in that: include: The network construction module is used to build a distributed storage network and collect data to be encrypted on the Internet; A data segmentation module is used to dynamically segment the Internet data to be encrypted into several data blocks; A data encryption module is used to encrypt each data block to obtain a corresponding encrypted data block; A data combining module, used for combining all encrypted data blocks into an encrypted data stream; A dynamic storage module is used to allocate an optimal transmission path and an optimal storage location for encrypted data streams in a distributed storage network; each module is connected by wired and / or wireless means; The method of constructing a distributed storage network includes: Preliminarily define the number of nodes and the connection relationship between nodes; each node represents an independent storage device or server; and optimize the connection relationship between nodes, that is, add backup connections to the nodes; according to the optimized connection relationship, select any node as the root node, and define the number of child nodes m for each non-leaf node; starting from the root node, create m child nodes for the root node, and these child nodes will serve as non-leaf nodes of the next layer; for each newly created non-leaf node, repeatedly create m child nodes for it until the preset network depth is reached; and obtain a distributed storage network; The method of encrypting each data block includes: Obtain a real-time timestamp and construct the timestamp into a bit string; use a cryptographic hash function to perform a hash operation on the bit string to obtain a random seed; use a pseudo-random number generation algorithm to generate two prime numbers p1 and q1 based on the random seed, calculate a large integer n1=p1×q1 based on the two prime numbers p1 and q1, and fit an Euler function φ(n1)=(p1-1)×(q1-1) based on this, and select an integer e1 that is relatively prime to the Euler function φ(n1) as a public key exponent; based on the public key exponent and the Euler function φ(n1), calculate a private key exponent d1 such that (d1×e1)%φ(n1)=1; Perform encryption operation on each sub-block to obtain the corresponding V block encryption results, perform XOR operation on the V block encryption results to obtain an encryption group, and concatenate all the obtained encryption groups to form an encrypted data block; The formula for encryption operation is: C(h,c)=((D(h,c)e 1 )⊕H(D(h,c)||r1))e 2 (mod n1); where C(h,c) represents the block encryption result obtained by encrypting the cth sub-block of the small bit string D1_h, D(h,c) is the large integer value corresponding to the cth sub-block after the small bit string D1_h is divided into V equal sub-blocks; r1 is a random number seed; ⊕ is a bitwise XOR operator, H() is a cryptographic hash function, e1 is an integer coprime with the Euler function φ(n1), and e2 is a random integer.

2. The data encryption storage system for Internet security according to claim 1, characterized in that: The method of adding a backup connection to a node includes: The nodes in the distributed storage network are represented as vertices in an undirected connected graph. If there is a direct connection between two nodes in the distributed storage network, an undirected edge is added between the corresponding vertices. A depth-first search or a breadth-first search is performed on the undirected connected graph. During the depth-first search or breadth-first search, the discovery time and the completion time of each vertex are marked. If the completion times of two vertices connected by an undirected edge are not connected after the undirected edge is removed, the undirected edge is defined as an important edge. Continue to perform depth-first search or breadth-first search on the undirected connected graph. For each vertex v, calculate the number of vertices that cannot be reached from v, recorded as n_v. If there is an undirected edge connected to vertex v, such that n_v is greater than or equal to 2, then define the corresponding undirected edge as a split edge; for the defined important edges and split edges, set the corresponding number of backup connections.

3. The data encryption storage system for Internet security according to claim 2, characterized in that: The method of setting a corresponding number of backup connections for the defined important edges and split edges includes: For important edge e, calculate its importance index I_e, with a value range of [0, 1]; Among them, BC(e) is the betweenness centrality of important edge e, EC(e) is the comprehensive connectivity of important edge e, T(e) is the flow of important edge e, B(e) is the bandwidth of important edge e, BC_max is the maximum betweenness centrality of all undirected edges in the undirected connected graph, T_max is the maximum flow of all undirected edges in the undirected connected graph, and B_max is the maximum bandwidth of all undirected edges in the undirected connected graph; The comprehensive connectivity can be obtained by: Add source point s and sink point t to the undirected connected graph, and connect all vertices in the undirected connected graph with source point s and sink point t to construct a flow network G'; for all edges in the flow network G' that are not directly connected to source point s and sink point t, set their capacity to 1, and for all edges in the flow network G' that are directly connected to source point s and sink point t, set their capacity to infinity; On the flow network G', the network flow algorithm is used to calculate the maximum flow value from the source point s to the sink point t, and the maximum flow value is used as the comprehensive connectivity of the important edge e; For an important edge e, N_e backup connections are set based on the calculated importance index I_e; N_e = ceil(I_e×(log(N)+1)); where N represents the total number of vertices in the undirected connected graph; ceil() represents a round-up function; For the split edge q, it is defined that after removing the split edge q, the undirected connected graph is divided into two subgraphs G1 and G2; based on the two subgraphs G1 and G2, the split degree index J_q is calculated; Wherein, N(G1) is the number of vertices in subgraph G1, and N(G2) is the number of vertices in subgraph G2; Δ_max is the maximum subgraph size difference caused by all split edges in the undirected connected graph; D(G1, G2) is the shortest distance between two subgraphs G1 and G2; D_max is the maximum distance between any two vertices in the undirected connected graph; w1 and w2 are weight coefficients, and their sum is 1; for the split edge q, based on the calculated split degree index J_q, set N_q backup connections; N_q=ceil(J_q×(log(N)+1)).

4. The data encryption storage system for Internet security according to claim 3 is characterized in that: Methods for dynamically dividing Internet data to be encrypted into several data blocks include: The Internet data to be encrypted is defined as a binary bit stream of length n; and data features of the Internet data to be encrypted are extracted, the data features including data type, metadata information, sensitivity and creation time; and the extracted data features are converted into a fixed-length feature vector; Use the first 64 bits of the feature vector as the initial seed value; perform a shift operation on the initial seed value to obtain a shift result, perform an XOR operation on the shift result and the initial seed value to obtain an XOR result, perform an XOR operation on the XOR result and the initial seed value, that is, iterate once to obtain a new pseudo-random number seed; repeat the iteration N1 times, connect the new pseudo-random number seeds obtained in each iteration to form a fixed-length seed vector; based on the formed seed vector, perform a preliminary segmentation process on the binary bit stream to obtain a number of coding blocks; these coding blocks are data blocks.

5. The data encryption storage system for Internet security according to claim 4, characterized in that: The method of performing preliminary segmentation processing on the binary bit stream includes: Define a generating polynomial g(x) = x 2 +a×x+b(mod p); x is an algebraic variable used to construct an algebraic expression for generating a polynomial; a and b are coprime numbers; p is a preset prime number; mod is modulus; Use the obtained seed vector and pseudo-random number generation algorithm to generate two a and b that are less than a preset prime number p; use the generating polynomial to divide the binary bit stream into a number of preliminary data blocks with a length of k, where k is a preset parameter; for each preliminary data block with a length of k, use the generated a and b to construct a generating polynomial; convert the preliminary data block into a coefficient polynomial f(x); that is, each binary bit of the preliminary data block is used as a coefficient of the coefficient polynomial f(x); substitute f(x) into the generating polynomial, take modulus p to obtain a remainder r(x), and the coefficient of r(x) is a number of check bits; splice the preliminary data block and the check bit to form a coding block; repeatedly divide the entire binary bit stream into a number of coding blocks.

6. The data encryption storage system for Internet security according to claim 5, characterized in that: The method of allocating the optimal transmission path and the optimal storage location includes: Randomly select a leaf node in the distributed storage network as the starting node s1, and randomly select a leaf node in the distributed storage network as the target node t1; generate N3 turtles, randomly distributed on the leaf nodes in the distributed storage network, and each turtle carries a storage pool; All turtles walk on the leaf nodes of the distributed storage network according to the random walk strategy. For the leaf node u1 where the turtle is currently located, the turtle randomly selects a leaf node v1 connected to u1; walking to the leaf node v1 in parallel is called walking one step; after each turtle walks one step, it pauses for one time unit and performs storage operations and acquisition operations; the acquisition operation is performed when the turtle is about to leave the leaf node v1; when each turtle walks to a leaf node, it checks whether there are other turtles on the leaf node. If other turtles are found, an interactive connection is established with them; after establishing an interactive connection, the two turtles exchange the timestamps of the copies of the encrypted data stream in their respective storage pools and the number of steps they have walked; the two interactively connected turtles compare the timestamps of the copies of the encrypted data stream in their respective storage pools, and the copy with the earlier timestamp is considered to be more fresh; the copy with the later timestamp is considered to be less fresh; The turtle with higher freshness makes a copy of the encrypted data stream in its storage pool to obtain a new copy, updates the timestamp of the new copy to the current time, and transmits the new copy to the turtle with lower freshness; the turtle with lower freshness replaces the copy in its own storage pool with the new copy; Preset the propagation threshold θ, count the number of replicas stored on each leaf node, and calculate the sum of the number of replicas of all leaf nodes su; like Where N4 is the total number of leaf nodes in the distributed storage network, and the turtle stops walking; at this time, for each leaf node g1, count the number of copies stored on it; record it as the number of node copies; find the leaf node g1_max with the largest number of node copies; determine g1_max as the optimal storage location for the encrypted data stream; For each turtle, trace back its walking path, and find the shortest path pat with g1_max as the end point among all the walking paths; determine pat as the optimal transmission path from the starting node s1 to the optimal storage location.

7. The data encryption storage system for Internet security according to claim 6, characterized in that: The storage operation is as follows: check the available storage space of the leaf node v1. If the available storage space is sufficient to store the encrypted data stream, take a copy of the encrypted data stream from the turtle's storage pool, store the copy on the leaf node v1, and update its timestamp. If the available storage space is insufficient to store the encrypted data stream, do not perform the storage operation. The acquisition operation is: check whether a copy of the encrypted data stream is stored on the leaf node v1. If a copy of the encrypted data stream is stored, obtain a copy from the leaf node v1 and store the obtained copy in the turtle's storage pool. If no copy of the encrypted data stream is stored on the leaf node v1, the turtle's storage pool remains unchanged.

Images